OVERVIEW
This whitepaper document aims to show how to implement AI tooling into a SOAR (Security Orchestration, Automation, Response) platform. The platform are mostly used in SOCs (Security Operation Centres) and require a lot of analytical power to classify and nullify threats.
According to various research, the biggest shortcoming in a SOC environment is lack of automation, too many tools, alert fatigue and large time consumption on manual analysis. This document will walk through how to create a bare-bones SOC on a virtual machine and implement a level of automatic log analysis.
The installation procedures have been taken from publicly available documentation.