Security Orchestration, Automation, and Response
SOAR is an automated tool that integrates all of your security processes and tools in a central location. As an automated process that uses machine learning and artificial intelligence that makes it faster than humans searching for evidence of attacks, it helps reduce the mean time to detect (MTTD) and accelerates the time to respond to events. This could release members of the IT team to carry out other tasks.
The SOAR system uses playbooks that define an incident and the action taken. If the SOAR system does not detect an incident in a timely fashion, the playbook would have to be better tuned.
This will produce faster alert information for the security operations team, where the human entities can take further action to keep the company safe. Let's look at the workflow in the following diagram:
Figure 5.3 – Security integration
As you can see in the preceding diagram, we first sort the raw...
