← All glossary terms Glossary

What is Security Orchestration, Automation, and Response (SOAR)?

Tooling that automates repetitive parts of investigation and response — like enriching alerts or isolating endpoints.

Security Orchestration, Automation, and Response (SOAR) platforms let security teams automate the repetitive parts of their workflow: enriching an alert with threat intelligence, looking up which user owns an affected device, isolating an endpoint, or opening a ticket. SOAR is usually layered on top of a SIEM. For most organizations, the automation embedded in an MDR service replaces what a dedicated SOAR platform would otherwise do.

  • Automates repetitive response steps like alert enrichment, lookups, and endpoint isolation.
  • Almost always layered on top of a SIEM rather than used on its own.
  • For most organizations, MDR's built-in automation replaces a dedicated SOAR purchase.

En français

Orchestration, automatisation et réponse en matière de sécurité (SOAR)

Des outils qui automatisent les parties répétitives de l'investigation et de l'intervention — comme enrichir une alerte ou isoler un terminal.

Les plateformes d'orchestration, d'automatisation et de réponse en matière de sécurité (SOAR) permettent aux équipes d'automatiser les tâches répétitives : enrichir une alerte avec du renseignement sur les menaces, repérer le propriétaire d'un appareil touché, isoler un terminal ou ouvrir un billet. Le SOAR est habituellement greffé à un SIEM. Pour la plupart des organisations, l'automatisation intégrée à un service MDR remplace ce que ferait une plateforme SOAR dédiée.

Security Orchestration, Automation, and Response (SOAR): frequently asked questions

What is the difference between SOAR and SIEM?

A SIEM collects and analyzes data to find security events; SOAR automates the actions taken in response to them. They're complementary — SOAR usually runs on top of a SIEM to speed up investigation and containment.

Do I need a SOAR platform?

Most small and mid-size organizations don't buy SOAR separately. The automation embedded in a good MDR service typically covers the same ground without a standalone platform to manage.

Want to talk through how this fits your environment?

Book a no-obligation consultation and we'll explain how this plays out for an organization like yours.

Talk to our team