AUTOMATED SECURITY ORCHESTRATION IN CLOUD INFRASTRUCTURE: A FRAMEWORK FOR REAL-TIME THREAT DETECTION AND RESPONSE

Modern enterprise computing now relies on cloud infrastructures that demonstrate both a growing and dynamic attack surface due to its multi-tenant and application programming interface (API)-driven characteristics and exposes organizations to a growing attack surface, which cannot be effectively defended by traditional, manually operated Security Operations Centers (SOCs). The paper presents an Automated Security Orchestration Framework (ASOF), a stacked architecture that combines real-time telemetry with the collection, hybrid machine-learning-based anomaly detection, threat-intelligence enhancement, and automated response based on playbooks into a single closed system adapted to both the public and hybrid cloud environment. The framework integrates a lightweight ingestion and normalization layer with a correlation engine that combines supervised classification with unsupervised anomaly scoring to operated a core of decision-logic orchestration that autonomously chooses and implements remediation playbooks, including identity revocation, network isolation and configuration rollback. ASOF was compared to a traditional manual SOC workflow through a proof-of-concept testbed on a simulated multi-cloud environment in five common cloud threat categories. The findings suggest that there are significant decreases in the mean time to detect and mean time to respond, as well as a reduced false-positive rate and decreased workload on analysts, implying that automation by orchestration can significantly reduce the window of exposure in cloud environments without a corresponding increase in operational cost.