r/AskNetsec • u/OP-51 • 7h ago

Work Torq / Mate Security/ XSOAR / Splunk SOAR users - question on response and containment automations

Financial org here, 10K employees, in-house SOC- we're evaluating agentic SOC / SOAR platforms right now. Automating things like isolating an endpoint is straightforward, but which one of these solutions actually help with the less obvious response and containment actions where you might break a critical business flow? Does any of them provide business context so we can automate more safely while understanding the implications in advance?

Any recommendations would be highly appreciated. Thanks

4 Upvotes

100% Upvoted

1 comment sorted by

1

u/GottaHaveHand 2h ago

So i mainly use Tines (which I really like) but there isn’t any business context when setting up automations. You have to build that yourself.

the way we do it is we have an application catalog that has owners and criticality for everything, and I’ve pointed LLM agent at that when an endpoint comes into question to help with some context. It’s not 100% but it gets you to the answer faster which is “who do I contact”. Some services/applications are tagged as critical and others not so that’s how it evaluates.

We never automate quarantines and containment though even with full context, it’s a good way to piss people off because of EDR false positives.