What is SOAR?
SOAR (Security Orchestration, Automation and Response) is a platform that connects security tools, automates recurring investigation and response tasks through playbooks and records incidents in a single case management system, so that a SOC handles alerts faster and more consistently. Where a SIEM mainly detects and correlates, SOAR takes care of the follow-up: enriching, deciding, acting and documenting. Gartner introduced the acronym in 2015 (then standing for Security Operations, Analytics and Reporting) and gave it its current meaning in 2017. In IT environments SOAR is now common; in OT, automated response calls for extra restraint, because a wrong block can stop a production process.
SOAR connects your security tools, automates repetitive tasks and accelerates Incident Response, but people remain responsible for any action that affects the process.
🧱 What does SOAR consist of?
The three letters of the name, together with case management, describe the four building blocks of every SOAR platform:
| Component | What it does | Example |
|---|---|---|
| Orchestration | Connects tools through APIs and connectors into a single workflow | SIEM, EDR, Firewall, CMDB, ticketing system and threat intelligence feeds |
| Automation | Executes steps without manual work, following fixed logic | Looking up a hash, enriching an IOC, isolating an endpoint |
| Response | Drives handling through playbooks with decision points and approvals | Phishing playbook, ransomware playbook, suspicious sign-in playbook |
| Case management | Records every incident, action and decision as an audit trail | Timeline, evidence, reporting to the CSIRT or regulator |
The playbook is the core: a defined sequence of steps with conditions, such as “if the reputation score of this IP address is high, block it on the perimeter firewall and open a ticket”. Since November 2023, the OASIS specification CACAO Security Playbooks version 2.0 has offered an open format for describing such playbooks in machine-readable form and sharing them between organisations and tools.
🔧 What does SOAR do in practice?
A SOAR platform mainly takes over the predictable work of tier 1 analysts:
- Triage - automatically classifying and prioritising an incoming alert from the SIEM, XDR or NDR
- Enrichment - checking IOCs such as hashes, domains and IP addresses against threat feeds and the CMDB
- Containment - isolating a suspicious endpoint through EDR, disabling an account through IAM or blocking an address on the Firewall or VPN gateway
- Coordination - creating tickets in the ITSM system, paging the on-call analyst and informing stakeholders
- Reporting - building a timeline and incident report that can be used directly for the internal review and for mandatory reporting
The benefit shows up mainly in measurable response time. SOCs steer on MTTD (mean time to detect) and MTTR (mean time to respond); SOAR mostly shortens the latter, because enrichment and first containment happen within minutes instead of after manual searching. SOAR also makes security processes more scalable: alert volumes can grow without the team growing at the same rate, which helps with the shortage of specialists (see also Scalability).
🧠 How does an automated ransomware response work?
A typical ransomware playbook in the office environment:
- Detection - the SIEM or EDR sees abnormal encryption activity on a workstation
- Playbook start - SOAR automatically opens a case and collects hostname, user and recent processes
- Containment - the workstation is isolated from the network through EDR and the account is temporarily locked
- Block - the IP address of the command-and-control server is blocked on the firewall
- Notification - the SOC receives an alert with an initial overview for forensic investigation
- Escalation - for a significant incident the case is handed over to the Incident Response Plan, the crisis organisation and, where needed, the CSIRT
🔄 What is the difference between SOAR, SIEM and XDR?
| Characteristic | SIEM | SOAR | XDR |
|---|---|---|---|
| Main task | Collecting, correlating and detecting on logs | Orchestrating and automating response | Detection and response across its own sensors |
| Input | Logs and events from many sources | Alerts from SIEM, XDR, email and tickets | Telemetry from endpoints, network, email and cloud |
| Output | Alerts and dashboards | Executed actions, cases and reports | Correlated incidents with built-in response |
| Vendor lock-in | Usually open to all sources | Broad: hundreds of connectors | Often focused on the vendor’s own ecosystem |
The boundaries are blurring: Microsoft Sentinel is a SIEM with built-in SOAR capabilities (automation rules and playbooks based on Azure Logic Apps), and Google Security Operations and Splunk also combine SIEM and SOAR in a single platform.
