SOAR guide: The fundamentals of Security Orchestration, Automation and Response

As a relatively novel technology in the cybersecurity industry, SOAR (short for Security Orchestration, Automation, and Response) is still settling in and yet to reach its full potential. But many still don’t quite understand the value of SOAR in its entirety, that's why we created this SOAR guide.

In this article, which is part one of a series of three consecutive blog posts, we will address the fundamentals of SOAR, and give concise and valuable answers to some of the most common questions regarding SOAR, such as - What is SOAR? What is the SOAR definition? What is a SOAR platform? What is SOAR used for, exactly? What does the acronym of SOAR stand for? How is SOAR different from SIEM?

Let’s dive right in.

SOAR definition: What is SOAR?

The SOAR acronym stands for Security Orchestration, Automation and Response. And the short version that briefly describes what is SOAR goes something like this:

• SOAR is a technology that allows companies to collect data regarding threats and alerts and allows analysts to respond to threats in less time and automate repetitive tasks.

Of course, now we’re just scratching the surface. There is a whole lot more to SOAR than it meets the eye, and we’ll take things one step at a time. Now, for the more elaborate definition that clears the fog and shines a light on the idiosyncrasies of SOAR:

• SOAR is a term coined by Gartner, which is used to describe three distinctive software capabilities. Orchestration, as a term, covers threat and vulnerability management, which include all the technologies that assist with the resolution of cyber threats.

• Automation refers to security automation, which describes the process of utilizing progressive automation and machine learning to automate particular areas of security operations.

• The term response refers to security incident response, which measures in detail how the organization responds to threats, in order to use that information to strategically increase the effectiveness of SecOps.

These three elements combined together make up the complex technology known as SOAR. Of course, understanding the SOAR definition and how SOAR operates is not that easy.

Still, as complex as it is, SOAR is still fairly straightforward to use, as the technology was created with the intention of instantly helping, not confusing security professionals. With the implementation of SOAR, the natural workflow of SecOps remains unaltered, yet it is drastically improved. SOAR allows SOC teams to respond faster to cyber threats, recognize false positives by detecting patterns, and free time for analysts to be able to focus on more relevant threats that require in-depth expertise.

But how can SOAR affect the way a SOC team operates without altering the core of their SecOps? This is possible because SOAR blends in the environment it is deployed in. SOAR is created with flexibility and swift customization in mind.

SOAR can integrate with a wide range of security tools, and instead of requiring security professionals to adapt to the way the technology operates, SOAR’s amazing customization capabilities actually allow security professionals to preserve their conventional workflow and reap the benefits of SOAR at the same time.

SOAR Guide: What is a SOAR platform? How is it different from SIEM?

This is one of the most commonly asked questions about SOAR, as many still confuse its capabilities with another cybersecurity technology, known as SIEM. SOAR starts where SIEM stops. A SOAR platform is characterized as the environment where SOAR is deployed and the changes it inflicts on the particular security ecosystem:

• A SOAR platform is typically incorporated in a SOC in order to increase the efficacy of the security professionals working within the SOC. SOAR uses automation and orchestration to help organizations pinpoint real cyber threats, eliminate false positives, and respond to actual danger by drastically improving the incident response time.

• SIEM, on the other hand, is a modern data aggregator that is solely used to collect information regarding alerts. Unlike SOAR, which leans on a machine learning engine to be constantly up to date with the most contemporary cyber threats, SIEM requires frequent manual tweaking from a cyber analyst in order to maintain its contemporary status.

In other words, not only does SOAR collect data, but it uses its machine learning engine to single-handedly respond to threats and utilize automation to fully carry out low-risk tasks (like documenting the process of analyzing an alert) without the need for human interaction. SIEM differs from SOAR in the sense that SIEM delivers the data regarding a threat, without facilitating recommended courses of action, ultimately requiring security professionals to do the job of assessing every single alert manually.

Within a given platform, SOAR allows SOC teams to detect, assess, and remediate cyber incidents all the while decreasing the need for human intervention in the process by providing automated analysis and utilizing machine learning and AI. Whereas SIEM needs constant tweaks and updates in order to be able to differentiate between normal and suspicious alerts.

This is why, with SOAR, analysts have more time to focus on higher priority assignments, rather than having to manually check every alert as it arrives in real-time, which is the case with those SOCs that rely on SIEM.

SOAR Guide: Does SOAR replace SIEM?

This is a crucial thing to understand - no, SOAR does not replace SIEM. The reality is that SOAR and SIEM are two very different technologies, and while SOAR is superior to SIEM in some areas, there is a reason why so many companies use SIEM, after all.

SIEM stands for Security Information and Event Management. In short, SIEM’s expertise lay in collecting and aggregating security information, including:

• Data from firewalls

• Intrusion detection systems

• Network appliances

However, once SIEM stores the aggregated data, its job is done. And in order to be able to replicate SOAR’s behavior and differentiate between normal and suspicious alerts, SIEM requires constant tweaking, which is performed by security analysts and engineers. But while SOAR has the upper hand in this area, and can autonomously distinguish between normal and potentially malicious alerts, SIEM is better at generating large volumes of data regarding security alerts.

So, rather than having to choose between SIEM and SOAR, the wise thing to do would be to combine the strengths of these two very different technologies and leverage their benefits by unifying them in a singular SOC platform. By working together, SOAR will be able to react to every alert generated by SIEM in a timely and effective manner.

