Siber Olay Müdahale Süreçlerinde Açık Kaynaklı Otomasyon: Low-Code Tabanlı Sürekli Tespit, Doğrulama ve Müdahale Mimarisi

Abstract

Siber tehditler giderek daha karmaşık hale gelmektedir; kuruluşlar personel eksikliği ve mali kısıtlamalar nedeniyle güvenlik politikalarının uygulanmasında zorluk çekmektedir. Manuel yaklaşımlar, yüksek "bekleme süresi" ve yanlış alarmlara yol açarak kuruluşları siber saldırılar açısından risklere maruz bırakmaktadır. Bu çalışma, kamu ve özel kuruluşlar için maliyet etkin, açık kaynaklı ve düşük kodlu bir güvenlik orkestrasyonu, otomasyonu ve yanıtı çerçevesi önermektedir. Önerilen sistem, Wazuh, n8n, OpenVAS ve GLPI çözümlerini içermekte olup, "sıfır dokunuş" yaklaşımına göre çalışan Docker mikro hizmet tabanlı mimari kullanılarak uygulanmaktadır.. Sunulan çözüm, yüksek vasıflı personele duyulan ihtiyacı en aza indirerek Türkiye'nin ulusal siber güvenlik altyapısını mikro düzeyde geliştirmesine yardımcı olacaktır.

Keywords

• İş Akışı Otomasyonu
• Olay Müdahalesi Otomasyonu
• SOAR
• SIEM
• Siber Güvenlik
• Tehdit Tespiti
• Zafiyet Yönetimi

Open-Source Automation in Cyber Incident Response Processes: A Low-Code-Based Continuous Detection, Verification, and Response Architecture

Abstract

Cyber threats are becoming increasingly complex; organizations face difficulties in implementing security policies due to staffing shortages and financial constraints. Manual approaches lead to high "wait times" and false alarms, exposing organizations to risks from cyberattacks. This study proposes a cost-effective, open-source, and lowcode Security Orchestration, Automation, and Response framework for public and private organizations. The proposed system incorporates Wazuh, n8n, OpenVAS, and GLPI solutions and is implemented using a Docker microservice-based architecture operating according to a "zero-touch" approach. The presented solution will help Türkiye develop its national cybersecurity infrastructure at the micro level by minimizing the need for highly skilled personnel. 

Keywords

• SOAR
• Cybersecurity
• Incident Response Automation
• SOAR
• SIEM
• Threat Detection
• Vulnerability Management
• Workflow Automation

References

1. Aksu, M. U., Altuncu, E., & Bicakci, K. (2019, February). A first look at the usability of openvas vulnerability scanner. In Workshop on usable security (USEC) (pp. 1-7). https://doi.org/10.14722/usec.2019.23026 Al Mansoori, F. (2023). Layered Deep Neural Systems for Dynamic Multi-Agent Interaction, Adaptive Workflow Optimization, and Autonomous Decision Execution in n8n. ThinkTide Global Research Journal, 4(4), 30-38. https://thinktidejournal.com/index.php/TGRJ/article/view/42
2. Al Siam, A., Hassan, M. M., Masum, A. K. M., & Bhuiyan, T. (2025, October). Automating Malware Detection and Response via Real-Time Threat Feed Integration with Wazuh SIEM. 2nd International Conference on Computing, Applications and Systems (COMPAS) (pp. 1-6). IEEE. https://doi.org/10.1109/COMPAS67506.2025.11381876 Alabdulhadi, S., & Al-Matouq, A. (2024). Efficient and standardized alarm rationalization for cybersecurity monitoring. IEEE Access, 12, 166936-166944. https://doi.org/10.1109/ACCESS.2024.3492264
3. Ayittey, G. (2025). A security operations and analytics framework: Continuous detection and response [Doctoral dissertation, University of East London]. https://doi.org/10.15123/uel.8z91z
4. Bakraouy, Z., Abbass, W., Baïna, A., & Bellafkih, M. The IT Infrastructure's Industrialization and Mastering. J. Commun., 14(10), 884-891. https://doi.org/10.12720/jcm.14.10.884-891
5. Bcicen, B., (2022, March 22). ctop: Top-like interface for container metrics. GitHub. Accessed: 11 April 2026. https://github.com/bcicen/ctop
6. Boyle, E., & Adebayo, Y. (2020). Designing intelligent security orchestration, automation, and response (SOAR) systems with AI. Revista Cintex, 25(2), 14-27.
7. Casaclang, H., Ionescu, B., Kim, Y., & Jo, J. Y. (2026, March). Self-Hosted Workflow Automation for AI-Based Cybersecurity Operation. Journal of The Colloquium for Information Systems Security Education 13(1), 21-21. https://doi.org/10.53735/cisse.v13i1.241
8. Chavan, N., Patel, H., & Shah, K. (2025, April). Comprehensive Approach to Android Penetration Testing: Techniques, Tools and Best Practices for Securing Mobile Applications. 12th International Conference on Computing for Sustainable Global Development (INDIACom) (pp. 01-07). IEEE. http://doi.org/10.23919/INDIACom66777.2025.11115701

