Security Orchestration, Automation And Response (SOAR).

What is SOAR?

SOAR stands for security orchestration, automation and response. NIST describes it as a security strategy that has evolved in recent years to automate the incident response process. Incident response is the work of handling security alerts and events once they appear.

Why does incident response need automation?

NIST SP 800-215 says that network security alerts and threat intelligence feeds are part of the incident response process in an enterprise. It adds that members of a security operations center, the team that watches for and handles security events, carry out the handling of these alerts and feeds. SOAR is the strategy NIST names for automating that process.

What can SOAR be used for?

NIST SP 800-215 lists some state of practice uses of SOAR. They include threat detection and response, vulnerability prioritization, compliance checks and security audits. The same document says SOAR has potential applications in many emerging areas, such as managing Internet of Things devices.

How does SOAR relate to a SIEM?

A SIEM is a security information and event management tool that gathers log data from many sources. NIST SP 800-61 Revision 3 gives SIEM and SOAR as examples of tools to monitor log events for known malicious and suspicious activity and to generate reports on what they find. It also names both as examples of ways to gather related data captured by multiple sources, and as automated means to estimate the impact and scope of adverse events. In plain terms, a SIEM can be described as the place where events are collected and correlated, while SOAR is aimed at automating the response steps.

A simple illustration

This is a generic illustration only. A security team receives many alerts. A SOAR approach would define the repeatable steps for handling one kind of alert, so that tools can carry out those steps automatically and staff can focus on the cases that need human judgment.

Where does SOAR sit in incident response planning?

An incident response plan describes how an organization prepares for, detects and responds to incidents. NIST SP 800-61 Revision 3 lists SOAR among the tools that can support detecting and analyzing adverse events.

Is SOAR the same as a SIEM?

No. NIST names them as two separate tools, listed side by side in the same recommendations. A SIEM centers on collecting and correlating security events. SOAR is described by NIST as a strategy to automate incident response.

Is SOAR the same as a security operations center?

No. A security operations center, or SOC, is a team. NIST SP 800-215 says members of a SOC handle alerts and feeds. SOAR is a way of automating part of that work.

Does SOAR remove the need for people?

NIST describes SOAR as a strategy to automate the incident response process. It also describes automated and manual means as options when estimating the impact and scope of adverse events, so the two can sit side by side.