Automation That Contains, Not Just Coordinates

Summary

Most SOC automation coordinates tickets and notifications but stops short of actually containing threats. Torq Field CISO Patrick Orzechowski explains how to move from coordination to containment: integrate and enrich first, embed AI agents inside deterministic workflows, and call containment APIs, like Zero Networks', to isolate compromised users and hosts in near real time. He walks through two examples, an impossible-travel alert and a ransomware attack.

Key takeaways

• Orchestration isn't containment. Many SOAR deployments stop at coordination. When containing a host means opening a help desk ticket, an attacker can have an hour to move laterally.
• The modern SOC runs on three A's.
  • Autonomous: documented processes, automated.
  • Agentic: AI agents with defined roles, bringing in humans only when needed.
  • Agile: plug-and-play tools via API, so replacing a tool doesn't mean rebuilding every process.
• Automation is a crawl-walk-run pyramid. It starts with integration and enrichment, then collaborative case management, then reporting and KPIs, then basic automated response. A fully automated SOC is still far off; people will always be needed.
• Automated containment needs near real-time APIs. Teams need to block hosts and users, apply security policies, and quarantine assets to a safe segment with a click or an automated trigger.
• Ransomware response can run end to end. A high-fidelity alert triggers enrichment, deterministic logic, and an AI agent's investigation. The workflow then creates a case, notifies the SOC, isolates the endpoint through containment APIs, and alerts legal, IT, and cyber insurance.

Speaker: Patrick Orzechowski, Field CISO, Torq

Who is Patrick Orzechowski?

Patrick Orzechowski: Welcome to Containment Island, um, presented by Torq and, and Zero Networks here. I've been told that this has to do with some sort of contest, uh, which is awesome. The first question I asked was, can I win the prize to go to the island? And I cannot. So you're stuck listening to me ramble on about, uh, automation and containment. So I am Patrick Orzechowski, uh, field CISO here at Torq. Um, proud to present here and, uh, further our partnership with Zero Networks. Uh, it's been fantastic so far. Everything I've learned about the product and the team that works there, um, has been awesome. Uh, today I'm gonna talk about, um, automation that contains, not just coordinates. And what that means to me is, when you have a SOAR, a lot of things you do is, is just orchestration-based. Right? Not a lot of the big R in response. So actually containing threats, um, whether that's on the endpoint, on a host, or, uh, with an identity, um, that a tool like Zero Networks can do, um, or any other tools you have in, in your toolbox as your security stack. Right? So, uh, uh, I'll go through, you know, the modern SOC, um, problem, what we think at Torq, uh, is the solution, and then maybe some examples on how we do things at Torq, and, and how you can integrate that, um, with Zero Networks as a whole. And, you know, when I say Torq or Zero Networks, I, I mean, it could be any part of your stack that has these capabilities. Right? It could be, um, an automation tool that's not Torq, or a containment mechanism that might be on an EDR, for example, or an IAM system. So, yeah, let's get started.

Uh, first, a quick introduction on me. I have been in cybersecurity for twenty-five years. Uh, for folks who don't, don't know me, uh, my friends call me PO. Um, everyone calls me PO, um, because my last name tends to be difficult to pronounce, so I just say, just call me PO. And, um, started in the Symantec SOC, which was originally the Riptech SOC, uh, twenty-five years ago. So very, very long time ago, we started doing blue teaming and managed security. Um, was lucky enough to move into the defense and intelligence communities. First, on the defense side, I was on the blue team side, and then on the intelligence community side, I was on the red team side. On the blue team side, I worked, uh, the Titan Rain intrusion, the first, uh, Chinese APT that, that attacked defense contractors. And on the red team side, I was lucky enough to, um, pentest some satellite systems for the intelligence community. So think CIA, NSA, um, NRO, those types of systems. Um, that was a lot of fun. I got into telecommunications, so that's really when I started thinking about data, um, and containment, and really blue team when it comes to host and identity, right? Host infected, isolated, um, zero trust, making sure that folks don't have access to things they don't need access to, um, as well as identity isolation. Um, and then after that, I was a founding employee at Deepwatch. So, third employee at Deepwatch, um, did that for about ten years, until I joined Torq a little over a year ago. So, um, yeah, a little background on me, just so you know who, who's talking at you today. Um, welcome any, uh, connections on LinkedIn, or questions that you might have. Um, if you disagree with anything I say that might be an opinion today, feel free to reach out, and, uh, we can have those questions answered.