9. Çakır, H., & Taşer, M. (2023). Türkiye’de yapılan siber güvenlik faaliyetlerinin ve eğitim çalışmalarının değerlendirilmesi. Gazi University Journal of Science Part C: Design and Technology. https://doi.org/10.29109/gujsc.1165131
10. de Luna Melo, W. (2026). Implantação de GLPI para gestão de serviços de TI em instituição de ensino superior. Revista Processus Multidisciplinar, 7(13), e131582-e131582. https://n2t.net/ark:/44123/multi.v7i13.1582
11. Gisi, P. J. (2024). The Dark Factory and the future of manufacturing: A Guide to Operational Efficiency and Competitiveness. Productivity Press. https://doi.org/10.4324/9781032688152
12. Greenbone AG. (2024). Greenbone Community Edition: Background and architecture. Accessed: 27 March 2026. https://greenbone.github.io/docs/latest/background.html
13. Hajamydeen, A. I., Hasni, M. D., & Abdullah, M. I. (2024). Integrating Wazuh for Efficient Real-Time Threat Monitoring and Vulnerability Assessment in a SOC Environment. Utilizing Renewable Energy, Technology, and Education for Industry 5.0 (pp. 292-320). IGI Global Scientific Publishing. https://doi.org/10.4018/979-8-3693-2814-9.ch013
14. Hidayat, M. R. T., Widiyasono, N., & Gunawan, R. (2025). Optimasi deteksi malware pada SIEM Wazuh melalui integrasi cyber threat intelligence dengan MISP dan DFIR-IRIS. Jurnal Informatika Dan Teknik Elektro Terapan, 13(1). https://doi.org/10.23960/jitet.v13i1.5686
15. International Society of Automation. (2016). ANSI/ISA-18.2-2016: Management of alarm systems for the process industries. ISA. Accessed: 27 March 2026. https://www.isa.org/products/ansi-isa-18-2-2016-management-of-alarm-systems-for
16. Islam, M. R., & Rafique, R. (2024). Wazuh SIEM for Cyber Security and Threat Mitigation in Apparel Industries. International Journal of Engineering Materials and Manufacture, 9(4), 136-144. https://doi.org/10.26776/ijemm.09.04.2024.02
17. Ismail, Kurnia, R., Brata, Z. A., Nelistiani, G. A., Heo, S., Kim, H., & Kim, H. (2025). Toward robust security orchestration and automated response in security operations centers with a hyper-automation approach using agentic artificial intelligence. Information, 16(5), 365. https://doi.org/10.3390/info16050365
18. Judith, D. (2026). Future Trends and Innovations in Hyper Automation. Implementing Hyper Automation: Strategies, Best Practices and Case Studies (pp. 293-306). Bentham Science Publishers. https://doi.org/10.2174/97988988130001260101
19. Kara, Ş., Zengin, A., & Hızal, S. (2023). Ağ Sistemlerinin Güvenliği İçin Siber Saldırıların Ayrık Olaylı Sistem Tanımlama Tabanlı Modellenmesi ve Simülasyonu. Mühendislik Bilimleri ve Araştırmaları Dergisi, 5(2), 186-202. https://doi.org/10.46387/bjesr.1268038
20. Kearney, P., Abdelsamea, M., Schmoor, X., Shah, F., & Vickers, I. (2023). Combating alert fatigue in the security operations centre. Available at SSRN 4633965. http://dx.doi.org/10.2139/ssrn.4633965
21. Khan, S. A., Adnan, M., Ali, A., Raza, A., Ali, A., Naqvi, S. Z. H., & Hussain, T. (2024, May). An android applications vulnerability analysis using MobSF. International Conference on Engineering & Computing Technologies (ICECT) (pp. 1-7). IEEE. https://doi.org/10.1109/ICECT61618.2024.10581312
22. Le, T. D., Le Dinh, T., & Uwizeyemungu, S. (2025). A cybersecurity framework for enhancing Small and medium-sized enterprises (SMEs) security posture using user behaviour analytics. Enterprise Information Systems, 19(10), 2529282. https://doi.org/10.1080/17517575.2025.2529282
23. Mishra, A. K. (2026, April 4). I replaced Portainer, Grafana, and Prometheus with this stack. XDA Developers. Accessed: 11 April 2026. https://www.xda-developers.com/i-replaced-portainer-grafana-and-prometheus-with-this-stack
24. National Institute of Standards and Technology. (2025). National Vulnerability Database (NVD) developers: Vulnerabilities. Accessed: 27 March 2026. https://nvd.nist.gov/developers/vulnerabilities
25. Núñez Fernández, H. (2023). Despliegue de una plataforma de respuesta a incidentes de seguridad (SIRP) con software libre. http://hdl.handle.net/2183/33365
