Using Automation and AI for Detection Engineering and Incident Response

GASAE · 20 questions

• A city maps each SOAR action to PICERL phases so gaps in automated IR support are visible. What practice does that mapping establish?
• A county wants generative AI to draft situation reports only after containment is confirmed. Where should that assist sit in the IR lifecycle?
• A transit SOC wants evidence preservation to finish before eradication playbooks run. How should automated IR actions be ordered?
• A public-health team wants every P1 incident to capture lessons learned through automation rather than hoping someone remembers. Which approach best fits the IR lifecycle?
• A school district organizes SOAR folders by NIST-style IR phases to teach new analysts the response model. What training practice is that?
• A city needs automated forensic triage timelines for ransomware hosts using Timesketch/Velociraptor-class tooling. Which approach best fits municipal IR?
• A county wants memory images hashed and cataloged by workflow before analysts review them. What forensic automation practice is that?
• A housing authority limits automated deep forensic pulls to machines that are already isolated. What gating practice does that enforce?
• A parks IT team needs scripted forensic analysis to timeline auth anomalies across multiple branch sites. Which approach best fits that multi-site civic need?
• A library consortium wants forensic automation outputs stored with case IDs that match SOAR. Why does that linkage matter?
• A city detection engineer uses an LLM to draft Sigma from ATT&CK notes, then tests the rule in CI. Which practice best describes that workflow?
• A county wants to catch detection regressions by replaying historical municipal alerts against new rules. What automation practice is that?
• A transit team refuses to promote AI-generated detections that lack unit tests. What quality gate is that enforcing?
• An emergency-management SOC promotes detections only after purple-team emulation confirms hits. What loop does that close?
• A court IT group versions detections and requires peer review the same way application PRs do. What discipline is that applying?
• A city SOC wants an agent to propose next investigation queries from the current Sentinel incident graph. Which capability is that using?
• A county forbids generative models from executing containment APIs unless a human provides a token. What autonomy limit is that?
• A 311 team grounds AI suggestions in past tickets so similar resolved civic incidents surface during triage. Which technique is that?
• A water utility evaluates AI SOC assist by whether mean time to understand drops without raising wrong-isolate counts. What evaluation approach is that?
• A city CISO pilots agentic enrichment first and defers agentic response until audit signs off. What adoption strategy is that?