A lightweight Security Orchestration, Automation and Response (SOAR) tool built in Python. Automatically ingests security alerts, triages severity, enriches with threat intelligence, and generates structured incident tickets — mimicking real-world SOAR platforms like Splunk SOAR and Palo Alto XSOAR.
- Ingests security alerts from a JSON alert file
- Triages each alert by severity (CRITICAL, HIGH, MEDIUM, LOW)
- Enriches alerts with IP reputation lookup and user context
- Generates a structured incident report for each alert
- Logs all actions with timestamps for audit trail
- Brute force login attempts
- Privilege escalation events
- Suspicious outbound connections
- Unauthorized file access
src/— Core Python automation scriptssample-alerts/— Sample security alert JSON filesreports/— Auto-generated incident reportsdocs/— Architecture and usage documentation
- Python security scripting
- Alert triage and enrichment
- SOAR workflow automation
- Incident report generation
- Detection engineering
pip install -r requirements.txt
python src/soar_engine.py