https://www.sans.org/reading-room/whitepapers/incident/balancing-security-innovation-event-driven-automation-36837