SOAR
noun · also Security orchestration, automation and response
Tools that connect security products and run automated playbooks, so routine response steps happen in seconds instead of being done by hand.
Security orchestration, automation and response (SOAR) covers three ideas. Orchestration connects the tools a SOC uses, such as the SIEM, EDR, email gateway, ticketing system and chat. Automation runs steps without a human, such as enriching an alert or disabling an account. Response ties those steps together into playbooks that follow a defined process.
SOAR can be a standalone platform or part of a broader product. In Microsoft Sentinel, for example, automation rules and playbooks built on Azure Logic Apps provide SOAR capabilities.
Example
When a phishing report arrives, a playbook extracts the URLs and attachments, checks them against threat intelligence, searches for other recipients of the same message, removes the email from every mailbox if it is malicious, and posts a summary in the SOC's channel for an analyst to confirm.
Why it matters for a SOC analyst
Automation takes over the repetitive parts of triage so analysts can spend their time on judgment calls. It also needs care: a playbook that disables accounts on a noisy rule can lock out half the company. Analysts who understand both the process and the automation are the ones who decide which steps are safe to automate and which still need a human.
Related terms
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
- XDR
A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.
- Security operations center
The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.