The Red Flavour of SOC Automation: Adversary Emulation for Automated Defense
Nicolas Mattiocco explores how automated adversary emulation feeds directly into Security Operations Center (SOC) playbooks and SOAR detection engineering.
Summary
The Expanding Challenge of Modern SOC Operations
Security Operations Centers face massive alert volumes and complex attack surfaces, necessitating automated orchestration and continuous validation of security playbooks.
Integrating Red Team Emulation with SOAR Platforms
Nicolas Mattiocco demonstrates triggering automated attack simulations to test Security Orchestration, Automation, and Response (SOAR) playbooks in real time.
Measuring Detection Latency and Response Efficacy
The author explains how synthetic attack telemetry allows SOC engineering teams to evaluate mean time to detect (MTTD) and refine automated containment actions.
Fostering Continuous Purple Team Collaboration
The presentation provides frameworks for automating detection validation and aligning defensive automation with mapped MITRE ATT&CK techniques.
Related talks
Blue Team Village·1 hr 5 min
Olaf Hartong · Mauricio Velazco
Presents open-source tooling and methodologies to measure defensive coverage and test detection engineering pipelines.
Red Team Village·55 min
Chris Cottrell
Chris Cottrell introduces the Guerrilla Red Team methodology, empowering distributed engineering teams to act as trusted internal ethical hackers.
Red Team Village·35 min
Erdener Uyan · Gökberk Gülgün
Erdener Uyan and Gökberk Gülgün present an open-source machine learning framework for generating dynamic, automated red team attack scenarios.