Cybersecurity glossary
What is Security Orchestration, Automation and Response (SOAR)?
Learn what SOAR is, how playbooks automate enrichment and response, how it differs from SIEM and XDR, and which actions are safe to automate versus those that need a human.
Definition
Security Orchestration, Automation and Response (SOAR) is a capability that connects security tools through playbooks so routine enrichment, case handling, and approved response actions run consistently—with humans remaining in control of high-impact decisions.
Why copy-paste response does not scale
Analysts should not spend the first twenty minutes of every alert looking up the same user in three consoles. SOAR encodes that routine: enrich, document, and—when the evidence and the risk allow—act.
Automation without judgment multiplies mistakes. The craft is deciding which steps are safe to run in the dark.
What SOAR actually automates
Enrichment
Threat-intel lookups, user HR context, asset ownership, and related alerts attached before a human reads the case.
Case choreography
Deduplicate, assign, notify the right channel, and keep a single timeline of who did what.
Low-regret actions
Block a rare hash, sinkhole a known-bad domain, or force a password reset after confirmed stuffing.
Guarded containment
Host isolation or account disable behind thresholds, dual control, or analyst confirmation.
Anatomy of a playbook that survives production
Trigger with a hypothesis
Name the alert type and the confidence you require. Do not start from “any SIEM severity high.”
Gather reversible context
Queries and API reads first. Writes come only after checks pass.
Branch on evidence
Known-benign, needs-human, and auto-act paths are explicit, with metrics on each.
Act with an audit trail
Every API call is logged: who (playbook), why (alert ID), and how to undo.
Hand off cleanly
If a human is needed, they inherit a case, not a pile of half-finished API errors.
Safe to automate versus keep human
| Action | Automate when | Keep a human when |
|---|---|---|
| Intel and CMDB lookup | Always, with cache and timeouts | The enrichment itself is the investigation |
| Block hash / URL | High-confidence, rare indicators with expiry | Shared infrastructure or business-critical domains |
| Disable user / revoke tokens | Confirmed credential stuffing with lockout policy | Executives, break-glass, or ambiguous MFA events |
| Isolate host | Ransomware-class EDR confidence plus allowlists | Production servers and uncertain process trees |
- Version playbooks like code; review destructive branches like production deploys.
- Build undo runbooks for every automated write (unblock, reconnect, re-enable).
- Fail closed on API errors: do not disable an account because HR lookup timed out.
- Measure playbook success as true-positive actions, not number of workflows launched.
- Keep secrets for tool APIs in a vault; SOAR is a high-privilege integration hub.
- Start with phishing and enrichment before touching network or identity kill switches.
- Disable a playbook as fast as a detection if it causes user harm.
- Train analysts to read playbook output skeptically—automation can still be wrong.
The practical takeaway
SOAR is consistent, auditable response at machine speed for steps you already trust. Orchestrate enrichment first, automate low-regret blocks second, and put humans on containment that can take the business down.
Related security terms
Security Information and Event Management (SIEM)
Common alert source that SOAR playbooks consume.
Incident Response
Human process SOAR should encode, not replace.
Security Operations Center (SOC)
Team whose repetitive work SOAR is meant to shrink.
Alert Fatigue
Automating enrichment helps; automating junk alerts makes it worse.
Mean Time to Respond (MTTR)
Metric SOAR can improve when playbooks hit the right actions.
Frequently asked questions
What is SOAR in simple terms?
It is workflow automation for security: when an alert arrives, a playbook gathers context, opens a case, and may take pre-approved actions like blocking a hash or disabling a token.
How is SOAR different from a SIEM?
A SIEM stores and detects. SOAR orchestrates what happens after: tickets, enrichment APIs, chat notifications, and response in other tools.
Should SOAR auto-isolate every EDR alert?
Usually no. Isolation is high impact. Start with enrichment and low-regret blocks, then add containment behind confidence checks and human approval.
What is orchestration versus automation?
Orchestration is connecting multiple tools in a sequence. Automation is executing steps without a human. SOAR names both, plus the case/response layer.
Does SOAR require a dedicated product?
Not always. Some XDR and SIEM suites include playbooks. The requirement is reliable integrations, versioned playbooks, and audit logs of automated actions.
Where do SOAR projects fail?
They automate noisy alerts, brittle APIs, and undocumented exceptions. Playbooks then create outages faster than analysts ever could.
What should the first playbooks be?
Phishing triage, hash/domain enrichment, user-context lookup, and ticket hygiene—jobs that are frequent, well-understood, and reversible.
References
Explore authoritative guidance and frameworks related to security orchestration, automation and response (soar).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.