Skip to main content

Security Automation Is More Than Saving Clicks

· 2 min read

When a security analyst investigates an unknown IP address or domain, one of the first steps is usually to check it against a threat intelligence provider. You can automate that lookup with a button. The analyst clicks it, the IOC is sent to the provider, and the result appears in the interface.

That's useful.

But is it automation?

Not really.

You saved a few clicks and probably a few seconds. That's useful, but I think good security automation should go one step further: it should remove a decision, not just a manual action.

Let's look at what the analyst actually does.

A TI provider will usually return information about the IOC such as:

  • Confidence in the underlying source
  • Context about the IOC and its activity
  • How recent that activity is

The analyst uses these signals to answer one question:

"Is this IOC worth investigating?"

So instead of just automating the lookup, we can model that decision with a scoring logic.

A scoring model can combine source confidence, context, and recency into a single score. A threshold then determines whether the IOC needs attention.

The analyst no longer needs to perform the same triage for every IOC.

We've removed the decision from the workflow.

But how can you trust your CTI provider that much? You don't have to. Use multiple sources, including open-source and score the yourself too.

And if you want to do it in scale I invite you to read this article Building a custom ETL pipeline for security data by Alexander Bolshakov.

This is where security and data engineering can work together to build something truly powerful.

I'm not saying that simple button automation isn't useful. It's just not the best we can do.

The best automations aren't necessarily the ones that save the most clicks.

They're the ones that make the analyst's decision unnecessary.