#HITB2023HKT #COMMSEC D1 LAB - Automated Incident Response

### Overview In this workshop session at Hack in the Box (HITB), speakers Valentine (Val) and Harjit from the GitLab Security Incident Response Team (SIRT) share how their globally distributed team automates end-to-end incident response workflows. Operating across APAC, EMEA, and Americas regions, the team uses automation to ensure 24/7 service continuity, combat alert fatigue, standardize triage and documentation, and generate operational metrics to justify team headcount.

### Key Topics - **Broader Scope of IR Automation:** Automation extends far beyond investigation log dives; it encompasses detection engineering, alerting pipelines, incident management, handovers, documentation, and metrics generation. - **Detection as Code & Deployment Pipelines:** Managing detections in GitLab repositories with review processes, standardized formatting checks via CI/CD pipelines, and automatic deployment to their SIEM (Devo). - **User Attestation Module (UAM):** Automated outreach via Slack bots to prompt users when high-risk events occur (e.g., Personal Access Token creation). Alerts auto-escalate if unacknowledged within a set timeframe (such as one hour). - **Shift Handovers with "Hogi":** Maintaining continuity across time zones through automated asynchronous handovers and sync issue creation in GitLab. - **GUARD Architecture:** The GitLab Universal Automated Response and Detection system, which ties together SIEM alerts, Slack interactions, Tines automation workflows, and a custom metric database (metricDB).

### Technical Details - **Tool Ecosystem:** GitLab acts as the single source of truth for issues, documentation, and CI/CD pipelines; Devo functions as the SIEM; Slack provides an interactive chat interface for engineers; and Tines serves as the no-code SOAR platform orchestrating actions. - **Alert Lifecycle in Slack:** When a Devo alert fires into Tines, Tines enriches the event with metricDB data and threat intelligence before presenting an interactive Slack prompt. Engineers can acknowledge, reassign, convert to an incident issue, or close the alert while logging qualitative feedback (sentiment analysis and relevance scores). - **Practical Lab Execution ("Tokenheimer"):** Participants constructed a workflow integrating a Slack slash command (`/nuke`) via a webhook into Tines. Tines extracted the token parameter from `web_hook.body.text` and executed an HTTP DELETE request against the GitLab API self endpoint (`/personal_access_tokens` / self API) to immediately revoke exposed credentials. In advanced exercises, attendees added GET queries against the `/users` endpoint to determine username and permission scopes before revocation.

### Takeaways - Standardizing and automating operational workflows allows small, understaffed security teams to scale consistently without manual overhead. - Capturing metrics directly during alert triage (true/false positive rates, engineer sentiment) provides data necessary to tune noisy detections and justify organizational resources. - High-risk manual actions can be safely accelerated by blending interactive user attestation with automated fallbacks.