# How Security Teams Use Windmill for Flexible, Code-First SOAR Automation

DevFeed: [How Security Teams Use Windmill for Flexible, Code-First SOAR Automation](<https://devfeed.tech/articles/windmill-for-soar-from-code-to-security-operations-in-minutes-30727.md>)

Original publisher: [Read original article](<https://www.windmill.dev/blog/windmill-for-soar-case-study>)

Author: Alex Petric

Published: 2025-09-10T00:00:00Z

Content type: article

Language: en

Sources: [Windmill Blog](<https://devfeed.tech/sources/windmill-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [automated incident response](<https://devfeed.tech/topics/automated-incident-response.md>), [Code](<https://devfeed.tech/topics/code.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [API](<https://devfeed.tech/topics/api.md>), [Orchestration](<https://devfeed.tech/topics/orchestration.md>), [PostgreSQL](<https://devfeed.tech/topics/postgresql.md>), [Rust](<https://devfeed.tech/topics/rust.md>)

Tags: [automated-incident-response](<https://devfeed.tech/tags/automated-incident-response.md>), [automation](<https://devfeed.tech/tags/automation.md>), [bash](<https://devfeed.tech/tags/bash.md>), [case-study](<https://devfeed.tech/tags/case-study.md>), [case-study-soar-security-operations-workflow-engine](<https://devfeed.tech/tags/case-study-soar-security-operations-workflow-engine.md>), [code](<https://devfeed.tech/tags/code.md>), [extension](<https://devfeed.tech/tags/extension.md>), [postgresql](<https://devfeed.tech/tags/postgresql.md>), [python](<https://devfeed.tech/tags/python.md>), [security-operations](<https://devfeed.tech/tags/security-operations.md>), [soar](<https://devfeed.tech/tags/soar.md>), [source](<https://devfeed.tech/tags/source.md>), [sql](<https://devfeed.tech/tags/sql.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [vs-code](<https://devfeed.tech/tags/vs-code.md>), [workflow-engine](<https://devfeed.tech/tags/workflow-engine.md>)

## AI overview

This case study describes how security teams use Windmill as a flexible, code-first alternative for SOAR workflows. It covers custom integrations, automated incident response, script and workflow development, orchestration, self-hosting, and open-source deployment.

## Source excerpt

How security teams are migrating from rigid SOAR platforms to Windmill for flexible, code-first security automation that scales with complex infrastructures.