--- title: 'Response Automation' source: 'https://academia.sh/en/courses/security-operations/response-automation' course: 'Security Operations and Incident Response' language: en updated: '2026-09-26T03:02:56+00:00' license: 'CC BY-SA 4.0' objectives: - 'Inventories recurring response procedures by frequency and duration, and calculates the minutes automation gains' - 'Counts the cost of a wrong automatic action as two items: rollback minutes and the legit work item cut' - 'Compares manual, approved, and full automation modes on the net-gain axis, and finds the break-even point' --- # Response Automation Eight recurring response procedures produce 158 items and 1,215 minutes of manual work per day; full automation cuts that to 281 minutes but brings 2.65 wrong automatic actions per day and a 457-minute cost, for a net gain of 477 minutes. Three procedures give a net negative under full automation: account lockout -4, address blocking -72, endpoint isolation -72 minutes. Human-approved mode gives a net gain of 715 minutes with zero wrong actions; selecting the best mode per procedure raises the daily net to 870 minutes, and the 3,120-minute write-up work is repaid in 4 days. When the cut legit work item's minute value is taken as 90, full automation drops to -60 minutes at a 1x wrong rate. Across eight lessons every step of the pipeline was counted, and every resulting number pointed at the same place: analyst minutes. In lesson one, daily capacity was 1,440 minutes; in lesson six, the second rule version cost 513 minutes a day; in lesson eight, ninety-day retention asked for 1,755 minutes. This lesson closes the topic and measures the only way to reclaim minutes: handing repeated work to a machine. The measure is not one-directional. Every automated response takes a wrong action **on its own** when the alert turns out wrong, and that action has two costs: undoing it, and the legitimate work it cuts in the meantime. The procedure inventory below is a **model**; the frequencies, durations, and rates are data, not measurement. - **DI43.** There are eight recurring procedures, producing a total of 158 items per day. Each procedure has a manual duration, an automatic duration, and a one-time write-up duration. - **DI44.** Automation coverage is less than 1: a portion of a procedure's items is always handled manually, because its input is incomplete. - **DI45.** There are three modes. **Manual**: every item by a human. **Approved**: the machine prepares it, a human approves it at 1.5 minutes per item. **Full**: the machine prepares and executes it. - **DI46.** A wrong automatic action occurs only in full mode; the model assumes the human catches **all** of them in approved mode. This is an optimistic assumption and should be measured on a real line. - **DI47.** The cost of a wrong action is two items: rollback minutes and the legit work item cut. The second item's minute value is model data, and it is an organizational, not a technical, decision. ## The Procedure Inventory and What Automation Gains ```js // procedure.mjs — recurring response procedures, automation gain, and payback. THIS IS A MODEL. // Numbers are DATA, not measurement; the procedures are fiction for the regional measurement network. // [name, daily count, manual min, automatic min, write min, automation coverage, wrong action rate, // wrong action rollback min, legit work items cut by wrong action] export const PROCEDURE = [ ["indicator lookup", 62, 4, 0.2, 240, 1.00, 0.000, 0, 0], ["file hash lookup", 38, 5, 0.2, 180, 1.00, 0.000, 0, 0], ["user verification prompt", 21, 9, 2.0, 420, 0.85, 0.030, 12, 1], ["identity session termination", 14, 11, 1.0, 360, 0.80, 0.060, 25, 2], ["account lockout", 9, 12, 1.0, 300, 0.75, 0.080, 40, 3], ["address blocking", 7, 16, 1.5, 480, 0.70, 0.110, 55, 6], ["endpoint isolation", 4, 34, 3.0, 600, 0.60, 0.140, 120, 9], ["daily collection request", 3, 26, 4.0, 540, 0.90, 0.010, 30, 0], ]; // Minute value of a cut legit work item (an organizational decision, model data). export const CUT_ITEM_MIN = 35; export const manualMin = (y) => y[1] * y[2]; export function automate(y, mode) { const [, n, manual, auto, write, coverage, wrongRate, rollback, cut] = y; const autoShare = mode === "manual" ? 