## Why Automate Security?

The SOC is drowning.
*   **Alert Volume**: 10,000 alerts/day.
*   **Staff**: 5 Analysts.
*   **Math**: Impossible.

### The Solution: SOAR (Security Orchestration, Automation, and Response)
SOAR tools replace manual, repetitive clicks with code.

### Benefits
1.  **Speed**: A human takes 20 minutes to block an IP on 10 firewalls. A script takes 1 second.
2.  **Consistency**: Humans make typos. Scripts do exactly what they are told.
3.  **Morale**: No analyst wants to spend 8 hours resetting passwords. Automate the boring stuff so analysts can hunt.

### The "O" in Orchestration
Connecting different tools.
*   "Take the IP from Splunk."
*   "Check it in VirusTotal."
*   "Send a Slack message."
*   "Add to Palo Alto firewall."
These tools don't talk to each other natively. SOAR is the glue (API Connector).

### Risks of Automation
**Automating a bad process just breaks things faster.**
*   *Bad Rule*: "Block any IP that fails login 5 times."
*   *Scenario*: CEO forgets password.
*   *Automation*: Blocks the entire office NAT IP.
*   *Result*: Fireable offense.
*   *Fix*: Always have a "Human in the Loop" for destructive actions until you are 100% sure.