SOC automation

Automation applies your judgement at machine speed, including the parts of your judgement that are wrong.

A rule that automatically isolates a machine is excellent when the detection is sound and a self-inflicted outage when it is not. The question before automating an action is not whether it can be automated, it is what happens when it fires on something legitimate, and how quickly a person can undo it.