LAB/04Research area
Security automation: safe, auditable automation of security work
Security automation research asks which parts of security work a machine can do reliably and which must stay with a person. The engineering side builds playbooks, integrations and approval controls that show their work.
- Area
- LAB/04 · Security Automation
- Outputs
- Playbooks, integrations and enrichment components for service delivery, Research notes on automation design, guardrails and measurement, Tools such as playbook test harnesses, where they are useful outside Onion, Investigation workflow components for the Autonomous SOC Analyst, Evidence collection methods for GRC development
- Status
- Active research
01Open questions
What we are working on
Which steps of alert triage are safe to automate fully, which need human approval, and how is that boundary documented?
How can an automated response action be made reversible and auditable across identity, endpoint and cloud platforms?
How should a playbook be tested before it is allowed to take an action in production?
Where does an LLM add value in an investigation workflow, and where is a deterministic script the better tool?
How can evidence for compliance controls be collected from operational systems without manual steps?
What must an automation record so that a reviewer can reconstruct why it acted?
02Method
How the work is done.
- Workflow decomposition
- An analyst task is broken into steps, and each step is classified: data gathering, enrichment, judgment or action. Gathering and enrichment are automated first. Judgment and action keep a human approval point unless pre-approved.
- Playbooks as tested code
- Playbooks and integrations are written as code in version control, with dry-run modes, test fixtures for each integrated platform and review before release.
- Guardrails and approvals
- Every automated action has a defined scope, an approval rule, a log entry and, where the platform allows, a rollback. The default is human approval, and automatic execution is limited to cases approved in advance.
- Measurement against human baselines
- Automation is compared with the same task done by an analyst: completeness of the checks, accuracy of the conclusion and time taken. Results decide what is automated next.