Security Orchestration, Automation, and Response
Security orchestration, automation, and response connects security tools and runs documented response playbooks. It helps a security operations team collect context, coordinate work, execute approved actions, and keep an auditable record while preserving human control over uncertain or high-impact decisions.
itDefensive security and security operations | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Security Orchestration, Automation, and Response
Security orchestration, automation, and response, or SOAR, coordinates security work across tools and teams. A SOAR platform receives an alert or incident, gathers context, evaluates conditions, executes approved actions, requests decisions, updates systems, and records results.
The goal is not to remove analysts. The goal is to make repeatable work consistent and fast while keeping uncertain and high-impact decisions under appropriate human control.
Three connected capabilities
Orchestration connects systems and coordinates a process across them. It can pass an incident from a detection platform to identity, endpoint, network, ticketing, messaging, and threat-intelligence systems.
Automation executes defined steps without a person performing each step manually. It works best when inputs, states, conditions, outcomes, and exceptions are explicit.
Response is the security outcome. A workflow may enrich an alert, assign a case, notify a team, isolate a device, disable an account, or collect evidence. The action still belongs to the incident response process and its authority model.
The playbook model
A playbook is an executable response procedure:
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/glossary/term/security_orchestration_automation_and_response
Supports
- Current NIST use of the SOAR term
- Source links to NIST SP 800-18r2, SP 800-215, and SP 800-61r3
- https://www.cisa.gov/sites/default/files/publications/Enabling%20Automation%20in%20Security%20Operations%20-%20Increasing%20Automation%20Potential%20of%20Processes_508c.pdf
Supports
- Need for clear definition, consistent implementation, and fixed determination of states, results, conditions, and decisions
- Hidden manual inference as a barrier to reliable automation
- Data accessibility, consistency, and relationships as automation considerations
- Process analysis before SOAR automation
- https://www.cisa.gov/sites/default/files/publications/Orchestration%20of%20Information%20Technology%20Automation%20Frameworks_508c.pdf
Supports
- Differences between orchestration and traditional automation frameworks
- Orchestration management functions and workflow characteristics
- Coordination of security operations and IT automation
- Approved frameworks and alignment of automated change with organizational policy
- https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks
Supports
- Playbooks as automated workflows for predefined investigation and remediation actions
- Automatic and manual execution on incidents, alerts, and entities
- Enrichment, ticket synchronization, notification, orchestration, and remediation examples
- Use of a service account and explicit permissions for playbook execution
- https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
Supports
- Central automation rules for incident handling
- Ordered actions and playbook execution
- Incident queue as an operational focus
- Explicit permission requirements for the execution identity
- https://learn.microsoft.com/en-us/azure/sentinel/automation/tutorial-respond-threats-playbook
Supports
- Example flow that opens a ticket, notifies responders, requests an administrator decision, and branches on approval
- Coordinated identity and network response actions after approval
- https://learn.microsoft.com/en-gb/azure/logic-apps/logic-apps-overview
Supports
- Logic Apps as the workflow engine used for Microsoft Sentinel playbooks
- At-least-once delivery and the need for idempotent handling of duplicate messages
- Workflow definitions, conditions, switches, and automated deployment support
- https://learn.microsoft.com/en-us/azure/logic-apps/error-exception-handling
Supports
- Explicit retry policies for timeouts, throttling, and server errors
- Bounded retry counts and intervals
- Run-after behavior for succeeded, failed, skipped, and timed-out actions
- Scopes and follow-up branches for centralized error handling and cleanup