⚙️ Which SOAR platforms are widely used?
| Platform | Background |
|---|---|
| Cortex XSOAR | Palo Alto Networks, built on the acquisition of Demisto in 2019 |
| Splunk SOAR | Formerly Phantom, acquired by Splunk in 2018; Splunk has been part of Cisco since March 2024 |
| IBM QRadar SOAR | IBM, originating from Resilient |
| Google Security Operations | SOAR capabilities from Siemplify, acquired by Google in January 2022 |
| Microsoft Sentinel | SIEM with automation rules and Logic Apps playbooks |
| FortiSOAR | Fortinet, following the acquisition of CyberSponse in late 2019 |
| Swimlane | Independent vendor of low-code security automation |
DFLabs, an early SOAR vendor, was acquired by Sumo Logic in 2021. OT monitoring platforms such as Nozomi, Claroty and Dragos do not provide full SOAR themselves, but they do forward their alerts to these platforms.
🏭 How do you use SOAR safely in OT?
In ICS and SCADA environments the risk is different from IT: availability and safety come before confidentiality. A playbook that automatically blocks the IP address of an HMI or engineering workstation can leave operators blind to the process. A responsible approach:
- Start with enrichment, not intervention - in OT, let SOAR first only gather context from passive monitoring, the asset inventory and MITRE ATT&CK for ICS
- Act at the boundary - automated blocks belong in the IDMZ or DMZ and on the IT/OT firewall, not at level 1 or 2 of the Purdue Model; sound segmentation is what makes such a boundary possible
- Keep a human in the loop - every action with process impact needs approval from the operator on duty or the OT administrator
- Leave safety systems alone - a SIS and PLC logic are outside the scope of any automated response
- Test and manage playbooks as changes - through change management and exercises such as a tabletop exercise
- Agree on roles - IT security, OT operations and the CISO agree in advance who may approve which action, often recorded in an OT SOC way of working
| Action | Office IT | OT network |
|---|---|---|
| Isolate endpoint | Automatic | Only after operator approval |
| Block IP address | Automatic at the perimeter | Only at the IT/OT boundary, after approval |
| Disable account | Automatic | Not for shared operator accounts without consultation |
| Enrichment and ticket | Automatic | Automatic |
🔐 What role does SOAR play in NIS2 and IEC 62443?
No law or standard requires SOAR, but the platform does help you meet the requirements. The incident reporting obligation of the Dutch Cybersecurity Act, the national implementation of NIS2, has since 15 August 2026 required an early warning within 24 hours, an incident notification within 72 hours and a final report within one month; SOAR case management provides the timeline you need for this. In IEC 62443-3-3, the system part of IEC 62443, foundational requirement FR 6 (timely response to events) covers audit log accessibility and continuous monitoring. ISO 27001 and the NIST CSF also call for demonstrable incident management, and NIST SP 800-61 Revision 3, published in April 2025, explicitly ties incident response to CSF 2.0. For compliance, the SOAR audit trail is therefore often more valuable than the automation itself.
❓ Frequently asked questions
What does SOAR stand for?
SOAR stands for Security Orchestration, Automation and Response. It is a category of security software that connects tools, automates response tasks through playbooks and records incidents in case management. Gartner introduced the acronym in 2015 and gave it this meaning in 2017.
Does SOAR replace SOC analysts?
SOAR does not replace SOC analysts, but it takes over their repetitive work, such as enrichment, triage and standard containment. This leaves analysts time for investigation, threat hunting and high-impact decisions. In OT especially, a person remains responsible for any intervention.
Do I need a SIEM to use SOAR?
SOAR needs alerts to respond to, and these usually come from a SIEM, XDR or email security. Without reliable detection, SOAR mainly automates noise. Many organisations therefore start with a well-tuned SIEM and add SOAR once the most important alerts are stable.
Is SOAR suitable for OT environments?
SOAR is suitable for OT when the platform mainly enriches, records and coordinates, and automated blocks are limited to the boundary between IT and OT. Interventions in the process network always need approval from an operator. Safety systems and PLC logic never belong in an automated playbook.
What is a SOAR playbook?
A SOAR playbook is a defined workflow with steps, conditions and approvals for one type of incident, such as phishing or ransomware. The platform executes the steps and records every result in the case. With the OASIS CACAO standard, playbooks can be described and shared in machine-readable form.
How does SOAR help with incident reporting under the Cybersecurity Act?
SOAR keeps a complete timeline of detection, actions and decisions for each incident. This lets an organisation draw up the early warning within 24 hours and the incident notification within 72 hours faster and with supporting evidence. Deciding whether an incident is significant remains a human judgement.
📌 In summary
SOAR connects the tools of a SOC, automates predictable investigation and response steps and records every incident. In IT this shortens response time considerably; in OT the emphasis is on enrichment, recording and coordination, with a person deciding on every intervention in the process.
SOAR automates and orchestrates security tasks so that incidents are handled faster and more consistently; in a hybrid IT/OT environment it only works well with clear limits on automated response and a complete audit trail.