SOAR (security orchestration, automation and response)

SOAR platforms connect a security team's tools together and automate the repetitive steps of handling an alert: enriching an indicator with threat intelligence, opening a ticket, isolating a host, or disabling a user account. A SOAR runs playbooks, predefined sequences of actions triggered by an alert from a SIEM or other detection tool, with some steps fully automated and others requiring analyst approval.

This differs from a SIEM, which focuses on detecting and correlating events; SOAR takes over on the response and case-management side after detection, and is usually deployed alongside rather than instead of a SIEM. It also differs from simple scripting in that playbooks are reusable, auditable, and can span many disconnected tools through prebuilt integrations.

SOAR matters because it lets a security operations center handle far more alerts with the same headcount, cutting the time between detection and containment. The main pitfall is over-automating high-impact actions, such as automatically blocking accounts or isolating production hosts, before playbooks are proven reliable; a bad rule can cause an automated outage as easily as it prevents one.