Hangyu Hu1, Liangrui Zhang1, Xiaowei Huang1, Xingmiao Yao1,2,*, Youyang Qu3, Xia Wu1, Guangmin Hu1,2
CMC-Computers, Materials & Continua, Vol.88, No.3, 2026, DOI:10.32604/cmc.2026.081752
- 23 July 2026
Abstract With the evolution of information technology toward more advanced intelligence and automation, Security Orchestration, Automation, and Response (SOAR) has become a critical foundation for security incident handling, owing to its intelligent orchestration capabilities. Security playbooks, as the core mechanism for automated response in SOAR, require well-designed workflows and precise action matching to ensure efficient and accurate alert handling. However, with the rising sophistication of attacks and the expanding scale of security alerts, traditional expert-driven playbook recommendation approaches often degrade in recommendation quality or completely fail when existing playbook repositories cannot adequately cover unknown or novel… More >