  Security orchestration, automation, and response (SOAR) systems ingest alerts
from security information and event management (SIEM) system, and then trigger
relevant playbooks that automate and orchestrate the execution of a sequence of
security activities. SOAR systems have two major limitations: (i) security
analysts need to define, create and change playbooks manually, and (ii) the
choice between multiple playbooks that could be triggered is based on rules
defined by security analysts. To address these limitations, recent studies in
the field of artificial intelligence for cybersecurity suggested the task of
interactive playbook creation. In this paper, we propose IC-SECURE, an
interactive playbook creation solution based on a novel deep learning-based
approach that provides recommendations to security analysts during the playbook
creation process. IC-SECURE captures the context in the form of alert data and
current status of incomplete playbook, required to make reasonable
recommendation for next module that should be included in the new playbook
being created. We created three evaluation datasets, each of which involved a
combination of a set of alert rules and a set of playbooks from a SOAR
platform. We evaluated IC-SECURE under various settings, and compared our
results with two state-of-the-art recommender system methods. In our evaluation
IC-SECURE demonstrated superior performance compared to other methods by
consistently recommending the correct security module, achieving precision@1 >
0.8 and recall@3 > 0.92
