At RSA2019 I heard about a SOAR customer that had to add delays to their playbook “wait 5 minutes before replying” so end users felt their request was being handled with care and not simply scripted.
It reminded me of a story of an Italian tortellini maker that bought 5 different pasta machines to keep the product looking ‘varied’ so customers would believe the pasta was hand made.
So what can we do to give SOAR that human touch? (DBot if you’re reading this, no offence my friend, I still think you’re great)
Approach #1 – Make automation more human like
Adding a time delay to responses to simulate an overworked team
Use a pre-written list of slightly varying replies with the occasional spelling mistake
Sometimes just close a ticket for no reason (or just don’t open it)
Approach #2 – Human chaperone
Random 10% chance that a human sends the last communication “I’ve been watching the ticket and it all looks good, did it meet your needs?”
If the submitter hasn’t used automation before, acknowledge this in your initial reply “we can see you are new and we’re assigning a human to watch over as you engage through this process”
Run a weekly report of new end users and give them a call to review
“Click here if you ever want to escape this automation and talk to someone”
Include “this is an automated response – an analyst response will follow”
I’d love to hear from anyone that has faced this problem and which gave the best success…