What is security orchestration, automation and response (SOAR)?
Security orchestration, automation and response (SOAR) is technology that connects security tools and automates the steps of investigating and responding to incidents, using playbooks that run the same way every time.
How it works
A SOAR playbook might enrich a phishing report, check the sender and links, pull the message from every inbox and open a ticket, without an analyst doing each step.
SOAR reduces response time and analyst workload, and creates an audit trail of what was done.
Why it matters
Alert volume outgrows analyst headcount. Automation handles the repeatable work so people can focus on the cases that need judgment.
