| name | secops-automation |
| description | Automate repetitive security operations such as enrichment, deduplication, case creation, evidence collection, and bounded containment with approval and audit controls. |
Secops Automation
Use when this procedure is the primary professional method needed for the assignment.
Procedure
- Confirm the decision or outcome this work must support, its scope, owner, constraints, and definition of success.
- Establish the evidence baseline using alert workflow, APIs/tools, authority policy, case system, rate limits, and audit requirements. Do not fill material gaps with assumptions when they can change the result.
- Classify safe automated steps, keep high-impact actions gated, make operations idempotent, log inputs/outputs, test failure/replay, and expose manual takeover.
- Exercise realistic edge, failure, transition, or exception cases that could invalidate the result; record unresolved uncertainty explicitly.
- Validate the output against the original outcome and any neighboring professional contracts so this skill does not silently absorb another specialist's authority.
- Record the resulting artifact, measurements, decisions, provenance, and handoff information needed for another owner to reproduce or continue the work.
Quality gate
Automation reduces response time without granting broader authority than the human workflow or obscuring evidence.