0 : coverage; const approval = mode === "approved" ? 1.5 : 0; // human approval costs 1.5 min per item const workMin = n * (autoShare * (auto + approval) + (1 - autoShare) * manual); const wrong = mode === "full" ? n * autoShare * wrongRate : 0; const cost = wrong * (rollback + cut * CUT_ITEM_MIN); return { workMin, wrong, cost, net: manualMin(y) - workMin - cost, write: mode === "manual" ? 0 : write }; } if (import.meta.url === `file://${process.argv[1]}`) { const fmt = (B) => (h) => h.map((v, j) => (j ? String(v).padStart(B[j]) : String(v).padEnd(B[0]))).join(""); const yz = fmt([28, 9, 11, 16, 13, 12, 13]); const totalManual = PROCEDURE.reduce((a, y) => a + manualMin(y), 0); console.log(`${PROCEDURE.length} recurring procedures, ` + `${PROCEDURE.reduce((a, y) => a + y[1], 0)} items/day; manual total ${totalManual} min ` + `(lesson one's daily capacity was 1440 min)`); console.log(); console.log(yz(["procedure", "daily", "manual min", "full auto. min", "wrong action", "daily net", "payback"])); for (const y of PROCEDURE) { const t = automate(y, "full"); console.log(yz([y[0], y[1], manualMin(y), Math.round(t.workMin), t.wrong.toFixed(2), Math.round(t.net), t.net > 0 ? `${Math.ceil(y[4] / t.net)} days` : "never"])); } const t = PROCEDURE.map((y) => automate(y, "full")); console.log(`\nfull automation gives a daily net gain of ` + `${Math.round(t.reduce((a, x) => a + x.net, 0))} min, ` + `${t.reduce((a, x) => a + x.wrong, 0).toFixed(2)} wrong automatic actions/day, ` + `cost ${Math.round(t.reduce((a, x) => a + x.cost, 0))} min`); console.log(`total write-up work ${PROCEDURE.reduce((a, y) => a + y[4], 0)} min`); } ``` ``` 8 recurring procedures, 158 items/day; manual total 1215 min (lesson one's daily capacity was 1440 min) procedure daily manual min full auto. min wrong action daily net payback indicator lookup 62 248 12 0.00 236 2 days file hash lookup 38 190 8 0.00 182 1 days user verification prompt 21 189 64 0.54 100 5 days identity session termination 14 154 42 0.67 48 8 days account lockout 9 108 34 0.54 -4 never address blocking 7 112 41 0.54 -72 never endpoint isolation 4 136 62 0.34 -72 never daily collection request 3 78 19 0.03 59 10 days full automation gives a daily net gain of 477 min, 2.65 wrong automatic actions/day, cost 457 min total write-up work 3120 min ``` The first line ties back to the course's first lesson: the eight procedures produce 1,215 minutes of manual work a day, and that lesson's three-person shift had a total capacity of 1,440 minutes. Recurring response eats 84 percent of that capacity; it is one reason 64 alerts went unlooked-at in lesson one. The table's first two rows are automation's easy side. Indicator and file hash lookup change nothing, they only fetch data; their wrong action rate is zero, and automating them gains 418 minutes a day. Both procedures' write-up work is repaid in one or two days. **Automation that fetches rather than changes has no cost.** The bottom three rows are the lesson's real result. Account lockout, address blocking, and endpoint isolation give a **net negative** under full automation: -4, -72, and -72 minutes respectively. Endpoint isolation alone makes the point — only 4 items a day, 136 minutes manual, 62 minutes automated, a 74-minute gain. But there are 0.34 wrong isolations a day, and each one costs 120 minutes of rollback plus 9 cut legitimate work items. In an organization that counts a cut item at 35 minutes, that is 146 minutes a day. Gain 74, cost 146. Where the wrong action rate comes from was also measured in this topic. In lesson five, at the threshold that fit the budget, 3 of 16 alerts were false positives; if a procedure is tied to those alerts, its wrong action rate is directly the rule's precision. Automation **turns detection precision into action**: a false positive worked manually only costs review minutes, but worked automatically it cuts legitimate