Everyone talks about SOAR; few have wired one up end to end. In this hands-on lab you'll build the "respond" half of a real detection-and-response pipeline — no slideware, no vendor console.
We hand you a live AWS environment: an API gateway and WAF fronting a target app, with all traffic and attack detections already flowing into Splunk. Your job is to build the automation that fires when Splunk raises an alert, using n8n (open-source, low-code) as the orchestrator.
You'll answer one question — "should I block this IP?" — with steadily rising intelligence. First, block on any alert (and watch the false positives roll in). Then block only when threat intel says the IP is malicious. Then hand the decision to an AI agent that investigates for itself: it queries multiple intel sources and runs its own Splunk searches, then returns a verdict with its reasoning. Finally, put a human in the loop to approve or overrule the agent — because trusting an autonomous blocker is the real 2026 question — and, time permitting, make the block self-reverse with a TTL and an audit trail back to Splunk.
You'll leave with a working, governed, AI-triaged auto-response pipeline and the patterns to rebuild it at home. Bring a laptop; we bring the infrastructure (AI model included).