BLOG
Automating Security Operations With AI: Where to Start When Everything Feels Manual
Your three-person SOC (Security Operations Center) team starts the week with a backlog of 400+ alerts. Half are GuardDuty findings you've seen before. A quarter are IAM policy changes that look routine. Somewhere in the remaining pile is a lateral movement attempt that won't look obviously wrong until someone correlates it with an Okta session anomaly from two hours earlier — but nobody has two hours to spare.
This isn't a staffing problem you can hire your way out of. Security analysts are unable to address 67% of the alerts they receive daily. The math doesn't work, and adding headcount doesn't change the math.
The answer is automation, but not the kind where you throw a SOAR platform at noisy detection rules and hope for the best. This guide walks through where to start when everything feels manual: how to fix your detection layer first, structure your data for automation, and build a tiered approach from alert triage through autonomous response, without scaling the problems you already have.
Key Takeaways:
Most SOC teams stay manual because alert volume, false positive rates, and staffing shortages create a compounding crisis that hiring alone cannot resolve.
SOAR playbooks stall for lean teams because they require dedicated architects, constant maintenance, and pre-defined logic for every scenario.
Automating noisy detection rules does not reduce false positives; it industrializes them.
Start with alert triage (Tier 1), expand to repeatable investigations (Tier 2), then move toward autonomous response (Tier 3), measuring false positive reduction and analyst time reclaimed, not just MTTD and MTTR.
Why Most SOC Teams Are Still Stuck in Manual Mode
For many teams, manual SOC work becomes a structural problem: alert volumes, false positive rates, and staffing constraints reinforce each other in a cycle that is difficult to break with hiring alone.
The Alert Volume Problem Nobody Can Hire Their Way Out Of
Many SOC teams struggle to keep pace with alert volume, and the talent pool alone is unlikely to rescue them. Only 34% of organizations have adequate security staffing, and the workforce gap continues to grow. Meanwhile, hiring freezes affect 49% of large enterprises.
For a two-to-five person team, the reality is stark: little redundancy for attrition, limited capacity buffer for volume spikes, and rarely specialized Tier-1 staff to absorb false positives before they reach senior analysts.
What "Manual" Actually Costs Your Team
Manual triage costs a three-person team roughly $306,000 per year, and at a high false positive rate, up to $245,000 of that is wasted. The math: 500 alerts per week at 10 minutes each consumes approximately 83 analyst-hours weekly.
The human cost compounds the financial one. When analysts spend most of their shift closing false positives, the work that actually matters — threat hunting, detection tuning, incident response — doesn't happen. Organizations using AI and automation in security operations save $1.88 million per breach on average, the largest single cost-reduction factor identified in recent breach cost research.
What SOC Automation Actually Means (and What It Doesn't)
SOC automation ranges from static playbooks to AI investigation, and where your team falls on that spectrum determines whether automation helps or just shifts the burden.
Rule-Based Playbooks vs. AI-Driven Automation
Rule-based SOAR automates incident response through deterministic if-X-then-Y playbooks. Every response path must be pre-defined by a human before the system can act.
AI-driven automation works differently. Instead of requiring pre-defined paths, AI systems can adjust investigation steps based on real-time data. This can let organizations with even immature processes gain earlier operational benefits rather than spending months on playbook development.
Where SOAR Stalls and Why Teams Get Stuck
SOAR's architectural constraints create specific failure modes for lean teams. In practice, many organizations struggle to build and maintain enough SOAR playbooks to deliver meaningful automation at scale. Static logic cannot adapt when new attack techniques emerge, requiring every affected playbook to be individually revised.
SOAR also assumes your SIEM is already producing clean, enriched alerts worth orchestrating. Without that foundation, playbook automation just moves bad data faster. Teams that deploy SOAR before their detection layer is mature end up maintaining two systems instead of one.
Fix Your Detections Before You Automate Anything
Automation amplifies whatever it touches. If your detection rules produce reliable signal, automation scales that reliability. If they produce false positives, automation industrializes them.
Why Automating Noisy Rules Just Scales the Problem
Automated playbooks execute every rule they receive, multiplying the operational impact of false positives across users, tickets, notifications, and downstream tools. SOAR doesn't eliminate false positives. It automates how they're handled, routing them through workflows faster, but not reducing their volume.
The underlying detection quality determines whether that speed helps or just creates more downstream work.
AI cannot fix vaguely defined alerting problems or compensate for missing engineering discipline. If the detection rule doesn't produce clean signal, no amount of AI reasoning downstream will fix that. As Stephen Gubenia, Head of Detection Engineering for Threat Response at Cisco Meraki, puts it, "AI isn't the silver bullet; you still have to have processes in place, good logging and alerting pipelines, sound detection logic."
How Detection-as-Code Builds an Automation-Ready Foundation
Detection-as-code applies software engineering discipline: version control, peer review, automated testing, and CI/CD deployment to threat detection logic. Detection rules become auditable, testable, portable code artifacts rather than fragile console-managed configurations.
Four mechanisms make the workflow automation-ready:
Linting catches malformed rules before production
Automated testing validates that rules fire correctly on known-bad events and stay silent on known-good ones
Version control through Git ensures reviewed rules before a rule reaches production
CI/CD pipelines gate every deployment
Clean detection inputs are what make downstream automation trustworthy.
In Panther, this workflow is native. Detection rules are written in Python, can also be managed locally in files and uploaded to Panther, and are often managed in a Git repository. Teams using this workflow catch broken rules before deployment, which strengthens the detection quality that automation depends on.
