SOC AUTOMATION MATURITY:
├── Tier 0 — Notification Only
│   Alert → Format → Notify analyst via Slack/Teams/PagerDuty
│   Risk: None (no automated actions)
├── Tier 1 — Automated Enrichment
│   Alert → Enrich IOCs (VT, WHOIS, CMDB) → Attach to case
│   Risk: Low (read-only operations)
├── Tier 2 — Decision Support
│   Alert → Enrich → Score → Recommend action → Await approval
│   Risk: Low (human approval gate)
├── Tier 3 — Automated Containment
│   Alert + High Confidence → Isolate host / Block IP / Disable account
│   Risk: Medium (automated impact, rollback required)
└── Tier 4 — Full Auto-Response
    Alert → Enrich → Decide → Contain → Ticket → Close
    Risk: High (no human in loop, extensive testing required)

# Enrichment playbook (Splunk SOAR / Phantom)
import phantom.rules as phantom

def on_start(container):
    # Extract IP artifacts
    artifacts = phantom.collect2(
        container=container,
        datapath=["artifact:*.cef.sourceAddress"],
        action_results=None)
    for artifact in artifacts:
        ip = artifact[0]
        if ip:
            phantom.act("ip reputation", parameters=[{"ip": ip}],
                        assets=["virustotal"], callback=enrich_complete)

def enrich_complete(action_results, **kwargs):
    for result in action_results:
        summary = result.get_summary()
        if summary.get("malicious", 0) > 5:
            phantom.act("block ip", parameters=[{"ip": result["ip"]}],
                        assets=["firewall"])
            phantom.set_severity(container, "high")

# Phishing triage automation
id: phishing-auto-triage
name: Phishing Auto-Triage
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: extract-indicators
    type: regular
    task:
      name: Extract Indicators
      script: ExtractIndicatorsFromEmailBody
  "1":
    id: "1"
    taskid: enrich-urls
    type: playbook
    task:
      name: URL Enrichment
      playbookName: URL Enrichment - Generic v2
  "2":
    id: "2"
    taskid: check-verdict
    type: condition
    task:
      name: Is Malicious?
    conditions:
      - label: "yes"
        condition:
          - - operator: isEqualNumber
              left: DBotScore.Score
              right: {value: 3}
      - label: "no"

{
  "definition": {
    "triggers": {
      "Microsoft_Sentinel_incident": {
        "type": "ApiConnectionNotification",
        "inputs": {
          "host": {"connection": {"name": "@parameters('$connections')['azuresentinel']['connectionId']"}},
          "body": {"callback_url": "@{listCallbackUrl()}"}
        }
      }
    },
    "actions": {
      "Enrich_IPs": {
        "type": "Http",
        "inputs": {
          "method": "GET",
          "uri": "https://www.virustotal.com/api/v3/ip_addresses/@{triggerBody()?['object']?['properties']?['relatedEntities'][0]?['properties']?['address']}"
        }
      },
      "Update_Incident": {
        "type": "ApiConnection",
        "inputs": {
          "body": {"severity": "High", "status": "Active"}
        }
      }
    }
  }
}

SAFETY REQUIREMENTS:
  □ All containment playbooks have rollback procedures
  □ High-impact actions require approval gate (Tier 2+)
  □ Rate limiting on automated blocking actions
  □ Allowlist of critical assets excluded from auto-containment
  □ Audit trail for every automated action
  □ Circuit breaker: pause automation if error rate > threshold
  □ Testing in simulation mode before production deployment