Security Orchestration, Automation, and Response (SOAR)

SOAR is a technology solution that streamlines threat detection and response by automating repetitive tasks and workflows.

Many incidents that occur are known causes, Both rely heavily on the detailed process data generated by the many different and the solutions for them are well-defined. Automating responses reduces the burden tools in use in their own domains, and on the incident response teams and speeds up recovery.

Security orchestration, automation, and response (SOAR) is in some respects comparable to continuous integration and continuous delivery/deployment (CI/CD).

both provide a greater degree of process automation and integration for those domains. CI/CD does this for the build-up (integration) of software units, their testing, and their delivery and hand off to end users.

SOAR performs a similar service for security professionals by bringing all the data from monitoring and control functions together and integrating it into workflows that can automate processes that would otherwise require actions by human operators to be coordinated and harmonized.

Broadly speaking, this involves three main processes:

• Security orchestration involves bringing together the various "islands of security automation" already in use in the organization. These might be nextgeneration firewalls, security information and event management (SIEM) systems, or other technology stacks. In many organizations, these may have been provided by different vendors, which may make manual orchestration and coordination difficult and time-consuming. Workflows can be created to specify sequences of tasks necessary for each orchestration activity.
• Security automation provides the process control capabilities to turn workflows into conditionally triggered execution of playbooks or runbooks. Playbooks generally are linear sequences of tasks, while runbooks contain conditional logic to control the execution of branches and sequels of activities. Some SOAR systems bring different degrees of machine learning (ML) to bear on developing, executing, and monitoring the performance of runbooks and playbooks

as well.

• Security response provides this full suite of rchestration and automation capabilitie o strengthen the organization's incider response capabilities.