Automate Cloud Security Incident Management With a SOAR-Based Approach

Modern organizations increasingly integrate public cloud platforms such as AWS, Azure, and Google Cloud Platform into their infrastructure to enhance flexibility and scalability. However, multi- cloud environments introduce new cybersecurity challenges. Human factors and careless handling of access parameters to cloud resources can create serious threats. In particular, if an attacker gains access to authorization keys, they can not only control existing resources but also create new ones for malicious purposes-such as launching attacks, distributing malware, or mining cryptocurrencies. Such incidents can rapidly cause financial losses, undermine user trust, and disrupt the stability of critical services.

This study explores the use of Splunk SOAR (Security Orchestration, Automation, and Response) as a tool for automated detection, analysis, and response to threats in public cloud environments. The primary focus is on integrating Splunk SOAR with cloud providers’ APIs to dynamically block compromised resources and to implement detailed response playbooks that isolate threats at the level of individual components (virtual machines, network policies, user accounts).

The paper also analyzes the integration of Splunk anomaly detection with Palo Alto Prisma as a comprehensive deviation scanner, the use of HashiCorp Vault for credentials protection, the introduction of a quarantine mode for isolating compromised resources, and the improvement of incident response processes.

The results demonstrate that automating security processes with Splunk SOAR significantly reduces response time, minimizes the impact of the human factor, and lowers the risk of cloud infrastructure compromise. The proposed approach strengthens an organization’s resilience to threats in a multi-cloud environment, ensuring an optimal balance between security, availability, and operational efficiency.