Security orchestration, automation and response (SOAR) is a security strategy that automates parts of the incident response process. NIST describes it as having evolved in recent years for this purpose. NIST SP 800-61 Revision 3 lists it, with SIEM, among tools for monitoring log events.
- Also Called2other namesSOAR
- Related Terms3linked entriesIncident response plan
What Is SOAR?
SOAR stands for security orchestration, automation and response. NIST describes it as a security strategy that has evolved in recent years to automate the incident response process. Incident response is the work of handling security alerts and events once they appear.
Why Does Incident Response Need Automation?
NIST SP 800-215 says that network security alerts and threat intelligence feeds are part of the incident response process in an enterprise. It adds that members of a security operations center, the team that watches for and handles security events, carry out the handling of these alerts and feeds. SOAR is the strategy NIST names for automating that process.
What Can SOAR Be Used For?
NIST SP 800-215 lists some state of practice uses of SOAR. They include threat detection and response, vulnerability prioritization, compliance checks and security audits. The same document says SOAR has potential applications in many emerging areas, such as managing Internet of Things devices.
How Does SOAR Relate to a SIEM?
A SIEM is a security information and event management tool that gathers log data from many sources. NIST SP 800-61 Revision 3 gives SIEM and SOAR as examples of tools that monitor log events for known malicious and suspicious activity. They also generate reports on what they find.
The same guide names both as ways to gather related data captured by multiple sources. It also names both as automated means to estimate the impact and scope of adverse events. In plain terms, a SIEM can be described as the place where events are collected and correlated. SOAR is aimed at automating the response steps.
Which Response Steps Can Be Automated?
NIST SP 800-61 Revision 3 names several places where automation can help. It also keeps people in the loop.
- Estimate impact and scopeUse automated means such as SIEM or SOAR, or manual ones. Then review and refine the estimate.
- Create ticketsConsider creating and assigning tickets automatically when certain types of alert occur.
- Add contextFeed current threat intelligence and asset inventories into the analysis of events.
- ContainConsider tools that act on their own, such as quarantining malware or isolating a compromised endpoint.
- EradicateConsider configuring tools to perform some eradication actions automatically.
- Keep a person in the loopLet handlers pick and run containment or eradication by hand, instead of or as well as automation.
Where Does SOAR Sit in Incident Response Planning?
An incident response plan describes how an organization prepares for, detects and responds to incidents. NIST SP 800-61 Revision 3 lists SOAR among the tools that can support detecting and analyzing adverse events.
Is SOAR the Same as a SIEM?
No. NIST names them as two separate tools, listed side by side in the same recommendations. A SIEM centers on collecting and correlating security events. SOAR is described by NIST as a strategy to automate incident response.
Is SOAR the Same as a Security Operations Center?
No. A security operations center, or SOC, is a team. NIST SP 800-215 says members of a SOC handle alerts and feeds. SOAR is a way of automating part of that work.
Does SOAR Remove the Need for People?
NIST describes SOAR as a strategy to automate the incident response process. It also describes automated and manual means as options when estimating the impact and scope of adverse events, so the two can sit side by side.
Related Pages in the Knowledge Hub
Also Called.
- NameSOAR
- Namesecurity orchestration, automation, and response
Questions.
-
What is SOAR?
SOAR stands for security orchestration, automation and response. NIST describes it as a security strategy that has evolved in recent years to automate the incident response process.
-
What is SOAR used for?
NIST SP 800-215 lists state of practice uses that include threat detection and response, vulnerability prioritization, compliance checks and security audits. It says SOAR has potential applications in many emerging areas, such as managing Internet of Things devices.
-
Is SOAR the same as a SIEM?
No. NIST names them as two separate tools. A SIEM centers on collecting and correlating security events. SOAR is described by NIST as a strategy to automate incident response.
-
Is SOAR the same as a security operations center?
No. A security operations center, or SOC, is a team. NIST SP 800-215 says SOC members handle alerts and threat feeds. SOAR is a way of automating part of that work.
-
Where does NIST point to automation in incident response?
NIST SP 800-61 Revision 3 names automated means for estimating impact and scope, automatic ticket creation, and tools that perform some containment and eradication actions. It also lets handlers act by hand instead of or as well as automation.
Sources
In Our Research
- 1 Living off the Land: The Cyberattack You’ll Never See Coming June 2025
- 2 Agentic Threat Intelligence 101 101 guide
- 3 Security operations center (SOC) Glossary term
- 4 Digital forensics Glossary term