Automate the enrichment and leave the decision alone

short · 40 min · Objective 4.7

Task

Write a playbook that gathers everything an analyst needs about an alert and stops short of acting on it. Automating the reversible and informational, and requiring a human for the destructive, is the pattern the lesson recommends — and building it is how the distinction becomes obvious.

Steps

  1. Create the alert input: a JSON file describing a suspicious event — a source address, a username, a process name and a timestamp.
  2. Write /tmp/enrich.sh: given that file, it gathers context from your own lab — who owns the address from the inventory, that user's recent authentication history, what else that process did, and whether the address appears in any other log.
  3. Have it write a single enriched summary to /tmp/enriched.json, and open a ticket record in /tmp/tickets/.
  4. Deliberately stop there. Add a clearly-marked section listing the actions it did NOT take — disable the account, isolate the host, block the address — each with the reason it requires a human.
  5. Time it: run the playbook and compare its elapsed time against doing the same lookups by hand.
  6. Write /tmp/playbook.md with both timings and the rule you would apply for deciding which future actions are safe to automate.

Verify

bash /tmp/enrich.sh /tmp/alert.json && echo "playbook exit 0"
python3 - <<'PY'
import json
d=json.load(open('/tmp/enriched.json'))
need={'owner','auth_history','process_context','other_sightings','proposed_actions'}
missing=need-set(d)
print('enrichment fields present:',sorted(set(d)&need))
assert not missing, 'missing enrichment: '+', '.join(sorted(missing))
assert d['proposed_actions'], 'no proposed actions listed'
assert all('requires_human' in a for a in d['proposed_actions']), \
    'an action was not marked for human approval'
print('every proposed action requires approval')
PY
ls /tmp/tickets/ | wc -l

The assertion that every proposed action is marked requires_human is the point of the lab. A playbook that gathers context and proposes actions is useful on day one; the same playbook taking those actions on a medium-confidence alert is how an automated response disables an executive's account during a board meeting.

Notes

The timing comparison is what justifies the work. Enrichment is typically most of an analyst's time per alert and none of the judgement, which makes it the highest-value and lowest-risk thing to automate — exactly the opposite of the containment actions people reach for first.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.