SOAR & Playbooks
5 exercises — master SOAR vocabulary for SOC engineers and analysts: SOAR vs SIEM roles and coupling, automation vs orchestration distinction, playbook anatomy (trigger/conditions/actions/output), connector and action definition vocabulary, SOAR ROI metrics (MTTR, automation rate, throughput), and playbook lifecycle management.
0 / 5 completed
SOAR & playbook quick reference
- SIEM = detection engine (collect → correlate → alert). SOAR = response engine (receive alert → enrich → orchestrate → respond). They are complementary, not alternatives.
- Automation: single rule-based action, no human needed. Orchestration: coordinating multi-step, multi-tool workflows.
- Runbook = manual human-executed procedure. Playbook = automated version of a runbook executed by SOAR.
- Playbook anatomy: Trigger → Conditions (IF/THEN logic) → Actions (API calls to connected tools) → Output. "Human-in-the-loop" = pause for analyst approval before high-impact action.
- Connector: integration module exposing action definitions (isolate host, reset password, block IP). Bidirectional: can push commands AND pull data from the tool.
- SOAR ROI metrics: MTTR (how fast you respond), automation rate (% alerts handled without analyst), throughput (alerts per analyst per day). Present as capacity multiplication, not headcount reduction.
- Playbook lifecycle: versioning, quarterly review, exception logging, retirement (disable + archive, never delete), rollback capability.
1 / 5
A SOC manager is presenting the case for a SOAR platform to the CISO. She says: "We need to clarify: SOAR is not a replacement for our SIEM. SOAR handles automation and orchestration — two things the SIEM doesn't do. And coupling them properly is what makes a modern SOC scale."
What is SOAR, what is the difference between automation and orchestration in a SOC, and how does SOAR complement — not replace — the SIEM?
The SOAR/SIEM relationship is foundational to modern SOC architecture. Understanding it precisely — and being able to explain it to leadership — is a core skill for any security engineer or analyst.
SIEM vs SOAR roles:
Automation vs orchestration in SOC context:
• Automation — a single, rule-based action with no human needed: "When an alert fires for a known-FP scanner IP, automatically close it as FP and add a case note."
• Orchestration — coordinating multiple actions across multiple tools in a structured workflow: "When a phishing alert fires → 1) Query VirusTotal for URL reputation; 2) Look up user in AD; 3) Check EDR for process execution on user's device; 4) If EDR finds malicious process, isolate device via EDR API; 5) Reset user password via identity provider API; 6) Create Jira incident ticket; 7) Send Slack message to SOC lead."
Key vocabulary:
• SOAR (Security Orchestration, Automation and Response) — a platform that automates repetitive SOC tasks and orchestrates multi-tool response workflows; consumes SIEM alerts and executes playbooks
• Automation (in SOC) — executing a single, rule-based action without human intervention
• Orchestration (in SOC) — coordinating a sequence of actions across multiple security tools as an integrated workflow
• SOAR-SIEM coupling — the integration architecture where SOAR subscribes to SIEM alerts and executes automated enrichment and response workflows
SIEM vs SOAR roles:
| SIEM | SOAR | |
|---|---|---|
| Primary function | Ingest → normalise → correlate → alert | Receive alert → enrich → respond → document |
| Output | Alert in analyst queue | Automated triage, enrichment, response, or escalation |
| Human touch point | Analyst receives and triages alert | Analyst receives pre-enriched, pre-triaged alerts requiring judgement |
| Tool integration | Consumes logs from many sources | Executes actions across many tools via API connectors |
Automation vs orchestration in SOC context:
• Automation — a single, rule-based action with no human needed: "When an alert fires for a known-FP scanner IP, automatically close it as FP and add a case note."
• Orchestration — coordinating multiple actions across multiple tools in a structured workflow: "When a phishing alert fires → 1) Query VirusTotal for URL reputation; 2) Look up user in AD; 3) Check EDR for process execution on user's device; 4) If EDR finds malicious process, isolate device via EDR API; 5) Reset user password via identity provider API; 6) Create Jira incident ticket; 7) Send Slack message to SOC lead."
Key vocabulary:
• SOAR (Security Orchestration, Automation and Response) — a platform that automates repetitive SOC tasks and orchestrates multi-tool response workflows; consumes SIEM alerts and executes playbooks
• Automation (in SOC) — executing a single, rule-based action without human intervention
• Orchestration (in SOC) — coordinating a sequence of actions across multiple security tools as an integrated workflow
• SOAR-SIEM coupling — the integration architecture where SOAR subscribes to SIEM alerts and executes automated enrichment and response workflows