Skip to content
sec/atlas
back to the map
practice
stage: automatizar
2 min read

Security automation and playbooks as code

Automating response takes minutes off every incident, but a poorly designed automation is an incident waiting to happen. What separates the two are the brakes.

PythonShuffleTinesTemporal

What it is

(security orchestration, automation and response) is the set of practices and tools that run response steps automatically: enriching an alert, checking reputation, opening a ticket, isolating a resource, blocking a source. A playbook is the script of those steps.

Treating playbooks as code (in a repository, with review, tests and versions) avoids the chaos of flows clicked together in an interface that nobody can audit or reproduce.

The four brakes

  • Idempotency: running the playbook twice for the same alert must not duplicate the effect (see the reliability topic).
  • Human approval for destructive or wide-reaching actions: blocking an entire ASN, disabling a production account, taking down a service.
  • Dry-run: every action must be able to run in simulated mode, showing what it would do, for testing and for the shadow phase of a new automation.
  • Auditing and rollback: each action records who (or what) ran it, for which alert, and has a defined undo, preferably with an expiry (TTL).

A playbook in Python

The example shows the structure: enrich, decide by rule, apply a time-limited action and require approval when the reach is large. The integration functions (blocking client, approval, audit) are illustrative.

playbook_block_source.pypython
from dataclasses import dataclass

TTL_SECONDS = 1800          # every block expires
APPROVAL_ABOVE = 50         # wide reach requires a human

@dataclass
class Alert:
    id: str
    source_ips: list[str]
    confidence: float

def run(alert: Alert, *, dry_run: bool = True) -> str:
    if audit.already_handled(alert.id):          # idempotency
        return "skip: already handled"
    if alert.confidence < 0.9:
        return "skip: low confidence, goes to human triage"

    if len(alert.source_ips) > APPROVAL_ABOVE and not approvals.granted(alert.id):
        approvals.request(alert.id, reason="wide block")
        return "pending: awaiting approval"

    for ip in alert.source_ips:
        blocker.block(ip, ttl=TTL_SECONDS, dry_run=dry_run)
    audit.record(alert.id, action="block", ips=alert.source_ips, dry_run=dry_run)
    return "ok"

Durable orchestration

Real playbooks have waits (an approval that takes hours), retries and parts that fail. Durable workflow engines (such as Temporal) store the state of each execution, resume from the right point after a failure and give visibility into what is in progress, which tends to be more robust than chaining scripts.

Automation secrets and permissions

Automation is a powerful identity: it blocks, revokes and deletes. Give it least-privilege permissions per action, keep its credentials in a vault with rotation, and treat the playbook repository and pipeline with the same rigor as any system with production access. A compromised automation is a ready-made attack tool.

SOARSecurity orchestration, automation and response: running response steps automatically, described in playbooks, with brakes such as human approval and auditing.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

Unlocks

test what you learned

Loading questions…