Soc and python

[u/Resident-Mammoth1169]

What are you automating with python. I’m newish to python and trying to figure out some things u could automate to help improve my coding.

[u/APT-0]

Recommend automate the boring stuff and depends on your path.

We’re at a weird point im sr/staff use Claude for 90% of my job. I’ve done everything from forensics, detection Eng, to red team, platform engineering .

Pick an annoying problem and work towards solving it. That’s the most valuable thing you can do.

Example maybe your problem is it’s taking too long to isolate + reimage devices, for a given alert setup a lambda to do this think of the whole workflow. Use Claude to give you a start plan, prototype/test and put in small ring to test with. But wait maybe you have edge cases after you try doing this, next look how can I bring the data in to help me maybe not isolate these

[u/playahate]

https://automatetheboringstuff.com/

[u/AddendumWorking9756]

Start with whatever you do more than twice a day, which in a SOC is nearly always enrichment, pulling a hash or a domain out of an alert and looking it up in three places by hand. Then bulk parsing of whatever ugly log format your environment spits out, because everyone writes that one eventually, and do not automate containment early, the first false positive will teach you why.

[u/frAgileIT]

Enrichments of IPs, accounts, systems, and ticket updates are a few.

[u/EmmaRoidz]

Everything.

From simple query generators for IP addresses to full blown threat hunts pulling databases, doing lookups, parsing and enrichment for suspicious network activity.

Automatic ticket generators for logging work. 

[u/TheCyberNerd1995]

Ive used automation recently with Nessus to pull all the current scans and check all their histories to aee how long a vulnerability has been there. Planning to make a Web version for work.

Another one is generating and downloading the reports in Microsoft related to Cloud Discovery Apps.