Optimal Automated Generation of Playbooks

Cyberattacks have become more complex and analysts need help managing all alerts promptly. Many organizations implement Security, Orchestration, Automation, and Response (SOAR) tools to automate Incident Response (IR). However, it is challenging to integrate these tools, often delaying expected Return on Investment (ROI). Our approach aims to automatically generate optimal playbooks using the Pareto front, which balances impact, loss, and complexity. These playbooks are populated in an ontology that aims to be integrated with a SOAR to overcome the SOAR limitations. Using the Pareto Front, we aim to reduce the generated playbooks by an average of over 75%.