2026-10-02 –, WORKSHOP 2 (GetRoot no Jutsu) Language: English
Everyone talks about SOAR; few have wired one up end to end. In this hands-on lab you'll build the "respond" half of a real detection-and-response pipeline — no slideware, no vendor console.
We hand you a live AWS environment: an API gateway and WAF fronting a target app, with all traffic and attack detections already flowing into Splunk. Your job is to build the automation that fires when Splunk raises an alert, using n8n (open-source, low-code) as the orchestrator.
You'll answer one question — "should I block this IP?" — with steadily rising intelligence. First, block on any alert (and watch the false positives roll in). Then block only when threat intel says the IP is malicious. Then hand the decision to an AI agent that investigates for itself: it queries multiple intel sources and runs its own Splunk searches, then returns a verdict with its reasoning. Finally, put a human in the loop to approve or overrule the agent — because trusting an autonomous blocker is the real 2026 question — and, time permitting, make the block self-reverse with a TTL and an audit trail back to Splunk.
You'll leave with a working, governed, AI-triaged auto-response pipeline and the patterns to rebuild it at home. Bring a laptop; we bring the infrastructure (AI model included).
Mattia — "Doc" to most people — is a Senior Defense Security Engineer at Satispay, where he works across the full defensive stack: detection engineering, monitoring, incident response and security automation for a European fintech. Splunk and n8n are two of his everyday tools, but the job spans the whole blue-team surface — building the systems that catch attacks and the automation that responds to them safely. He's spent years turning noisy signals into actions a SOC can trust, and is increasingly focused on where AI fits into that loop: genuinely useful for triage, dangerous without guardrails. Doc believes the hard problem in security automation isn't automating the response, but automating it safely — and would rather prove it with a working lab than a deck. This is his first time on the RomHack stage.
Alessandro Serpi is a Defensive Security Engineer at Satispay. Focused in building robust SIEM and SOAR architectures, he specializes in automating incident response pipelines and designing cross-functional tools that extend traditional cybersecurity capabilities into adjacent domains, such as fraud detection.
