Open-Source Automation in Cyber Incident Response Processes: A Low-Code-Based Continuous Detection, Verification, and Response Architecture
Abstract
Cyber threats are becoming increasingly complex; organizations face difficulties in implementing security policies due to staffing shortages and financial constraints. Manual approaches lead to high "wait times" and false alarms, exposing organizations to risks from cyberattacks. This study proposes a cost-effective, open-source, and lowcode Security Orchestration, Automation, and Response framework for public and private organizations. The proposed system incorporates Wazuh, n8n, OpenVAS, and GLPI solutions and is implemented using a Docker microservice-based architecture operating according to a "zero-touch" approach. The presented solution will help Türkiye develop its national cybersecurity infrastructure at the micro level by minimizing the need for highly skilled personnel.
Fields of Study & Subjects
Software System Performance and Reliability
Network Security and Intrusion Detection
Information and Cyber Security
Publication details
- Journal / source
- Beykent üniversitesi fen ve mühendislik bilimleri dergisi
- Publisher
- Beykent University Journal of Science and Engineering
- Volume
- 19
- Issue
- 1
- Pages
- 32–54
- Publication date
- 29 June 2026
- Language
- TR