Defensive Security Automation

GASAE · 20 questions

• A city must deploy EDR agents to all hybrid-joined endpoints including seasonal parks staff laptops. What defensive automation focus is that?
• A county uses Intune or GPO automation to heal missing logging agents on clerk desktops. What agent-ops pattern is that?
• A transit authority stages Velociraptor-class collectors only on labeled IR jump hosts first. What rollout pattern is that?
• A school district monitors agent health dashboards and tickets machines offline more than 24 hours. What operational control is that?
• A housing authority refuses agents that need local admin forever after install. What deployment requirement is that?
• A city IR playbook auto-collects prefetch, authentication logs, and browser history on suspected phishing hosts. What defensive automation practice is that?
• A county uses remote collection that hashes files before transfer to the evidence share. What artifact-handling goal does that automation serve?
• A public-health SOC limits automated collection so it never pulls full EHR database dumps during host triage. What scoping principle is that?
• A parks IT team schedules memory captures only when ransomware-class alerts fire. What collection strategy is that?
• A library consortium centralizes collected artifacts into a WORM evidence bucket with retention tags. What evidence-handling automation is that?
• A city enrichment pipeline adds GeoIP, WHOIS, and CMDB owner to every external IP in alerts. What enrichment practice is that?
• A county skips detonation-sandbox enrichment for URLs that resolve inside the permit application domain. What enrichment rule is that?
• A transit SOC caches threat-intel lookups so enrichment stays within API rate limits during major events. What enrichment design is that?
• An emergency-management fusion center enriches security alerts with weather and event context during disasters. What enrichment approach is that?
• A court security team strips SSNs from tickets before enrichment calls leave the network. What enrichment safeguard is that?
• A city feeds automated enrichments into both the SOC SIEM and the regional fusion center portal. What integration pattern is that?
• A county wants fusion analysts to reuse the same artifact packages the SOC already collected. What integration goal is that?
• A 311 security ops desk receives only high-severity enriched tickets while low noise stays in the SIEM. What routing pattern is that?
• A water utility maps OT-adjacent IT alerts into the fusion taxonomy without exposing plant networks. What integration practice is that?
• A city CISO measures defensive automation by reduced dwell time from alert to enriched ticket in the SOC. What effectiveness approach is that?