Skip to main content

SOAR

Updated Jan 30, 2024 ·

Overview​

SOAR stands for Security Orchestration, Automation, and Response. It refers to a set of practices, processes, and technologies used by cybersecurity teams to streamline and enhance their incident response capabilities.

  • Typically integrate with a variety of security tools and technologies, such as SIEM
  • Provide centralized dashboards and workflows for managing security incidents
  • Built-in capabilities for automation and orchestration

Features​

  • Security Orchestration
    • Coordinating and managing security processes and tools.
    • Defining workflows and assigning tasks across teams.
  • Automation
    • Using technology to automate repetitive tasks.
    • Improving response times and reducing human error.
    • Use playbooks to automate:
      • Firewall rules, content filters
      • Application Allow/Deny Lists
      • Revoke certificates
  • Response
    • Taking actions to investigate, contain, and mitigate security incidents.
    • Blocking malicious activities and implementing remediation measures.