Security operations
What is SOAR, and what does it actually automate?
SOAR (security orchestration, automation and response) is the platform category that connects your security tools together and executes response steps as repeatable playbooks — enriching an alert, isolating a host, disabling an account, opening the ticket — instead of leaving every step to an analyst working console by console. It does not detect anything by itself: SOAR acts on what a SIEM or detection tool finds, which is why the two are usually discussed, and increasingly bought, together.
The three words, unpacked
Orchestration is the plumbing: connecting the SIEM, the endpoint tool, the firewall, the identity provider and the ticketing system so they can pass context and instructions to each other. Automation is the execution: steps that run without a human doing the clicking — look up the address, pull the asset owner, gather the process tree. Response is the point of it all: containment actions against the live estate, taken quickly enough to matter. A platform that only orchestrates is middleware; one that only automates enrichment is a helper; SOAR is the category that claims all three.
What a playbook actually is
A playbook is a decision tree with hands. It starts from a trigger — usually a class of alert — and walks through steps: enrich with context, decide against conditions, act, record. The acting part is what separates SOAR from a scripting habit: isolating a host, disabling an account, revoking a session or token, blocking an address or domain, quarantining a file, restarting a service, and opening or updating the ticket with the timeline attached. A good playbook also knows when to stop and hand the decision to a person.
Where SOAR sits in a SOC
A SOC (security operations centre) lives or dies on the conversion of alerts into decisions, and the arithmetic is brutal: detection tooling can raise hundreds of candidates a day, and every one consumes analyst minutes for triage even when the verdict is benign. SOAR attacks that arithmetic from both ends — enrichment playbooks compress the minutes each alert costs, and containment playbooks collapse the gap between verdict and action. The analysts left in the loop spend their time on judgement instead of copy-paste.
Orchestration needs governance, not just connectors
The hard question in any SOAR deployment is not which tools it integrates with but which actions it is allowed to take unattended. The workable pattern is a per-action policy: run unattended, require approval, or stay advisory — set per action type and per environment. Most teams start with containment advisory everywhere, then promote the low-risk, high-frequency actions to unattended once they have watched them behave. Any evaluation should ask to see that authority matrix and the run history, not the connector list.
Why SIEM and SOAR are usually separate products
History, mostly. SIEM (security information and event management) matured first; SOAR grew up as a separate startup category and was then acquired sideways into the big security portfolios. The result is that most estates buy correlation in one product and response in another, then fund an integration project to make them talk — and keep funding it through every upgrade on either side. That separation is a procurement artefact, not an architectural requirement, and platforms built with the two together simply skip the integration tax.
What SOAR does not do
SOAR has no detections of its own. It cannot rescue a noisy SIEM — automating triage on bad alerts just produces faster wrong answers — and it cannot invent context the connected tools do not hold. It is also not a substitute for people: playbooks encode decisions that experienced analysts made first, and somebody still owns the judgement calls, the tuning and the governance. Treat SOAR as a force multiplier for an operation that already works, not a replacement for building one.
Does the telemetry underneath matter?
More than the brochures suggest. Response quality is bounded by what the correlation layer can see: if network health, flow records and device state never reach it, a playbook cannot tell a link failure from an exfiltration attempt, and a containment action can fire against a symptom. Platforms that correlate operational telemetry alongside security logs give playbooks a fuller picture to act on — which is the argument for treating monitoring and security as one stream rather than two stacks.
Have Questions? We've Got Answers.
SOAR stands for security orchestration, automation and response. It is the platform category that connects security tools together, automates the repetitive steps of alert handling, and executes response actions such as isolating a host or disabling an account as governed playbooks.
A SIEM collects and correlates events to find problems; SOAR acts on what is found — enrichment, decision steps and containment actions. One detects, the other responds. They are complementary layers, historically sold as separate products and integrated by the buyer.
No. Automation is one of its three parts. Orchestration — connecting tools so they share context — comes first, and response — governed actions against the live estate — is the part that changes outcomes. Scripted enrichment without orchestration or response authority is scripting, not SOAR.
Small teams feel alert fatigue hardest, so they benefit most from automated enrichment and triage — but a standalone SOAR product plus the integration work is often more project than a small team can carry. The practical routes are a platform with response built in, or a managed SOC service that brings its own playbooks.
Only if you configure it to. The sound model gives every action a policy — unattended, approval-required, or advisory — set per action type and per environment. Start conservative, watch the run history, and promote actions deliberately.
No. It removes the mechanical minutes from each alert — lookups, pivots, ticket-keeping — so analyst time concentrates on judgement: is this real, how far does it go, what should change afterwards. Playbooks are written and governed by people, and escalation still ends at a person.
Keep reading
See governed response on a live estate
A proof of concept shows enrichment and containment playbooks running against your own telemetry — with the authority matrix and run history in front of you, not on a slide.