Why is SOAR becoming increasingly prevalent in the cybersecurity industry?

So far, we mentioned that SOAR utilizes orchestration and incorporates automation in SecOps. Now, we’re going to explain just how these features benefit organizations, SOCs, MSSPs, and CISOs as well:

• Resolves the alert fatigue problem: Many organizations receive thousands of alerts on a daily basis, and SOCs often don’t have the manpower to properly assess every one of them. The huge volume of alerts inevitably leads to an overload of work for analysts, who are unable to keep up with the never-ending flood of alerts. By leveraging security automation, SOAR replaces analysts by taking care of low-risk alerts, which make up for over 60% of all alerts.

• Addressing the skill shortage issue: The number of daily alerts is rising, and sadly, the number of skilled security professionals is decreasing. However, SOAR directly addresses this issue by increasing the SOC productivity by 10 times, allowing SOC teams to accomplish more by doing less.

• Drastically increasing incident response time: SOC teams that don’t rely on the most contemporary technology and are not stacked with the most skilled analysts are often too slow in analyzing alerts. SOAR allows security professionals to increase their response time to cyber threats by up to 80% with fully or semi-automated responses.

The reason why SOAR is growing both in popularity and demand is that SOAR addresses the issues that couldn’t be resolved by older technologies.

SOAR acts as an all-in-one solution, simultaneously reinforcing different aspects of one SOC. And Gartner believes that, in comparison to today’s 5%, in 2022, over 30% of all SOC with over 5 members will rely on SOAR as their primary technology solution that connects all aspects of their security platform. Making it clear that the path of SOAR is already paved, and we’re the ones who have to follow.

How does SOAR affect the incident response efficiency of one SOC?

We already mentioned that SOAR improves the incident response time of an average SOC team by 80%. Yes, you read that correctly… 80%. But how exactly is that possible? Let us elaborate:

• Respond to threats within minutes instead of hours: SOAR uses its automation capability to get to the bottom of incoming alerts. Major companies get bombarded with thousands of threats every day, and without SOAR, answering every one of those alerts can take hours, days, and sometimes even weeks.

• In this scenario, SOAR presents a quick visual representation with every relevant characteristic of an alert, and given that SOAR is able to tell apart normal from suspicious alerts, SOAR will only notify analysts in case there is an unprecedented, complex issue that SOAR cannot resolve with the knowledge it already has. And, as we said that over 60% of all alerts end up being either false positives or low-risk threats, SOAR allows analysts to respond to the threats that really matter within minutes.

• Instead of sifting through endless data, SOAR automatically presents the most relevant pieces of information regarding a threat, allowing analysts to make well-informed decisions from the powerful insights SOAR provides through its customizable dashboards.

And the beauty of it is that SOAR will remember the course of action taken to remediate complex threats, and thus increase its knowledge and be more competent to at least provide recommended courses of action when a similar threat appears in the future. This is what progressive automation is all about, and that’s what we’re going to explain in more detail in the heading below.

How does progressive security automation function? Is automation dangerous?

Security automation is often a subject of some of the most heated debates among security professionals. To automate or not to automate? But before answering that, let’s delve into the idiosyncrasies of security automation:

• Detect and resolve false positives: Due to its machine learning engine, SOAR is capable of differentiating false positives from actual threats. The reason why security automation is called progressive is that the engine itself is programmed to accumulate knowledge from the characteristics of different types of threats it encounters, and SOAR uses that knowledge whenever an alert with a familiar pattern occurs.

• Adjustable degree of automation: Analysts can decide whether they want to fully or semi-automate certain processes. By configuring the documented procedures of a playbook, analysts have full autonomy to choose under which circumstances they want SOAR to fully automate certain tasks, and in which areas they want to include human intervention.

• Security automation frees up analyst time: SOAR’s security automation revolves around utilizing artificial intelligence and machine learning to apply full or semi-automation to workflow processes. Given that many of the day-to-day processes of many SOCs are repetitive, automating those repetitive processes spares a lot of time that would be unnecessarily spent if those processes were handled manually by analysts.

• Helps deal with the increasing volumes of alerts: Given that analysts have more time on their hands thanks to security automation, they can redirect their valuable time to focus on mitigating malicious threats. And documenting playbooks, SOC teams actually allow automation to resolve the flood of low-risk alerts in a regulated manner, all the while complying with GDPR and NIST regulations.

Even though many are skeptical about automation, the truth is, there is no reason to be scared of it, because even though SOAR has a machine learning engine backed by AI, it is still very much in control by analysts and engineers. In reality, SOAR’s automation will operate in the way orchestrated by analysts, not the other way around.

Even if you choose automation to take part only in low-risk processes, that would still be extremely helpful for your SOC team, as it will alleviate the burden of having to spend their time handling menial and repetitive tasks unnecessarily.

SOAR Guide Summary

As we mentioned at the beginning of this blog, there is a lot more to SOAR than it meets the eye, and immersing yourself into the very core of the SOAR technology is not that easy. Hopefully, by now you have a better understanding of the essence of SOAR and its amazing capabilities, as we explained the SOAR definition, what SOAR really is, and how this piece of technology assists SOC teams in a unique manner.

We’re going to unveil more characteristics about SOAR in the next part of this series. But in the meantime, if you want to learn more about the potential of SOAR, you can find out more about it by checking out our extensive repertoire of SOAR-dedicated blog posts.