Security Automation (SOAR) SOAR

An orchestration platform that runs repetitive SOC tasks (alert enrichment, locking a user, blocking an IP, opening a ticket) through automated scenarios (playbooks).

When you need it

• Your SOC team is drowning in hundreds of alerts a day
• The same response steps are repeated by hand for every incident
• You need to cut response time down to minutes

When you do not need it

• Without a SOC team and a mature SIEM, there is no process to automate.
• If you use an MDR service, automation is the provider's responsibility.
• Many SIEM/XDR products include basic automation built in.

Behind the SIEM; connects via API to EDR, firewall, identity provider and ticketing system. Start with the 3–5 most frequent scenarios.