I've been working as a security automation engineer for a few years now and I noticed that automation in security mostly exclusive to enterprises with mature security practices like banks, big tech, etc. Small and medium business which have way less resource and budget to hire automation experts are always the ones most at risk and stuck with "Tab Fatigue", manually pivoting between different solutions.
But now with MCP servers, these automation can all be done basically with a LLM, but yet again you need a dev to create the tools the MCP server will use.
The Goal would be To give small teams the "power" of a SOAR without the $50k-300k/year price tag and the need for a dedicated automation engineer. (note that having a incident/case management tool is still useful)
I actually went and created this ultra early early alpha (MVP) where a SOC analyst can query their entire stack in natural language. The MCP server is linked with the tools the business is using, including case management.
So I was wondering if this could be a useful tool for SOC analyst to help them enrich their data/incidents and help them focus on a single tool instead of going though dozen of tools and tabs. Would the "Single Pane of Glass" via Chat actually useful
[link] [comments]