Andrei Cotaie is a Security Engineer specialised in Incident Response. Currently working for UiPath’s Security Operation Center, Andrei made the transition from the public to the private sector almost 9 years ago. A big fan of automation and machine learning enthusiast, Andrei spends most of his time involved in monitoring, engineering and RPA security related projects, trying to take automation of security tedious tasks as Incident Response, Acquisition and Forensics to the next level.  

Using RPA for a fast, reliable and repeatable Incident Response process

Incident Response at its core has always been a combination of Management and Technical activities, both with equal importance and urgency. But which are you going to tackle first as an incident occurs? If you’re like us, every nerve in your body will scream for you to get hands on, investigate and mitigate the threat. But your manager might have a different opinion, because if it’s not written down, then it didn’t happen, it is not accounted for and, therefore, it cannot be escalated to upper management. 

So this is where the RPA comes in. We have successfully used it to automate the boring, or the mundane tasks. But why stop there when you can also automate the critical, time essentials activities? 

Our RPA PoC will highlight how you can automate the full incipient management tasks in just under one minute. Immediately after this, it can start a full forensics process, acquisition and investigation in just minutes after an incident has been declared, while also creating a detailed dynamic timeline of all the activities around the incident. Should we also say that all of this is done with just a couple of clicks?

This presentation is co-presented with Cristian Miron, Security Engineer at UiPath.