What's the modern SOC challenge?

Patrick Orzechowski: So, the modern SOC challenge. Um, I think the traditional SOC has kind of gone the way of the dodo here a little bit. We've, we've, we've evolved beyond what the, you know, the SOC triad is — um, endpoints, network detection, and SIEM — while still effective in a lot of areas, especially on-prem, traditional enterprise. Um, you see, you know, what's going on here in this, in this, uh, graphic. There's a lot more than just the traditional enterprise.

What are the three A's of the modern SOC?

Patrick Orzechowski: So I kind of think of things in threes. Um, I can only — as I'm a dinosaur, right, I've been around twenty-five years — um, I can, I, I have the three A's. So, uh, the first one's autonomous. What that means is building, uh, your processes into an automated system, whether that's, uh, legacy SOAR, a next-gen SOAR, hyperautomation, as we call it at Torq — making sure your processes are documented and then automated. Uh, agentic. Uh, so agentic AI is a, is a buzzword, I, I will admit, but, um, definitely something that we wanna look at from a nondeterministic standpoint. And what I mean by that is not just if-then-else, the traditional SOAR, but making sure that, um, we're looking at providing roles for when we want human interaction in the loop. And I'll cover that in, in a short workflow here in a bit, but, you know, humans shouldn't really be in the loop until they need to be. And that's the traditional kind of SOC burnout, um, not enough talent, um, you know, making sure that folks understand when to look at things from a severity standpoint and from a risk standpoint. So that's, that's what I mean by agentic: giving systems roles and using AI to help make decisions. Obviously, important decisions will still need to be made by humans. Agile. Um, what I mean by agile here is not the traditional kind of SDLC as agile. Um, it's the ability to plug and play different systems. Right? You see all these different logos that are feeding into the middle Rubik's cube thing there, and, you know, Zero Networks would be one of those for your autonomous system. But being able to, uh, not traditionally say that, oh, we can't do a firewall replacement project, because we've deployed 600 firewalls, and that would take a year. Right? Being able to be agile and say, hey, we can replace our firewalls, because all of our processes, all of our capabilities, are in place right now, and we have the systems in place to say, okay, we're not gonna re— renew with, with firewall vendor X. Right?

Why is containment so hard?

Patrick Orzechowski: The containment problem. Right? It — it's always been a problem to do, and, and we — we've struggled with this at Deepwatch, to do, uh, containment, the big R response, um, because, number one, there are manual response gaps. Making sure that, uh, you have access to the system you wanna contain. Right? Um, if you have to open a ticket to the help desk to contain a server or a host, it's gonna be an issue. Right? Um, there's gonna be a lag time on, on when that happens, and you might have, um, an hour for the adversary to be in your network, moving laterally, making sure that they have a foothold in the network, and we're seeing that. Right? So speed to contain is, is part of the problem. Human intervention — you know, making sure human intervention, um, is, is part of the loop — has always been a, a, a stick in the mud for containing things. Right? Um, you don't have the systems in place to automatically contain, and maybe you haven't taken a zero trust approach to all of your systems, whether that's on purpose, or you didn't have the tooling to do it. Um, that's always increased, uh, risk as far as lateral movement and risk to systems that are exposed. Right? And then even ZTNA has holes. Exposure of nonhuman identities, service accounts, uh, auth tokens. You know, we kind of saw that with the third-party attack on Salesforce very recently. Endpoints, um, that need to be exposed outside of the ZTNA kind of bubble or umbrella. And then, um, I put printers here because that's kinda close to my heart. Printers have always been the bane of, you know, VPN and zero trust existence, uh, trying to help people print, whether they're printing at home, in their home offices, or printing in the office with ZTNA. Um, always been a problem. So, you know, you, you have to poke holes, just like you do in a firewall, with your zero trust approach and zero trust policies.

