SOAR (Security Orchestration, Automation, and Response)

The three capabilities

Orchestration connects disparate security tools into coordinated workflows. A modern SOC runs dozens of tools, SIEM, EDR, firewalls, email security, identity management, vulnerability scanners, threat intelligence feeds. Each tool generates its own alerts and has its own interface. Orchestration integrates these tools through APIs so that data and actions flow between them without manual intervention. When a SIEM alert triggers, orchestration can automatically query the EDR for endpoint context, check the IP against threat intelligence, and pull the user’s access history from the identity provider, all before an analyst opens the case.

Automation executes predefined actions without human involvement. This includes enrichment tasks (looking up an IP reputation, checking a file hash against VirusTotal, querying a domain’s registration history), containment actions (isolating an endpoint, blocking an IP at the firewall, disabling a user account), and administrative tasks (creating tickets, sending notifications, updating case records). Automation handles the tasks that follow the same steps every time, freeing analysts from repetitive manual work.

Response provides structured incident response workflows, playbooks that define the steps to investigate and resolve specific incident types. A phishing response playbook might extract the sender address, check it against known indicators, pull all recipients from the email gateway, scan attachments in a sandbox, and quarantine the message across all mailboxes. A ransomware response playbook might isolate affected endpoints, preserve forensic evidence, notify the incident response team, and initiate the DFIR process. Playbooks codify institutional knowledge so that incidents are handled consistently regardless of which analyst is on shift.

SOAR vs SIEM

SIEM and SOAR are complementary, not competing, technologies. They serve different functions in the security operations stack.

	SIEM	SOAR
Primary function	Log collection, correlation, and alerting	Workflow automation and incident response
Input	Security logs, events, and telemetry from across the environment	Alerts from SIEM and other detection tools
Output	Correlated alerts and security events	Automated actions, enriched cases, and response playbooks
Analyst role	Investigate alerts generated by correlation rules	Respond to incidents using automated and semi-automated playbooks
Value	Visibility – knowing what happened	Efficiency – responding faster with fewer analysts

SIEM tells you that something happened. SOAR helps you do something about it. Most organisations deploy SIEM first to establish detection capability, then add SOAR to automate the response workflow as alert volumes grow beyond what analysts can handle manually.

Use cases

SOAR delivers the most value in high-volume, repeatable scenarios where consistent, rapid response is critical:

Phishing response – a phishing email is reported or detected. SOAR automatically extracts indicators (sender, URLs, attachments), checks them against threat intelligence, identifies all recipients, sandboxes attachments, quarantines the email across the organisation, and creates a case for analyst review. What previously took 30-45 minutes of manual work per incident takes seconds.

Incident triage – SIEM generates thousands of alerts daily. SOAR enriches each alert with context (asset criticality, user risk score, threat intelligence matches, historical behaviour), applies triage logic, and either auto-closes false positives or escalates genuine threats to analysts with full context already assembled.

Threat intelligence enrichment – indicators of compromise (IoCs) from external feeds, internal detection, or MITRE ATT&CK mappings are automatically cross-referenced against internal telemetry. SOAR checks whether the organisation has communicated with a flagged IP, whether a malicious file hash exists on any endpoint, or whether a compromised credential is in use.

Compliance reporting – SOAR maintains an audit trail of every action taken during incident response. Who did what, when, and why. This supports compliance requirements under NIS2, DORA, and ISO 27001 by providing documented evidence of incident handling processes.

Cyberfort and SOAR

SOAR is a core component of our MXDR service. Our Security Operations Centre uses automated playbooks to enrich, triage, and respond to threats across our clients’ environments, ensuring that high-priority incidents receive immediate action while lower-risk alerts are handled efficiently without analyst fatigue. For organisations preparing for cyber incidents, our cyber crisis simulation exercises test the response playbooks and escalation processes that SOAR automates in production. We also support organisations developing their own SOAR capability through our virtual cyber consultancy service, including playbook design, tool integration planning, and SOC maturity assessment. Discuss your security operations requirements →

Related glossary terms

• MXDR – managed detection and response service that uses SOAR for automated triage and response
• DFIR – digital forensics and incident response, the investigative discipline that SOAR playbooks initiate and support
• MITRE ATT&CK – adversary tactics framework used to structure SOAR detection rules and response playbooks
• Cyber Crisis Simulation – tabletop exercises that test the response processes SOAR automates
• Zero Trust – security architecture that SOAR supports through automated policy enforcement and anomaly response

External references

• Wikipedia: Security information and event management – overview of SIEM, the complementary technology to SOAR
• Gartner: SOAR definition – the original category definition
• CISA: Automated Indicator Sharing – US government threat intelligence sharing that feeds SOAR platforms
• MITRE ATT&CK – the adversary tactics framework used to structure SOAR detection and response playbooks

Frequently asked questions