SOAR (Security Orchestration, Automation and Response) is a class of platforms that coordinate detection tools, automate repetitive incident-handling workflows, and orchestrate response actions across a security stack through codified playbooks. It ingests alerts from disparate sources, enriches them with context, and executes graded responses to reduce analyst workload and mean time to respond. The acronym also denotes Soar, a cognitive architecture for modelling general intelligence, but in security contexts the orchestration sense dominates.
Content
- A SOAR system ingests alerts, enriches them with threat intelligence, and triggers graded automated actions, sharply reducing analyst toil and mean time to respond. Within Cyber Security and Cryptography operations it acts as the connective layer between SIEM, EDR, and ticketing tools, and increasingly incorporates Cognitive AI techniques to prioritise and reason over incoming signals.