What is the automation pyramid of pain?

Patrick Orzechowski: So for automation, um, we built at Torq, uh, what, what we call the automation pyramid of pain. Um, this is, uh, taken from the automation, uh, approach that we like to see folks have, um, when it comes to kind of a crawl, walk, run approach. Right? And this, this concept is basically stolen from Alex Pinto. Alex does the Verizon DBIR report. He did, about a decade ago, the threat intelligence pyramid of pain.This isn't a threat intel talk, so I won't go into that, but, um, he, he definitely, uh, took the same approach: the simplest stuff is at the bottom, the more complex stuff is at the top. Basically — and I won't go through this, because this could take a whole half hour to go over, um, how this works — but, um, the first thing you start with: integration and enrichment, right? You have to integrate your systems — integrate your security systems, non-security systems, IT systems, HR systems — so you can build those processes that humans normally do, that create that lag time in incident response. Enrichment and context — you know, making sure that you have all the enrichment that you might do with VirusTotal, all the user information that you need to do an investigation. Right? And then collaborative case management. We call this HyperSOC at, at Torq. Other folks do it with Jira, maybe ServiceNow. Making sure that your case has everything involved in what's going on with the alert as it comes in. Uh, so you can make a really, really good decision when it comes down to it, as a human. Automated — automation reporting. Let me start that over again. Automation reporting and KPIs and SOC metrics. Um, SOCs are, are definitely metrics now, so making sure that, uh, we have the right KPIs in place to justify the budgets of your security stack, you know, your headcounts, all the folks who work on the security team, making sure — and, you know, most security teams do the best they can with what they have, but a lot of boards, C-levels, are going out there and saying, why are we spending so much on security, and maybe still getting breached? Or, we're just not seeing the value from what we're spending money on. And then the next level, level four, is, is basic automated response. That's, you know, your high— host isolation. That's your host containment, your identity containment, making sure that you have the ability to do automated response and say, yes, remove that phishing email from the mailbox, or isolate this host onto a containment network, um, those types of things. And level five, you know, is kind of the, you know, the pie-in-the-sky idea of having the SOC fully automated. Now, there are some vendors out there who will tell you that they're building an AI SOC, and you're not gonna need people. Um, I don't think that day is coming anytime soon. So I think we're always gonna need people, but there will be a time when a good percentage of the alerts that come into the SOC are fully automated.

Why integrate and automate?

Patrick Orzechowski: So why integrate and automate? I've kinda covered this as far as the, uh, reasons, but just to reiterate: speed. Um, you think MTTX, uh, so mean time to detect, MTTD, mean time to investigate, mean time to respond, and then mean time to contain, which is one thing I'll talk about in a little bit. Um, context — making sure you have the correct context of the alert and the case that's being created. You know, a lot of tools will just tell you and give you an alert, especially EDR tools. You know, this is a reverse shell on this host. Well, what user executed that reverse shell? Which, which group is that user a part of? What groups are those hosts on? Right? Is this something I need to look at from a criticality standpoint that provides business risk? You know, does this host our internal crown jewels? And, you know, making sure you have that compliance — uh, that I went on the compliance. Pause. Restart. Making sure you have that context for each alert that comes in, and have the right case management capabilities there. Uh, compliance and auditability — making sure you have, uh, the right audit trails to see what's going on. Cloud attacks are a perfect example of this. Right? Um, if you look at the beginning and end of a cloud attack, a lot of times, it's very just disjointed. Might start with GitHub, might move to Salesforce, might move to Okta. Right? And all those are disjointed capabilities. So making sure you have, um, a good audit trail of what's happening. Nowadays, it's not just about putting all the data into the SIEM. It's about making sure that you have a good trail, especially when an incident happens. You know, I have folks who are dealing with the Salesforce attack, the Salesloft Drift attack from a few weeks ago, and they're still trying to pull together little pieces of data to give to the incident response team, to make sure they get the full picture of what happened.

