Orchestration
- Connecting the many tools a SOC uses.
- So they can pass information to each other.
- One workflow instead of ten tabs.
Concepts
SOAR: doing the repetitive work automatically.
SOAR stands for Security Orchestration, Automation, and Response. In plain terms, it is the layer that takes the routine steps an analyst would do by hand — look something up, enrich it, take an action — and runs them automatically through a playbook. It does not replace analysts; it gives them back the hours they used to spend on copy-paste.
Breaking it down
The three words
Automation
- Running routine steps without a human.
- Enrichment, lookups, gathering context.
- Consistent, fast, and never forgotten.
Response
- Taking action: block, isolate, disable, notify.
- Some actions automatic, some held for approval.
- The risky ones keep a human in the loop.
The core idea
What a playbook is
A playbook is a written, repeatable sequence of steps for handling a particular kind of alert. Before SOAR, playbooks lived in documents and analysts followed them by hand. SOAR turns that document into something executable: each step becomes an automated action, with decision points where the workflow branches or pauses for a person.
The value is consistency and speed. The hundredth phishing report at 3am is handled exactly like the first, in seconds, freeing the analyst to focus on the cases that genuinely need judgement. This site's playbooks page covers the human side of building those procedures.
Example
A phishing playbook, automated
1. Trigger A user reports a suspicious email; the alert lands in the SOAR tool.
2. Enrich Automatically extract links and attachments, check them against threat intel and sandboxes.
3. Decide If clearly malicious, continue; if uncertain, pause for an analyst.
4. Act Pull the email from other inboxes, block the sender, and open a case.
5. Record Log every step so the response is auditable and measurable.
Clearing up confusion
SOAR vs SIEM
SIEM
- Collects data and detects problems.
- Answers "what is happening?"
- Produces the alerts.
SOAR
- Acts on the problems the SIEM finds.
- Answers "what do we do about it?"
- Runs the response.
They are complementary. The SIEM is the eyes; SOAR is the hands. In many environments the two are tightly integrated, and some vendors ship them together. For the detection side, revisit the SIEM architecture guide; for the knowledge that drives smarter automation, see threat intelligence.