SOAR gets sold as the solution to alert fatigue. In practice, a poorly implemented SOAR makes alert fatigue worse — it creates automation that fires incorrectly, closes things it shouldn't, and forces analysts to babysit the automation instead of working actual alerts.

After seeing this fail multiple times and eventually get it working correctly, the pattern is clear: SOAR is powerful for a specific category of alert and useless or dangerous for another. The mistake is treating it as a blanket solution rather than a precision tool.

Free Download
SOC Alert Triage Checklist
Severity matrix, 5-phase triage process, critical Event IDs, Splunk quick reference. One page, instant download.
Get Free Checklist →

The Automation Readiness Test

Before automating any alert type, it has to pass four criteria. All four, not three of four.

  1. False positive rate under 5% — if 1 in 20 alerts is a real threat, automating closure will miss real incidents. Run the alert manually for 30 days and measure the actual FPR before automating.
  2. Decision logic is deterministic — if a human analyst would make the same decision given the same data every time, it can be automated. If the decision requires judgment about context that isn't in the alert data, it can't.
  3. Failure mode is safe — if the automation fails or makes an error, what's the worst case? Automated containment actions that fail in the wrong direction (isolating a production server incorrectly) are higher risk than enrichment actions that fail silently.
  4. The action is reversible — automated enrichment (adding context to a ticket) is always reversible. Automated containment (isolating a host, disabling an account) is only acceptable if there's a clear, tested reversal procedure that doesn't require manual escalation.
Start with enrichment, not action

The safest first automation is enrichment-only: when an alert fires, automatically pull threat intel, look up the user's last 30 days of activity, check if the host has had recent vulnerabilities, and attach all of it to the ticket. The analyst still makes the decision — they just make it with more context, faster. This builds trust in the automation before you give it any action authority.

What Works Well for Automation

✓
Threat intel enrichment
On any alert with an IP, domain, file hash, or URL — automatically query threat intel feeds, VirusTotal, and your internal blocklists. Attach results to the ticket. Zero risk, significant time saving per analyst per day.
✓
Known false positive closure
If an alert has fired 50 times in the last 30 days from the same source, for the same reason, and been closed as a false positive every time — automate the closure with a clear disposition note. Requires a maintained allowlist with ticket references for every entry.
✓
User and host context pull
When a user or host appears in an alert, automatically pull: account status, department, manager, last login, recent alerts involving this entity, open tickets. Saves 5-10 minutes per alert that the analyst would spend pivoting manually.
✓
Phishing URL detonation
On phishing alerts, automatically extract URLs from the email, submit to a sandbox, and attach the detonation report to the ticket. Deterministic, reversible, saves significant analyst time on the most common alert type.

What Doesn't Work for Automation

✗
Behavioral anomaly alerts
Alerts based on deviation from baseline — unusual login time, new device, access outside normal scope — require human judgment about whether the context makes the anomaly legitimate. The same "unusual login" looks different for someone who just started a new role vs someone whose account was just compromised.
✗
Automated host isolation on first trigger
Isolating a host automatically based on a single alert is almost always wrong. The FPR for most individual detection rules is too high. The exception is specific, near-zero-FPR alerts like confirmed ransomware file creation or confirmed Mimikatz execution — and even then, the automation should require a second corroborating signal.
✗
Automated account disabling
Disabling an account automatically affects a real person and their ability to work. The false positive risk combined with the business impact of the action makes this a human decision in almost every case. The only exception is clear credential compromise with confirmed malicious use — and that still should have a human in the loop before disabling a service account.

Building the First Automation: Phishing Triage

Phishing is the best first automation target because the triage steps are deterministic, the action (close as false positive vs escalate) is binary, and the volume justifies the investment. Here's the logic that works:

  1. Alert fires on a reported phishing email or a suspicious email detection from Defender
  2. Automation extracts sender, subject, all URLs, all attachments
  3. Automation checks sender against known-bad domains and your internal blocklist
  4. Automation submits URLs to sandbox and waits for detonation result
  5. If any indicator is confirmed malicious — escalate to analyst with pre-filled ticket containing all enrichment data
  6. If all indicators are clean and sender is in your allowlist — auto-close with disposition "Benign True Positive — confirmed clean by sandbox and threat intel"
  7. Everything else — route to analyst queue with enrichment attached
Measure before and after

Track average analyst time per phishing ticket before automation and after. If the automation is working correctly, that number drops significantly on clean-close tickets and stays the same or improves on escalated tickets (because the analyst gets a pre-enriched ticket instead of starting from scratch). If analyst time goes up, the automation is creating more work than it saves.

Weekly Intelligence Pack
SOC operations depth every Tuesday

Every Tuesday issue includes a production detection rule, real incident case study, hunt hypothesis, and a career tip — the kind of operational depth that comes from 10 years of real SOC work, not vendor documentation. Monthly Office Hours included for direct questions.

Join — $14.99/mo SOC Starter Kit — $39
Founding member pricing locked for life · 30-day money back