By use case
For SOAR automation
A playbook acts before anyone reviews it. A false positive becomes an incident at machine speed.
Automation-grade — scored inputs, and a fast verdict at decision time.
The problem
Automation makes precision a prerequisite, not a preference
Manual triage tolerates a noisy feed because a human is the filter. A playbook has no such filter — block, isolate and disable all execute at the speed of the trigger, and the cost of acting on a known-good address is an outage you caused yourself.
Two things make automation safe: subtracting what should never have fired, and having a verdict fast enough to sit inside the playbook.
What answers it
The building blocks that solve it
RST Noise Control
The known-good set — CDNs, cloud ranges, popular infrastructure — so playbooks never fire on them.
RST IoC Lookup
A scored verdict on a single indicator, fast enough to call mid-playbook.
RST Threat Feed
Scored, decayed indicators, so the playbook can branch on confidence rather than mere presence.
Enrichment inside the playbook
Give the branch something to branch on
A playbook that only knows present in feed / absent from feed has two branches and no judgement. Every call below returns structured facts mid-run, so the decision node has something better than a boolean — and Noise Control runs first, so you never spend an enrichment call on a CDN edge.
Discard the known-good first
Bulk-check a whole alert batch against the benign set before anything else runs.
The cheapest step in the playbook: it removes the indicators that were never going to be actionable, so the expensive nodes downstream only see candidates.
A scored verdict, fast
One indicator in, a score with its contributing dimensions out.
Branch on confidence rather than presence — auto-contain above your high-confidence line, enqueue for review in the middle band, drop below it.
Age as a severity input
Creation date, registrar and nameservers for the domain in the alert.
A simple, durable rule: newly registered plus any other signal escalates. Domain age is one of the few enrichments that almost never ages badly.
Decide a phish without a human
Render the URL and pull the body it serves.
A credential form posting off-domain is a machine-checkable fact. That is enough to raise severity and pull the message from every other inbox automatically.
Expand one hit into the cluster
Certificate SANs and favicon fingerprint for the host in question.
Turns a single-indicator containment into a campaign-wide block, inside the same run, without waiting for a human to think to pivot.
Confirm before you isolate
Beacon scan against the suspected listener.
Isolating a host is disruptive and political. A confirmed beacon config is the difference between an action you can defend at review and one you have to apologise for.
noise_batch_lookupon the whole reported batch. Anything benign exits the playbook here — no further calls are spent on it.ioc_lookupon what survives. A high-confidence known-bad short-circuits straight to containment.whois_domainon the unknowns. Registered within 30 days raises the working severity before anything else is known.scan_screenshotinlastmode plusscan_html_body. A login form for a brand you own, posting to a third-party host, is a decision — not a judgement call.scan_faviconandscan_ssl_certificateto pivot. The same icon and certificate typically expose the rest of the kit’s infrastructure.- Block the cluster, recall the message estate-wide, and attach every call’s output to the ticket as the rationale.
The point: six calls, no analyst, and a containment decision that arrives with its own evidence trail — so the review afterwards is about the verdict, not about what the automation was thinking.
Let the playbook decide on better inputs.
Run our feed alongside what you have and compare what your automation would have done. A month is enough to see the difference.