Security Orchestration, Automation, and Response (SOAR)
Security orchestration, automation, and response (SOAR) is software that automates part of the response to detected security events and incidents by running predefined playbooks, either on its own log analysis or on top of an existing SIEM.
Updated
Overview
A SOAR platform builds on the collection, centralization, and analysis of log data. Some SOAR platforms perform these functions themselves, while others integrate with an existing SIEM and use its log collection and analysis.
The automation runs through playbooks: predefined actions taken when specific events occur, such as isolating the source of an event in the network. These automated actions complement human incident responders rather than replace them.
Implementing a SOAR is an intensive, ongoing process that usually takes several people working on it full time.
Similar Terms
1 termFrequently Asked Questions
What does SOAR stand for?→
SOAR stands for security orchestration, automation, and response.
Does SOAR replace incident responders?→
No. A SOAR's automated playbook actions, such as isolating the source of an event in the network, do not replace human incident responders but can complement them.
Does a SOAR need a SIEM?→
Not always. Some SOAR platforms collect and analyze log data themselves, while others integrate with an existing SIEM and use its log collection, centralization, and analysis.
Related
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.