## Common Automation Use Cases

Where should you start automating?

### 1. Phishing Triage (The #1 Time sink)
*   **Manual**: Analyst opens email, extracts URL, checks URLScan.io, checks sender IP... (15 mins).
*   **Automated**: User forwards email to `phish@company.com`. SOAR extracts artifacts, scans them, and only alerts the analyst if it finds a malicious link. (0 mins human time for clean emails).

### 2. Malware Containment
*   **Trigger**: EDR detects Ransomware.
*   **Action**: Automatically isolate the host via API call to EDR.
*   **Why**: Speed is critical. If you wait 20 minutes for a human to see the ticket, the whole network is encrypted.

### 3. User Onboarding/Offboarding
*   **Trigger**: HR system says "Bob is fired".
*   **Action**: Disable Active Directory account, revoke VPN, wipe mobile device.

### 4. Threat Intel Management
*   **Trigger**: New IOC list from CISA.
*   **Action**: Push IPs to firewall blocklist automatically.