What does automated containment require?

Patrick Orzechowski: So this is a quick example, uh, for automated containment. What you need, uh, for, uh, a capability from an API perspective is near real-time blocking of host and user access. Right? Making sure that you can go out, with a click of a button or an automated trigger, go out and block a host and block a user, isolate them. Uh, apply security policies. Maybe you want more logs from that host. Maybe you wanna put that user on a watch list, where they're considered, uh, an at-risk user because they clicked on a phishing email, those types of things. Um, and then isolate and quarantine asset to a safe segment. We've been seeing this for a long time with, with products like Forescout, um, network access control products, 802.1X. I think a lot of these products are getting more mature, and we can trust them a lot more to be consistent. Um, I know when — you know? Again, I'm a dinosaur. Fifteen years ago, when we tried to do 802.1X and, and NAC, um, it was much more difficult to isolate a host onto a network, because the switching infrastructure wasn't there. Now everything's, uh, software-defined, so you can actually do these in an automated way, all the way down to the switch level.

How do you automate an impossible-travel alert?

Patrick Orzechowski: This is an example of, um, an impossible travel alert. Uh, we deal with this a lot, um, from a, hey, this might be something that folks need to look at. Um, basically, you know, some folks call it the Superman alert. Um, if you log in from one city, let's say Los Angeles, and then you log in from, um, Paris two minutes later, maybe, uh, that's something to look at, because it's impossible for you to travel across. Now, you could say it could be VPNs, could be, could be, um, you know, routing issues. It could be the IPs aren't labeled correctly, but it is something to look at. Um, from there, we, we bring that into the hyperautomation platform and do a little bit of user behavior analysis. Right? Is this user normally traveling? Is this user, um, has they — have they ever logged in from that other location before? You know, maybe it's — it, the log lagged, and they, they work in Paris and Los Angeles. Right? And then if it is risky, deemed risky, and it, and goes against a risk, risk threshold that's higher than you need, you wanna create an alert for it and then create a case. Um, from there, uh, we auto-assign it to an AI SOC analyst — you know, we call it Socrates. Socrates. Took me a bit to, to get that, um, play on words there — but, um, it'll actually go out and automatically give you that context I was talking about. Right? Making sure that you have that, um, all the information you need to make an informed decision as, uh, an analyst or an investigator. Right? From that point, you can either automate isolating the user, right, if you deem that it's — the user is malicious, um, that's logging in from Paris or Los Angeles, vice versa — or you can hand it off to a SOC analyst, maybe send them a Slack or a Teams message, saying, here's all the information you need to make a decision here. Should you isolate this user, maybe notify their manager, and say, hey, this account might be compromised, and then we need to do further investigation? At that point, you can say the case is remediated. With automation, you're doing all of this in a lot less time than it would have taken five, ten years ago.

What are the benefits of automated containment?

