Security Orchestration, Automation, and Response
Security orchestration, automation, and response connects security tools and runs documented response playbooks. It helps a security operations team collect context, coordinate work, execute approved actions, and keep an auditable record while preserving human control over uncertain or high-impact decisions.
itDefensive security and security operations | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Security Orchestration, Automation, and Response
Security orchestration, automation, and response (SOAR) coordinates security work across tools and teams. A SOAR platform receives an alert or incident, gathers context, evaluates conditions, executes approved actions, asks for decisions when needed, updates systems, and records results.
The goal is not to remove analysts. The goal is to make repeatable work consistent and fast while keeping uncertain and high-impact decisions under human control.
Three capabilities travel together. Orchestration connects systems and coordinates a process across them. Automation executes defined steps without waiting on a human for each click. Response changes the environment to contain or recover: isolate a host, block a token, open a ticket, notify an owner. Useful platforms keep those stages visible: trigger, normalize, enrich, decide, act, verify, record.
Start with enrichment and ticket hygiene before irreversible containment. Give playbooks narrow execution identities. Define timeouts and fallbacks when an enrichment source is down. Measure false positives before you let automation pull cables.
Read the Intro for the three-capability split. Use the Cheatsheet when you need the pipeline stages. Field Notes highlight enrichment trust, execution identity, and override signals that tell you a playbook is unsafe. The Intro and Cheatsheet carry the worked vocabulary; return to them when a term here feels thin. Field Notes hold the judgment calls that change what you do next. The Intro and Cheatsheet carry the worked vocabulary; return to them when a term here feels thin. Field Notes hold the judgment calls that change what you do next.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/glossary/term/security_orchestration_automation_and_response
Supports
- Current NIST use of the SOAR term
- Source links to NIST SP 800-18r2, SP 800-215, and SP 800-61r3
- https://www.cisa.gov/sites/default/files/publications/Enabling%20Automation%20in%20Security%20Operations%20-%20Increasing%20Automation%20Potential%20of%20Processes_508c.pdf
Supports
- Need for clear definition, consistent implementation, and fixed determination of states, results, conditions, and decisions
- Hidden manual inference as a barrier to reliable automation
- Data accessibility, consistency, and relationships as automation considerations
- Process analysis before SOAR automation
- https://www.cisa.gov/sites/default/files/publications/Orchestration%20of%20Information%20Technology%20Automation%20Frameworks_508c.pdf
Supports
- Differences between orchestration and traditional automation frameworks
- Orchestration management functions and workflow characteristics
- Coordination of security operations and IT automation
- Approved frameworks and alignment of automated change with organizational policy
- https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks
Supports
- Playbooks as automated workflows for predefined investigation and remediation actions
- Automatic and manual execution on incidents, alerts, and entities
- Enrichment, ticket synchronization, notification, orchestration, and remediation examples
- Use of a service account and explicit permissions for playbook execution
- https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
Supports
- Central automation rules for incident handling
- Ordered actions and playbook execution
- Incident queue as an operational focus
- Explicit permission requirements for the execution identity
- https://learn.microsoft.com/en-us/azure/sentinel/automation/tutorial-respond-threats-playbook
Supports
- Example flow that opens a ticket, notifies responders, requests an administrator decision, and branches on approval
- Coordinated identity and network response actions after approval
- https://learn.microsoft.com/en-gb/azure/logic-apps/logic-apps-overview
Supports
- Logic Apps as the workflow engine used for Microsoft Sentinel playbooks
- At-least-once delivery and the need for idempotent handling of duplicate messages
- Workflow definitions, conditions, switches, and automated deployment support
- https://learn.microsoft.com/en-us/azure/logic-apps/error-exception-handling
Supports
- Explicit retry policies for timeouts, throttling, and server errors
- Bounded retry counts and intervals
- Run-after behavior for succeeded, failed, skipped, and timed-out actions
- Scopes and follow-up branches for centralized error handling and cleanup