BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.romhack.io//romhack-camp-2026//speaker//HEQYHT
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-romhack-camp-2026-AHQ3ZZ@cfp.romhack.io
DTSTART;TZID=CET:20261002T180000
DTEND;TZID=CET:20261002T200000
DESCRIPTION:Everyone talks about SOAR\; few have wired one up end to end. I
 n this hands-on lab you'll build the "respond" half of a real detection-an
 d-response pipeline — no slideware\, no vendor console.\n\nWe hand you a
  live AWS environment: an API gateway and WAF fronting a target app\, with
  all traffic and attack detections already flowing into Splunk. Your job i
 s to build the automation that fires when Splunk raises an alert\, using n
 8n (open-source\, low-code) as the orchestrator.\n\nYou'll answer one ques
 tion — "should I block this IP?" — with steadily rising intelligence. 
 First\, block on any alert (and watch the false positives roll in). Then b
 lock only when threat intel says the IP is malicious. Then hand the decisi
 on to an AI agent that investigates for itself: it queries multiple intel 
 sources and runs its own Splunk searches\, then returns a verdict with its
  reasoning. Finally\, put a human in the loop to approve or overrule the a
 gent — because trusting an autonomous blocker is the real 2026 question 
 — and\, time permitting\, make the block self-reverse with a TTL and an 
 audit trail back to Splunk.\n\nYou'll leave with a working\, governed\, AI
 -triaged auto-response pipeline and the patterns to rebuild it at home. Br
 ing a laptop\; we bring the infrastructure (AI model included).
DTSTAMP:20260921T191249Z
LOCATION:WORKSHOP 2 (GetRoot no Jutsu)
SUMMARY:Keep caLLM and Let It Block: Agentic SOAR with n8n + Splunk - Doc\,
  aserpi\, Ric\, Francesco Viscardi
URL:https://cfp.romhack.io/romhack-camp-2026/talk/AHQ3ZZ/
END:VEVENT
END:VCALENDAR