work. The same precision is paid in two different units under two modes. The wrong action rate and a procedure's destructiveness rise together in this model, and that is not a coincidence: the more a procedure stops, the more complex its input is. The procedures that look the most tempting to automate — the longest-running ones — are the most expensive to automate. ## Three Modes and the Break-Even Point ```js // mode.mjs — three-mode comparison, per-procedure best mode, and a break-even scan. import { PROCEDURE, CUT_ITEM_MIN, manualMin, automate } from "./procedure.mjs"; const fmt = (B) => (h) => h.map((v, j) => (j ? String(v).padStart(B[j]) : String(v).padEnd(B[0]))).join(""); const totalManual = PROCEDURE.reduce((a, y) => a + manualMin(y), 0); const modeTotal = (mode) => PROCEDURE.reduce((a, y) => { const t = automate(y, mode); return { workMin: a.workMin + t.workMin, wrong: a.wrong + t.wrong, cost: a.cost + t.cost, net: a.net + t.net, write: a.write + t.write }; }, { workMin: 0, wrong: 0, cost: 0, net: 0, write: 0 }); const yz = fmt([12, 11, 13, 13, 12, 11, 13]); console.log(yz(["mode", "work min", "wrong action", "cost min", "net min", "write min", "payback"])); for (const mode of ["manual", "approved", "full"]) { const t = modeTotal(mode); console.log(yz([mode, Math.round(t.workMin), t.wrong.toFixed(2), Math.round(t.cost), Math.round(t.net), t.write, t.net > 0 ? `${Math.ceil(t.write / t.net)} days` : "-"])); } // Best mode: for each procedure, the mode with the highest net gain. const best = PROCEDURE.map((y) => { const top = ["manual", "approved", "full"] .map((m) => ({ m, ...automate(y, m) })) .reduce((a, b) => (b.net > a.net ? b : a)); return { y, top }; }); const ys = fmt([28, 12, 12, 15, 16]); console.log("\nbest mode per procedure:"); console.log(ys(["procedure", "mode", "net min", "wrong action", "cut items"])); for (const { y, top } of best) console.log(ys([y[0], top.m, Math.round(top.net), top.wrong.toFixed(2), (top.wrong * y[8]).toFixed(2)])); const net = best.reduce((a, s) => a + s.top.net, 0); const write = best.reduce((a, s) => a + s.top.write, 0); console.log(`\nselective-mode daily net ${Math.round(net)} min (manual was ${totalManual} min), ` + `write-up work ${write} min, payback ${Math.ceil(write / net)} days`); // Break-even point: if the wrong action rate and the cut item's minute value change. const yk = fmt([14, 14, 14, 16, 18]); console.log("\nbreak-even point under full automation:"); console.log(yk(["wrong multiplier", "item min 10", "item min 35", "item min 90", "profitable procs"])); for (const c of [0.25, 0.5, 1, 2, 4]) { const calc = (kd) => PROCEDURE.reduce((a, y) => { const [, n, , , , coverage, rate, rollback, cut] = y; const t = automate(y, "full"); const wrong = n * coverage * rate * c; return a + (manualMin(y) - t.workMin - wrong * (rollback + cut * kd)); }, 0); const profitable = PROCEDURE.filter((y) => { const [, n, , , , coverage, rate, rollback, cut] = y; const t = automate(y, "full"); return manualMin(y) - t.workMin - n * coverage * rate * c * (rollback + cut * CUT_ITEM_MIN) > 0; }).length; console.log(yk([`${c}x`, Math.round(calc(10)), Math.round(calc(35)), Math.round(calc(90)), `${profitable}/${PROCEDURE.length}`])); } ``` ``` mode work min wrong action cost min net min write min payback manual 1215 0.00 0 0 0 - approved 500 0.00 0 715 3120 5 days full 281 2.65 457 477 3120 7 days best mode per procedure: procedure mode net min wrong action cut items indicator lookup full 236 0.00 0.00 file hash lookup full 182 0.00 0.00 user verification prompt full 100 0.54 0.54 identity session termination approved 95 0.00 0.00 account lockout approved 64 0.00 0.00 address blocking approved 64 0.00 0.00 endpoint isolation approved 71 0.00 0.00 daily collection request full 59 0.03 0.00 selective-mode daily net 870 min (manual was 1215 min), write-up work 3120 min, payback 4 days break-even point under full automation: wrong multiplier item min 10 item min 35 item min 90 profitable procs 0.25x 881 820 686 8/8 0.5x 827 705 437 7/8 1x 721 477 -60 5/8 2x 508 20 -1054 4/8 4x 81 -894 -3041 4/8 ``` The three-mode table gives an unexpected order: **approved mode gains more than full automation**. Full automation cuts work time to 281 minutes, approved mode leaves it at 500; but full automation carries a 457-minute cost and its net gain stays at 477, while approved mode's is 715. Two hundred nineteen minutes of extra approval work prevents four hundred fifty-seven minutes of wrong-action cost. The right answer is not picking a single mode, it is picking per procedure. The second table does this: the four data-fetching procedures land on full automation, the four that change something land on approved mode. The daily net rises to 870 minutes — 72 percent of the 1,215 manual minutes — and the 3,120-minute write-up work is repaid in **four days**. The cut legitimate work item column is 0.54 a day under this selection; full automation had 2.65 wrong actions a day and far more cut items. The last table shows sensitivity to two unknowns and closes out the course's measure. If the wrong action rate quadruples, full automation is still positive (81 minutes) when a cut item is counted at 10 minutes; it is -894 at 35 minutes, and -3,041 at 90 minutes. Same line, same procedures, same wrong rate — the only thing that flips the result is **how many minutes the cut legitimate work is counted as**. That number is not a security metric, and it cannot be set by the security team. The right-hand column says something else: even if the wrong rate quadruples, four of the eight procedures stay positive. These are the data-fetching procedures, and their wrong action rates are already close to zero. Automation's safe zone is work that **changes nothing**; for every job that changes something, the decision comes down to weighing the minutes gained against the legitimate work cut. ## Summary - Eight recurring procedures produce 158 items and 1,215 minutes of manual work a day; that is 84 percent of lesson one's 1,440-minute daily capacity. - Automation has no cost on data-fetching procedures: indicator and file hash lookup gain 418 minutes a day, and the write-up work is repaid in one or two days. - Three of the change-making procedures give a net negative under full automation: endpoint isolation gains 74 minutes but 0.34 wrong isolations a day cost 146 minutes. - Approved mode gains more than full automation: 715 versus 477 minutes, because 219 minutes of extra approval work prevents 457 minutes of wrong-action cost. - Selecting the mode per procedure raises the daily net to 870 minutes, and the 3,120-minute write-up work is repaid in four days; the cut legitimate work item drops to 0.54 a day — full automation had 2.65 wrong actions a day and far more cut items. - When the cut legitimate work's minute value is taken as 90 instead of 10, full automation drops to -60 minutes at a 1x wrong rate; that number is an organizational, not a technical, decision. ## Next Step This topic built a pipeline and counted every step of it: sources were mapped to a single schema and the unmapped fields were counted, a correlation rule was run and what it missed was written down, a threshold scan measured the band where false positives and misses cannot be reduced at the same time, rule versions were compared, hypotheses were run, feeds were split along a lifespan axis, and recurring response was automated. All of these numbers belonged to detection time — the time **before** the moment an alert turns out **right** — containment time was never measured. What happens after it turns out right was never written down. In this lesson's approved mode, who approves, under what authority endpoint isolation is applied, who decides when nine legitimate work items are cut, and who is informed after the decision — these stand in the model as mere numbers, but in an organization they are a role, an authority boundary, and a sequence of steps. The next topic, **Incident Response**, addresses exactly this: from preparation to identification, containment to eradication and recovery — which step is taken by whom, under what authority, and in what time.