SOAR 🦅

SOAR stands for Security Orchestration, Automation, and Response. It is a solution that helps organisations to streamline and automate their security operations, including incident management, threat intelligence, and vulnerability response.

SOC does many things includes detecting, monitoing, recovering, remediating, communicating…

Problem

With so many tasks, SOCs usually face challenge such as alert fatigue…

Solution

With SOAR, SOC analysts do not need to switch between SIEM, EDR, Firewall, and other security tools for their investigations. It AUTOMATE the tasks for the analyst. It also does orchestration (the act of connecting and integrating security tools and systems into seamless workflows) and response.

• SIEM finds the problem. SOAR helps fix it.
• SIEM = “Hey! Something suspicious just happened.”
• SOAR = “Got it. I’ll take care of it.”