SOAR (Security Orchestration, Automation, and Response)
Also known as: Security Orchestration Automation and Response, Security Automation
Security tooling that coordinates systems and automates repeatable response work through controlled playbooks and integrations.
Security Orchestration, Automation, and Response connects security tools to repeatable procedures, so the same steps happen the same way every time.
- Enrich alerts
- Create cases
- Notify the right people
- Gather evidence
- Take approved response actions Automation should not remove governance. Buyers should verify which integrations and playbooks are included, which actions require approval, how failures are handled, and what evidence is retained after a workflow runs.