# Soar Playbook Builder

> Design and generate SOAR automation playbooks that enrich alerts with threat intelligence (VirusTotal, Group-IB, AbuseIPDB, OTX) and orchestrate automated response via device APIs — blocking IOCs on firewalls (Palo Alto, Fortinet, Check Point), WAFs (Cloudflare, AWS WAF, F5), IPS, DLP, and EDR. Produces vendor-neutral playbook definitions with decision logic, approval gates, rollback, and safety…

- **Type:** Skill
- **Install:** `agentstack add skill-arttapon1-defensive-soc-skills-soar-playbook-builder`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [arttapon1](https://agentstack.voostack.com/s/arttapon1)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [arttapon1](https://github.com/arttapon1)
- **Source:** https://github.com/arttapon1/defensive-soc-skills/tree/master/skills/soar-playbook-builder

## Install

```sh
agentstack add skill-arttapon1-defensive-soc-skills-soar-playbook-builder
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SOAR Playbook Builder

Turn a detection into an automated, auditable response: enrich the indicator, decide with explicit logic, act through device APIs, and always leave a rollback path. Playbooks are authored vendor-neutral, then bound to concrete integrations.

> **Safety first — automation that blocks production traffic can cause outages.**
> Every generated playbook defaults to **dry-run**, requires an **approval gate** for
> any destructive/blocking action on production, scopes blocks with a **TTL/expiry**,
> and ships with a **rollback** step. Only operate against infrastructure you are
> authorized to control.

## Activation triggers

- The user wants to auto-enrich alerts with threat intel.
- The user wants to auto-block/contain IOCs on firewall / WAF / IPS / DLP / EDR.
- The user wants to orchestrate a multi-step response with decision logic.

## Design principles

1. **Enrich before you act.** Never block on a raw indicator. Gather reputation from multiple sources and require a confidence threshold.
2. **Human-in-the-loop for blast radius.** Auto-act on low-risk, reversible steps; gate anything that can break production behind an approval.
3. **Everything is reversible & time-boxed.** Blocks carry a TTL and an explicit rollback action. Log every action with who/what/when/why.
4. **Idempotent & rate-aware.** Re-running must not double-apply. Respect API rate limits and back off.
5. **Fail safe, not open.** On integration error, alert a human — do not silently drop the response.

## Workflow

1. **Define the trigger.** What detection/alert starts this playbook? (Handoff from `siem-detection-engineer`.) Capture the indicator(s) and context.

2. **Enrichment stage.** Choose intel sources from `resources/integration-catalog.md`. Use `scripts/enrich_ioc.py` as the reference client (VirusTotal, AbuseIPDB, OTX, Group-IB placeholders). Compute an aggregate risk score and confidence.

3. **Decision logic.** Write explicit conditions: e.g. `if malicious_votes >= N and confidence == high -> block; elif suspicious -> tag + escalate; else -> close as FP`. No implicit "always block."

4. **Response actions.** Map each action to a device integration in `resources/integration-catalog.md`. Use `scripts/respond_block.py` as the reference client for firewall/WAF blocking with dry-run, TTL, and rollback. Sequence: contain → notify → ticket.

5. **Guardrails.** Add: allowlist of never-block assets (corp ranges, partners, monitoring), max-actions-per-run circuit breaker, approval gate for production, and full audit logging.

6. **Emit the playbook.** Fill `templates/playbook-template.yml` — a vendor-neutral spec with trigger, enrichment, decision, actions, guardrails, rollback. Optionally note how it maps to a specific platform (Cortex XSOAR, Splunk SOAR, Tines, Shuffle, native SIEM automation).

7. **Test plan.** Provide a dry-run walkthrough with a sample alert, expected decision, and the exact API calls that *would* fire (without firing them).

## Output format

- Playbook YAML (vendor-neutral) per the template.
- A decision table (condition → action).
- Integration binding notes (which API, which credential, which endpoint).
- A dry-run test walkthrough.
- Guardrail & rollback summary.

## Handoffs

- Triggered by detections from `siem-detection-engineer`.
- Blocked/contained IOCs and actions taken → feed back into `ir-report-builder` for the incident record.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [arttapon1](https://github.com/arttapon1)
- **Source:** [arttapon1/defensive-soc-skills](https://github.com/arttapon1/defensive-soc-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arttapon1-defensive-soc-skills-soar-playbook-builder
- Seller: https://agentstack.voostack.com/s/arttapon1
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.