Simple definition
SOAR (Security Orchestration, Automation and Response) automates and orchestrates security-incident response tasks.
Technical definition
A SOAR platform connects SIEM, EDR, email, firewalls, threat-intelligence services, and other APIs. It represents procedures as playbooks that can enrich an alert, request approval, and execute actions.
How it works / role
An alert triggers a playbook. The playbook collects context, queries multiple tools, evaluates conditions, and then performs actions automatically or after approval, such as isolating a host, blocking an IP, or opening a ticket. Each step is logged to preserve a response trail.
What is it used for?
Reduce repetitive SOC work, speed up alert enrichment, and apply consistent response procedures.
Practical example
After a phishing alert, the playbook extracts indicators, searches for similar messages, requests approval, then removes the emails and blocks the malicious domain.
Common issues
- Playbook is too aggressive and performs incorrect actions
- API connector is broken or lacks permissions
- Poor input data leads to a wrong decision
- High-impact action has no human-approval step
Key takeaway: SOAR automates a procedure; playbook quality, input data, and safety controls directly determine how safe that automation is.