What is SOAR?
SOAR stands for security orchestration, automation and response. A SOAR platform connects the tools a security operations center already runs, such as the SIEM, EDR, email gateway, firewall, identity provider, threat intelligence feeds and ticketing system, and runs playbooks across them. When an alert arrives, a playbook can gather context, make simple decisions, take response actions and record everything in a case, in seconds rather than the many minutes an analyst might spend copying data between consoles.
The three words describe three capabilities:
- Orchestration: connecting different tools through APIs and webhooks so they work as one workflow.
- Automation: carrying out steps without a person driving each one, such as looking up a file hash or blocking a URL.
- Response: case management, collaboration and the documented actions taken to handle an incident.
How a SOAR playbook runs
Consider an impossible-travel alert from the identity provider: a user signs in from Chicago and, 40 minutes later, from another continent. A typical playbook does the following:
- Trigger: the SIEM sends the alert to the SOAR platform.
- Enrich: look up the second IP address's reputation and whether it belongs to a VPN or hosting provider, pull the user's role and manager, and check for recent MFA changes or new inbox rules.
- Decide: if the address is a known corporate VPN exit, close the case as benign; if it is on a threat feed or the mailbox shows new forwarding rules, raise the severity.
- Contain: revoke the user's sessions and require a password reset, after an analyst approves.
- Record: attach every lookup and action to the ticket and notify the user's manager.
Most of an analyst's time would go into steps 2 and 3, which is exactly the repetitive work automation handles well.
What SOAR is good for
- High-volume, repetitive triage, such as user-reported phishing or low-severity endpoint alerts.
- Consistency: every alert of a given type is handled the same way.
- Speed: a shorter time to contain, which limits damage.
- Documentation: an automatic audit trail of what was checked and what was done.
- Analyst time: people spend it on judgment instead of data gathering.
Guardrails for automation
Automation multiplies mistakes as easily as it multiplies good work. A playbook that disables accounts can lock out hundreds of people if a detection rule misfires, and the SOAR platform holds the combined rights of many tools, which makes it a valuable target. Sound deployments use:
- Human approval before disruptive or hard-to-reverse actions, such as isolating a production server.
- Limits on how many targets one run may act on, plus a kill switch to stop a runaway playbook.
- A dry-run or monitor-only mode for testing before enforcement.
- Least-privilege API credentials for each integration, kept in a vault.
- Change management for playbooks, like any other production code.
SOAR vs. SIEM
A SIEM collects, normalizes and correlates logs from across the environment and raises alerts. SOAR takes those alerts and acts on them. When a scenario says the team detects plenty but can't keep up with the response work, a second SIEM or more log sources won't help; SOAR will. Many vendors now bundle the two, and XDR products include some automated response, but the exam treats detection and orchestrated response as separate jobs.
SOAR on the CompTIA Security+ exam
SOAR belongs to objective 4.6 on SY0-801, which covers automation and orchestration in security operations, and orchestration also appears in objective 4.4 among the tools used for monitoring and alerting. Look for wording like "reduce analyst time on repetitive triage," "respond to every reported phishing email the same way," "coordinate actions across the firewall, EDR and identity provider" or "alert fatigue." Distractors include a SIEM, which detects but doesn't orchestrate a response, a single scheduled script, which suits one simple rule rather than a cross-tool workflow, and hiring more analysts for a problem of volume. Expect questions about guardrails too: the safer answer keeps a person approving destructive steps.