Definition
Security Orchestration, Automation, and Response (SOAR) platforms combine incident response, orchestration, automation, and threat intelligence management to help security teams efficiently manage and respond to threats.
People Also Ask
Common questions about SOAR answered by our security experts.
SOAR in Practice
Security orchestration, automation and response describes platforms that automate the repetitive parts of security operations — enriching an alert, gathering context, executing containment steps, updating a case — through codified workflows.
The objective is analyst time. A large share of triage work is mechanical lookup, and automating it lets scarce human attention go to the judgement calls.
What automates well
Enrichment, unambiguously: reputation lookups, asset ownership, user and department context, whether the same indicator appeared elsewhere. An analyst opening an alert with that already attached starts from a decision rather than a research task.
Also well suited: consistent case creation, notification routing, evidence collection at the moment of detection, and closing categories of alert that are reliably benign for reasons that can be expressed as a rule.
What automates badly
Anything with significant consequence and imperfect confidence. Automatically disabling accounts or isolating hosts on a detection that is sometimes wrong converts a false positive into an outage, and the first time it happens to something important the automation gets switched off entirely.
The workable pattern is automation that prepares and a human who approves: gather everything, stage the containment action, present it for one click.
Process first, or the automation encodes the mess
Automating an undocumented process produces a workflow nobody can reason about, and a bad process executed faster. The prerequisite is a written procedure that people actually follow, which is also the artefact most organisations discover they do not have.
That discovery is itself valuable. Several programmes deliver most of their benefit in the documentation phase, before any workflow is built.
Maintenance is the recurring cost
Workflows depend on integrations, and integrations break when vendors change interfaces, credentials rotate or tools are replaced. A broken workflow frequently fails quietly, which means a step everyone believes is happening has silently stopped.
Monitoring the automation — alerting when a workflow fails rather than discovering it during an incident — is part of running it, and is regularly omitted.
Where the value actually lands
Time saved per alert, multiplied by alert volume. That means the return depends on volume — a team handling a few dozen alerts a day will not recover the build and maintenance cost, while one handling hundreds will.
Who maintains it, and with what skills
Workflows are code, whether they are written in a scripting language or assembled in a visual editor. They need version control, testing, review and somebody who understands them well enough to fix one under time pressure.
The recurring failure is a platform built by one enthusiastic engineer who then changes role, leaving workflows nobody else can modify. Keeping the automation deliberately simple, documenting each workflow’s purpose and owner, and ensuring at least two people can maintain it are what stop the investment becoming a liability.
Where to start
Take your highest-volume alert type and write down every step an analyst performs. The enrichment steps in that list are the automation candidates with the clearest return.
See security orchestration. GuardsArm delivers managed security.
Related Terms
SIEM
Security Information and Event Management (SIEM) is a technology solution that collects, aggregates, and analyzes security event data from across an organization's IT infrastructure. SIEM provides real-time monitoring, threat detection, correlation of security events, and compliance reporting.
Incident Response
Incident response is the organized approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage, reduces recovery time and costs, and prevents future incidents.
Security Operations Center (SOC)
A Security Operations Center (SOC) is a centralized facility staffed with security analysts who continuously monitor, detect, analyze, and respond to cybersecurity incidents using a combination of technology solutions and processes.
Related Reading
Your SIEM Is an Expensive Log Dump (And You Know It)
A SIEM without a SOC behind it is just collecting evidence for the forensic team that shows up after the breach. Most healthcare organizations are…
SIEM Tuning for Hospitals: Reducing Noise Without Missing Threats
A SIEM producing 4,000 alerts a day is producing none, because nobody reads 4,000 alerts. Suppressing safely, measuring whether tuning worked, and…
Security Information and Event Management (SIEM): Implementation and Optimization
Learn about security information and event management (siem): implementation and optimization and how it impacts your organization's cybersecurity…
Speak With an Expert
Book a free consultation to discuss soar for your organization.
Related Services
Need Help With SOAR?
Our certified security professionals can help you implement the right soar strategy for your organization. Get a free assessment today.
Book a Free Consultation