Patrick Orzechowski: So, the benefits. I covered a few of these. Um, efficiency. Consolidates — consolidating your containment actions, making sure that, um, all of the actions are documented and implemented in one system. That goes back to the agility piece. Right? If all of that happens, and you're just doing API calls, then you can rip and replace tools all you want, because your processes are already there. Speed. The, the faster you can contain the threat, the faster you can reduce risk to the business. Right? Um, especially from — and we'll talk about ransomware in a second, but especially from a ransomware perspective. If you detect something's happening from a ransomware perspective, and the, the, the — that's lag time between when they get in and start doing things, to when you contain them, might be, um, an hour. That's enough time for them to get enough data to, to really put a, put a hamper on your business. Right? Enrichment and context. You know, I keep hitting this over and over again, kind of beating a dead horse a little bit, but, you know, that is critically important, to make sure that you have all the data and information you need to make an informed human decision. Right? Whether or not we wanna hand that off to an AI agent is a matter of how much risk you wanna take, uh, but definitely making sure you have all the data you can possibly get. And traditionally, we did that with a SIEM, where you dumped all the data. Now I think we're moving to a more federated world, where you have to go out and pull data from different places in near real time. And, again, auditing compliance: making sure that you have an audit trail for everything that, number one, the automation platform did, and number two, uh, the human did, as far as decision-making is concerned, in the workflow.

How do you automate ransomware containment?

Patrick Orzechowski: So a real-world example here is, uh, a, a ransomware example, and the scenario is, uh, you know, as any other scenario happens. High-fidelity alert might come from an EDR, might come from somewhere else, um, indicates suspicious file encryption on an endpoint. And the goal is real-time, or near real-time, containment to stop any lateral movement, because once that starts happening on one host, it's going to start popping off on other hosts very quickly. Um, so you build automation. Number one, it's the trigger. Uh, making sure that that high-fidelity alert is well documented on what happens after that. Uh, so when that alert is triggered, your automation platform should go out and say, okay, I need to start gathering all the information I need. What's the host? What's the user? What context do I have? Do I have any data in the SIEM for this host that might indicate the user got phished on, on the host, or the user in general got phished, or maybe the user was compromised prior, and we had an impossible travel alert that was already contained — going back to the original example. Conditional logic. Right? So this is the deterministic piece of it. If-then-else, um, and, you know, any SOAR or hyperautomation workflow will have those capabilities in them. And they're, they're basically the steps in your playbook: that when we get a ransomware alert from wherever, our EDR system, here's what we do step by step, how you would describe it in a, in a process document. And then there's the agentic piece. Right? Things that deterministic or conditional logic can't do. Right? So, um, give it a role — a, a, a layer one SOC analyst who needs to investigate ransomware — and then describe what that role is via prompt engineering. And the cool thing now, especially with Torq, is we can embed those agents within a deterministic workflow. So if you need to do something that's a little more nondeterministic, or squishy — uh, is the technical term I like to use — um, the agents can go out and do those for you. And then case creation and notification. Right? The case creation is for — could be for pure documentation purposes. If you determine that it's a false positive, with all of the steps above, then you can go out and say, hey, you know, create, create a case, document it for future reference, and then we have it. We have all the enrichment, everything that's been done, the contextualization. So if we did determine it was a false positive, we can go back and fix our processes, and we have all the data that was involved in that incident prior. Um, if you determine that it is a true positive, then you're gonna wanna notify the SOC. Right? And the SOC can take action — whether, like I said, it's a Slack message, it's a Teams message, it's a Jira, um, it's a ServiceNow ticket, any of those things — making sure that you notify via escalation that, hey, we could have a ransomware attack here. And then, once that happens, the action piece — the actual containment piece — takes off. Right? Call your APIs, um, your containment APIs. Move the, move the endpoint to a quarantine segment. You can even isolate the endpoint via EDR capabilities. Create a temporary policy to only allow the endpoint, maybe, to talk to forensic systems, or isolate it altogether until the incident response team can look at it and see, you know, what the ransomware variant is — you know, can we gather any information or IOCs from that host, and, and do some hunting around, uh, the network for it — and then notify all stakeholders of potential ransomware incident. Um, hopefully, everyone's ransomware playbook has not only what the SOC does in the event of a ransomware incident, but notifying legal, notifying the IT team, notifying folks who, who are, uh, big stakeholders, because once that ransomware note drops, um, you're gonna wanna instigate your, uh, your cybersecurity, um, insurance, uh, capabilities, as well as incident response. So — and that was it. Thank you very much. Um, it was a pleasure to be here with you.