26. Palavesam, K. V., Arcot, S. V., Krishnamoorthy, M. V., & V, E. G. (2025). Building Automated Security Pipeline for Containerized Microservices. Journal of Mathematics Mechanics and Computer Science. https://doi.org/10.9734/jamcs/2025/v40i21969
27. Parmaksız, H., & Gündoğdu, G. (2026). Bibliometric Analysis of Psychosocial Factors in Telehealth Subdisciplines. Bilecik Şeyh Edebali Üniversitesi Sosyal Bilimler Dergisi, 11(1), 42-58. https://izlik.org/JA96KK95BS
28. Parmaksız, H. (2026). Vulnerability-Based Enrichment of Türkiye-Specific Cyber Threat Intelligence: Proactive Threat Hunting and Critical Vulnerability Analysis with TR-CERT and Exploit-DB Integration. Güvenlik Stratejileri Dergisi, 22(53), 155-184. https://doi.org/10.17752/guvenlikstrtj.1792238
29. Nathaniel, D. A., & Syahputra, M. E. (2025, December). A Comparative Analysis of Security Baselines Across Kubernetes Distributions. International Conference on Artificial Intelligence, Blockchain, Cloud Computing, and Data Analytics (ICoABCD) (pp. 1-7). IEEE. https://doi.org/10.1109/ICoABCD67551.2025.11470958
30. Pawar, M. (2025). A practical evaluation of self-hosted N8N for secure and scalable workflow automation. International Journal of Scientific Research in Engineering and Management, 9(6), 1-9.
31. Peesara, N. R. (2022). The Strategic Fusion of SIEM and SOAR in Modern SOCs. Available at SSRN 5664250. http://dx.doi.org/10.2139/ssrn.5664250
32. Rahalkar, S. (2019). Quick Start Guide to Penetration Testing. Berkeley, CA, USA: Apress. https://doi.org/10.1007/978-1-4842-4270-4
33. Rey, W. P., & Go, M. H. D. (2025, September). Scalable IT Management in Resource-Constrained Environments: A Case Study of GLPI Implementation in a Philippine Power Plant. 14th International Conference on Information Communication and Applications (pp. 69-75). https://doi.org/10.1145/3743158.3783859
34. Saidur, M. J. I., & Khan, M. K. (2023). Automating Nist 800-53 Control Implementetion: A Cross-Sector Review of Enterprise Security Toolkits. ASRC Procedia: Global Perspectives in Science and Scholarship, 3(1), 160-195. https://doi.org/10.63125/prkw8r07
35. Sezgin, A., & Boyacı, A. (2023). Açık kaynaklardan test otomasyon araçlarıyla siber tehdit istihbaratı çıkarılması. Fırat Üniversitesi Mühendislik Bilimleri Dergisi, 35(1), 283-290. https://doi.org/10.35234/fumbd.1217219
36. Shalamanov, V. (2019). Organising for IT effectiveness, efficiency and cyber resilience in the academic sector: National and regional dimensions. Information & Security, 42, 49-66.
37. Sharma, M., Desai, D., Arun, A. R., & Rajagopalan, N. (2024, March). Openvas vs the rest: unveiling the competitive edge in vulnerability scanners. 3rd International conference for innovation in technology (INOCON) (pp. 1-6). IEEE. https://doi.org/10.1109/INOCON60754.2024.10511864
38. Turhan, Ö. (2026, February 7). Siber olay müdahale süreçlerinde otomasyon yaklaşımı: Açık kaynaklı, low-code tabanlı sürekli tespit ve müdahale entegrasyonu. Medium. Accessed: 11 March 2026. https://medium.com/@OmerTurhann/siber-olay-m%C3%BCdahale-s%C3%BCre%C3%A7lerinde-otomasyon-yakla%C5%9F%C4%B1m%C4%B1-a%C3%A7%C4%B1k-kaynakl%C4%B1-low-code-tabanl%C4%B1-s%C3%BCrekli-9ea88cef570e
39. Viswanadhapalli, V. (2025). The future of intelligent automation: how low-code/no-code platforms are transforming AI decisioning. International Journal Of Engineering And Computer Science, 14(1), 26803-26825. https://doi.org/10.18535/ijecs/v13i11.4946
40. Wongsaard, P., Thaenkaew, P., & Suksomboon, K. (2025, September). Enabling Cost-Effective Vulnerability Scanning with OpenVAS: A Nested Virtualization Approach for Understaffed Security Teams. 6th Asia Service Sciences and Software Engineering Conference (pp. 47-56). https://doi.org/10.1145/3775030.3775037
41. Younus, Z. S., & Alanezi, M. (2025). Proactive SIEM-Based Framework for Cyberattack Monitoring and Classification. Baghdad Science Journal, 22(9), 3114-3132. https://doi.org/10.21123/2411-7986.5067