HansITAcademy

Security Orchestration, Automation, and Response (SOAR) includes multiple sets of tools that assists in cyber security operations. SOAR can automatically scan for vulnerabilities and eliminate threats up to a certain extent. SOAR’s main two components that makes the tool unique are automation and orchestration. Automation allows administrators to create course of action that can be taken depending on the incidents. This will be an automated task that is assigned to certain alert or incident. This allows security experts to streamline threat hunting and remediation processes and lower the amount of low level security issues, so that they can focus on bigger problems. Then we have orchestration, which is the ability to connect multiple tools for centralization. It allows tools that are connected to work together in tandem, forming a cohesive environment from start to finish. SOAR allows tools like threat intelligence and SIEM to work together. SOAR is a process based tool made to improve workflow processes and is also a great integration platform that provides holistic dashboard.