SOC108 · Security Automation and Response (SOAR)
About Course
Automate repetitive SOC work safely. You design playbooks, build an enrichment and response workflow with free tools, and add the guardrails and human approvals that keep automation trustworthy.
Who it is for
Analysts and security engineers who want to cut manual triage time without losing control.
Prerequisites
Complete SOC105 and SOC107, and be comfortable reading JSON.
What you will be able to do
- Identify SOC tasks suitable for automation using frequency, consistency and risk criteria
- Design a playbook with triggers, enrichment, decisions, actions and human approval points
- Build a working alert enrichment and response workflow in self-hosted n8n with free threat-intelligence APIs
- Apply guardrails such as allowlists, rate limits, audit logging and rollback to automated actions
Lessons
- Lesson 1 · SOAR concepts and choosing what to automate
- Lesson 2 · Designing playbooks
- Lesson 3 · Guardrails, testing and operating automation
- Lesson 4 · Lab and assignment
Lab: Build a phishing alert enrichment playbook
You build an n8n workflow that receives a sample phishing alert through a webhook, extracts the sender IP, URLs and attachment hash, enriches them with free threat-intelligence APIs and calculates a risk score. High-risk cases pause for human approval before a simulated block action, and every step is written to a case log.
Free tools: n8n self-hosted in Docker Desktop (free community edition), VirusTotal and AbuseIPDB free API tiers, and a local CSV or Google Sheets case log
Assessed assignment
Design and document an automation program for a small SOC that handles about 200 alerts per day. Select three use cases, justify each with time saved and risk, and deliver the full playbook for one of them with a workflow diagram, the exported n8n JSON, decision thresholds, approval points, guardrails and failure handling. Include a test log showing at least three alerts processed: one benign, one suspicious and one malicious.
| Criterion | Weight | What excellent work looks like |
|---|---|---|
| Use case selection | 20% | Use cases are justified with volume, time saved and an honest risk assessment. |
| Playbook design | 30% | Triggers, enrichment, decisions, actions and approvals are complete, logical and documented. |
| Working implementation | 30% | The exported workflow runs, handles API errors and produces the documented results for all test alerts. |
| Guardrails and governance | 20% | Allowlists, rate limits, audit logs, rollback and ownership are defined and implemented. |
Portfolio piece
A documented, working n8n phishing enrichment playbook with guardrails and test evidence.
Next step
Continue with SOC109 · Final Project: A Detection and Response Playbook for a Small Business · 8 hours · $56.00
Course Content
SOC108 · Security Automation and Response (SOAR) (8 h)
-
Lesson 1 · SOAR concepts and choosing what to automate
-
Lesson 2 · Designing playbooks
-
Lesson 3 · Guardrails, testing and operating automation
-
Lesson 4 · Lab and assignment
-
SOC108 Assessment · Security Automation and Response (SOAR)