The Data Layer Most Automation Strategies Skip
Most teams jump from "fix our detections" to "automate our workflows" without addressing the layer in between: data structure and normalization.
Structured Data and the Security Data Lake Advantage
Normalized telemetry makes automation portable across tools. When telemetry is normalized to an open standard like the Open Cybersecurity Schema Framework (OCSF), detection rules become source-agnostic: a rule written against a normalized process.name field fires correctly regardless of whether the event came from an EDR, a container runtime, or a cloud workload agent.
Data lakes make this possible by storing raw telemetry in open formats and making full retention economically feasible.
As Matthew Martin, Founder of Two Candlesticks, notes, "Before you can really go all in on sort of AI, you got to spend time making sure that you actually understand those data sources, they're cleaned up, there's governance around them."
Panther's architecture is built on this principle. Its Snowflake-backed security data lake centralizes security telemetry in open formats. All data is immediately queryable without rehydration. Cockroach Labs saw this play out in practice: they ingested 5x more logs while saving $200K+ in SecOps costs, with 365 days of hot storage eliminating the blind spots that previously hampered both investigations and audit preparation.
Where to Start: A Prioritization Framework for Manual SOCs
The three tiers below follow a hard dependency chain. Tier 2 requires the normalized, enriched alerts that only exist after Tier 1 is operational. Tier 3 requires the trusted, validated playbook logic that only matures through Tier 2 operation. A practical approach is to start with narrow, high-volume tasks and baseline your operations before measuring AI improvement.
Tier 1: Automate Alert Triage and Enrichment First
By the time an analyst opens an alert, the system should have already gathered all available context, scored severity, and suppressed confirmed false positives. At this tier, the goal is to reduce manual research and triage effort rather than take autonomous blocking action.
Specific tasks: IOC enrichment (VirusTotal, AbuseIPDB, WHOIS), asset and user context lookups, threat intelligence correlation, false positive suppression for known-benign sources, alert deduplication and grouping, and auto-ticket creation with enrichment pre-attached. Automated enrichment workflows typically compress what takes an analyst over an hour into a few minutes — the difference between triage as a bottleneck and triage as background work.
If your team spends substantial time each day on alert triage, Tier 1 should reduce that burden materially.
Panther AI is primarily used for alert triage, enrichment, investigation, and summarization. It reviews alerts, analyzes the alert and its associated data, takes the detection rule's runbook() guidance into consideration during triage, and generates an AI triage for the analyst to review. Every conclusion includes the evidence and reasoning behind it, not just a verdict.
Tier 2: Automate Repeatable Investigation Workflows
Automate the complete investigation decision tree for alert types where an experienced analyst follows the same logical sequence every time. Phishing investigations are often a strong early Tier 2 playbook: extract sender and URLs, sandbox attachments, check domain age, and generate a verdict with full evidence.
Cresta, for example, cut triage time by at least 50% after deploying Panther AI, with the biggest gains on complex investigations requiring cross-system correlation.
Tier 3: Move Toward AI-Driven Response and Remediation
Automation should take autonomous action only for high-confidence, well-defined scenarios where the cost of a false positive action has been explicitly evaluated. Before enabling autonomous action, run Tier 3 playbooks in shadow mode long enough to review what they would have done, and gate every action on explicit confidence scores with tested rollback procedures.
Even at Tier 3, treat AI-generated output as a draft. Human oversight stays in the loop for any action with real consequences. James Nettesheim, CISO at Block, has publicly discussed keeping humans involved in AI-driven security work and expressed strong support for adopting AI-assisted detection engineering and related tools.
Panther's Tool Approval enforces this by pausing and presenting a review card before executing sensitive actions, with all decisions logged in audit trails.
Measuring Whether Automation Is Actually Working
MTTD and MTTR are necessary, but they do not tell the whole story. They can improve while backlog, false positive pressure, or analyst strain remain unresolved.
Four metrics reveal the real picture:
False Positive Reduction Rate: The percentage decrease in alerts resolving as non-malicious. Organizations that close the feedback loop between analyst review and automation logic can reduce false positives over time as detections are updated and tuned. Track by sampling 10% of closed alerts weekly.
Analyst Time Reclaimed: Percentage of work hours spent on threat hunting and detection engineering versus reactive triage. Teams routinely spend hours each day on manual triage. If that proportion isn't declining, automation isn't working.
Alert-to-Investigation Ratio: Total alerts received divided by alerts escalated to formal investigation. A healthy ratio depends on your environment, but if you're escalating more than 10% to 15% of alerts to formal investigation, your detection rules may need tuning.
P90 Case Age: The 90th percentile age of closed cases, which captures the long tail that MTTR averages conceal. If average MTTR improves while P90 Case Age worsens, automation may be accelerating simple cases while complex ones accumulate.
The SOC Teams Who Automate Detection First Move Fastest
Every automation technology inherits the quality of the detection layer beneath it and the data layer beneath that. Teams that skip straight to orchestration without fixing noisy rules and fragmented data discover they have scaled the problem, not solved it.
Panther is built for the sequence that works: detections-as-code with CI/CD pipelines produce trustworthy signal, a Snowflake-backed lake provides broad context without vendor lock-in, and AI triage compresses investigation time while showing every step of its reasoning. As a cloud-native SIEM, Panther ties those layers together around structured telemetry, detection-as-code, and analyst-visible reasoning.
If your SOC still feels entirely manual, start by auditing your top 10 alert types by volume, documenting the runbook for each, and asking a straightforward question: which of these could a machine handle if the detection rule was clean and the data was structured? The answer is your automation roadmap.
Share:
RESOURCES
