SOAR

The term SOAR was popularised by Gartner around 2017 to describe the convergence of three earlier product categories: security orchestration and automation, security incident response platforms (case management) and threat-intelligence platforms. A SOAR platform has four core components: integrations (connectors wrapping the APIs of SIEM, EDR, email, identity, firewall, ticketing and threat-intelligence tools), playbooks (workflows of actions, conditions, loops and human approval steps, usually built in a visual editor or as code), a case management layer that records artefacts, tasks, evidence and timelines, and metrics reporting. Well-known products include Splunk SOAR (formerly Phantom), Palo Alto Networks Cortex XSOAR (formerly Demisto), and Microsoft Sentinel's automation rules and Logic Apps playbooks; newer tools such as Tines market themselves as general security automation platforms.

A typical playbook for a reported phishing email parses the message, extracts observables (sender, URLs, attachments, hashes), queries reputation services and sandbox detonation, searches the mail platform for other recipients, and branches: benign verdicts are closed with a reply to the reporter, while malicious verdicts trigger purging of the message from all mailboxes, blocking of indicators and, after analyst approval, containment such as disabling the account or isolating the endpoint. OASIS's CACAO Security Playbooks specification (version 2.0, 2023) defines a vendor-neutral JSON format for describing and exchanging such playbooks, though adoption in commercial products is still limited.

The design principle that matters most is graduated automation. Enrichment and deduplication are safe to automate fully; reversible containment (quarantining a file, forcing a password reset) can often be automated for high-confidence detections; disruptive or irreversible actions (disabling an executive's account, isolating a production server, blocking a cloud provider's IP range) should require a human decision. Automating actions on top of noisy detections scales false positives into outages, so playbook quality is bounded by detection quality.

SOAR introduces its own risks. The platform stores API credentials with broad privileges across the security stack, making it a high-value target that needs strict access control, secrets management, change control on playbooks and audit logging of its own actions. Playbooks decay silently when connected APIs change, so they need testing like code. SOAR differs from a SIEM, which collects and correlates events to raise alerts, whereas SOAR acts on those alerts; the categories are converging as SIEM and XDR platforms build in automation, and AI assistants are increasingly used for enrichment and summarisation within these workflows, which calls for the same approval gates as any other automated action.