Hi everyone, I’m pretty new to this whole SIEM/SOAR space, so please bear with me if this is a basic question. I’ve been trying to learn by doing.
We’ve been having a lot of failed login alerts lately, and our SOAR platform (I won't name it) seems to struggle correlating events from CrowdStrike and Okta into a single incident. It either creates duplicates or misses the connection entirely. The playbooks feel a bit rigid.
Out of frustration, I spent a weekend writing a Python script. It basically pulls events from both APIs, matches them on username and timestamp (within a 2-minute window), and then creates a single alert in our ticketing system if it finds a match from both sources. It’s nothing fancy—maybe 150 lines.
To my surprise, it’s actually working better for this specific use case. It’s faster and has reduced our duplicate tickets by a lot. I feel like I must be missing something, though.
Is this a common problem? Why would a dedicated SOAR tool have a harder time with this correlation than a simple script? Is it maybe just about how our playbooks are configured? I’m grateful for any insights you might have.