The Flywheel of SecOps Automation and Domain Memory

In conversations with security leaders, I often ask a question that produces a thoughtful pause: when your most experienced security analyst leaves, how much of their knowledge leaves with them?

The honest answer, in most organizations, is: a significant amount. The analyst who has worked in an environment for three years carries a model of that environment in their head, which systems are genuinely critical, which alerts consistently turn out to be noise in this specific context, which behavioral patterns warrant investigation even when no rule fires, what the normal rhythm of this environment looks like. This institutional memory is extraordinarily valuable. It is also extraordinarily fragile.

Transforming Tribal Knowledge into Permanent SOC Memory

When we built the Resolution Intelligence Cloud, one of our foundational design goals was to make institutional memory a property of the system rather than a property of the people. Not to replace the analyst's judgment, that remains essential - but to ensure that the knowledge accumulated through years of operating in a specific enterprise environment is captured, structured, and available to every analyst who works in that environment, including ones who joined recently. By executing this architecture through advanced SecOps automation, we ensure that fleeting individual insights are turned into permanent, accessible SOC memory.

Inside our architecture, institutional SOC memory manifests through structured, scalable parameters:

Institutional memory in the RIC means something specific.

• Continuous Entity Baselines: The behavioral baselines that define what normal looks like for every significant entity in the environment, built from years of operational data, continuously updated, never discarded.
• Codified Investigation History: The investigation history that shows which hypothesis paths have been explored in this environment and what they found.
• Contextual Incident Alignment: The intelligence context that connects observed events to previous incidents and previous findings in this specific environment.

All of it accumulated additively, growing more precise with every hour of operation.

Activating Domain Memory: The Multi-Tenant Flywheel

But the part of the architecture I find most compelling is what I call domain memory, the intelligence we build across all 200-plus customers simultaneously. Through scalable SecOps automation, this collective model expands continuously without compromising private corporate perimeters:

An adversary technique that appears in one customer's environment and triggers a detection and investigation produces a finding that enriches the knowledge graph for the entire customer base. Not the customer's specific data, that is protected by Google's governance infrastructure and never shared. The analytical intelligence: this behavioral pattern, in this context, at this stage of the kill chain, is associated with this type of adversary activity. That intelligence propagates across the domain.

No individual enterprise, no matter how sophisticated or how large, can build domain memory at this scale. They see their own environment. We see across hundreds of environments simultaneously. The signal that might appear as a marginal anomaly in a single environment becomes clearly significant when the same pattern appears across multiple environments in the same period.

This is the flywheel. Every customer environment that contributes operational data makes the system smarter for every other customer. The system gets better every hour, every day, across every dimension of both institutional and domain knowledge.

We are not building another database. We are building SOC memory that learns, and that belongs to every customer who helps it grow.

*Part of my ongoing series on data science and the future of security operations.*

 
About the Author