SOAR
Definition
Security Orchestration, Automation and Response. A platform that can execute playbook steps automatically, such as blocking an IP address or disabling a user account, based on defined triggers. SOAR turns human-readable playbooks into partially automated workflows.
- Full form
- Security Orchestration, Automation and Response
- Core function
- Automated playbook execution
- Example action
- Block an IP or disable a user account
- Trigger source
- Alerts from SIEM and other tools
Common questions
How does SOAR differ from a SIEM?+
A SIEM collects, correlates, and surfaces alerts from log and event data. SOAR sits downstream of that: it takes the alert the SIEM raises and executes a defined playbook against it, such as enriching the alert with threat intelligence or automatically containing an affected host, rather than only detecting the event.
Does SOAR remove the need for a human analyst in incident response?+
No. SOAR automates the repeatable, well-defined steps of a playbook, such as lookups and low-risk containment actions, but decisions with legal, business, or high-impact consequences are typically routed to an analyst for approval before the platform executes them.
What happens if a SOAR playbook is poorly designed?+
Because SOAR executes actions automatically, a flawed playbook can take the wrong containment step at scale, for example disabling accounts on a false positive. This is why playbooks are usually tested and reviewed before automation is enabled beyond alert enrichment.
Related terms
- Decision Gate
- A checkpoint within a playbook at which the responder must evaluate a condition, such as whether data exfiltration has been confirmed, and...
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- Runbook
- A technical execution document, sometimes used interchangeably with playbook but more precisely refers to the low-level commands and scripts used during a...
- Tabletop Exercise
- A structured, discussion-based simulation in which team members walk through a hypothetical incident using the playbook as a guide, without touching live...