Cyber Automation

Automated Threat Response (SOAR/EDR)

Independent Infrastructure Project | June 2026 – Present

LimaCharlie Tines Slack API Email Webhooks Incident Response

Executive Summary

The Challenge: Security Operations Center (SOC) analysts suffer from "alert fatigue." Manually triaging, investigating, and responding to every endpoint alert is slow and tedious, which drastically increases the Mean Time to Respond (MTTR) during an actual cyber attack.

The Solution: I architected a multi-channel automated incident response playbook. LimaCharlie (EDR) monitors devices and fires alerts to Tines (SOAR). Tines instantly orchestrates notifications across Slack and Email, while simultaneously generating a secure "User Prompt" portal for the analyst to review the threat data.

The Impact: Analysts no longer log into multiple portals to gather context. They receive the alert and can authorize an "Isolate Host" command directly via the Tines user prompt. If approved, the playbook automatically severs the infected machine's network connection and verifies the isolation status, neutralizing the threat in seconds.

Playbook Orchestration Flow

flowchart TD A[LimaCharlie] -->|Detection Alert| B(Tines Webhook) B --> C[Slack: Send Msg with Details] B --> D[Email: Send Msg with Details] B --> E[Tines: User Prompt Page] E --> F{Isolate?} F -->|Condition: Yes| G[HTTP Request: Isolate Sensor] G --> H[HTTP Request: Get Isolation Status] H --> I[Slack: Send Confirmation Msg] F -->|Condition: No| J[Slack: Prompt Further Investigation]

Automated workflow reflecting the Tines storyboard implementation.

Technical Implementation (Deep Dive)

1. Detection & Ingestion

The workflow begins with custom Detection and Response (D&R) rules configured in LimaCharlie. When a malicious behavior is detected on an endpoint, LimaCharlie fires a JSON payload containing critical Indicators of Compromise (IOCs)—such as IP, file hash, and command line arguments—to a Webhook trigger in Tines.

2. Multi-Channel Alerting (Tines)

Once Tines receives the payload, it parses the JSON and simultaneously branches out into three distinct actions:

  • Slack Integration: Sends a formatted alert message directly to the SOC channel.
  • Email Integration: Sends a detailed summary via email for compliance and offline review.
  • User Prompt Generation: This is the core "Human-in-the-Loop" mechanism. Tines dynamically generates a secure, web-based form containing the parsed IOCs and a strict Yes/No submit button asking: "Do you wish to isolate this machine?"

3. Conditional Remediation & Verification

The playbook waits for the analyst to submit the User Prompt. Depending on the input, Tines routes the flow using logic conditions:

Condition: NO (False Positive)
If the analyst determines the alert is benign, Tines routes to a Slack action that logs the decision and prompts the team that further manual investigation is required, effectively closing the automated loop without impacting the user's machine.

Condition: YES (True Positive)
If isolation is approved, Tines executes an authenticated HTTP Request back to the LimaCharlie API targeting the specific Sensor ID. It issues the isolation command to sever network connectivity. Crucially, I implemented a follow-up HTTP Request to poll LimaCharlie for the Isolation Status. Only after verifying the machine is successfully quarantined does Tines send a final Slack message confirming the successful remediation to the SOC team.

Interested in discussing security engineering and automation?

Get In Touch