Team Lead for Global Security at a non-tech company with 201-500 employees
Real User
Oct 18, 2022
We use this solution for automated orchestration within our environment. Specifically for us that is privileged escalation, detections, and malware detections that we want to have investigated.
We primarily use the solution for SIEM alerts triage automation and MITRE detection playbooks. We have hundreds of alerts from various detection tools fed into our SIEM. Correlation within the SIEM is difficult for us since our SIEM only supports simple filtering and one level of data sources correlation. Managing and updating correlation rules is a pain. We are now propagating alerts fed into the SIEM directly to LogicHub via a webhook. Within the LogicHub, we have playbooks that automatically enrich the alerts, baseline checking the alerts, risk weighing and scoring the alerts, and then stack ranking the riskiest and impactful ones to be escalated into a case so our analyst can be the human in the loop before we fire off any automated response.
Find out what your peers are saying about Devo, Splunk, ServiceNow and others in Security Orchestration Automation and Response (SOAR). Updated: October 2026.
Security Orchestration Automation and Response integrates security tools and processes, enhancing threat detection, investigation, and response. It minimizes human intervention, making security operations more efficient.Security Orchestration Automation and Response solutions streamline incident management by allowing security teams to automate repetitive tasks, analyze threat data from multiple sources, and orchestrate responses to incidents. These solutions typically provide an automated...
We use this solution for automated orchestration within our environment. Specifically for us that is privileged escalation, detections, and malware detections that we want to have investigated.
We primarily use the solution for SIEM alerts triage automation and MITRE detection playbooks. We have hundreds of alerts from various detection tools fed into our SIEM. Correlation within the SIEM is difficult for us since our SIEM only supports simple filtering and one level of data sources correlation. Managing and updating correlation rules is a pain. We are now propagating alerts fed into the SIEM directly to LogicHub via a webhook. Within the LogicHub, we have playbooks that automatically enrich the alerts, baseline checking the alerts, risk weighing and scoring the alerts, and then stack ranking the riskiest and impactful ones to be escalated into a case so our analyst can be the human in the loop before we fire off any automated response.