SOAR platforms are a collection of security software solutions and tools for browsing and collecting data from a variety of sources. SOAR solutions then use a combination of human and machine learning to analyze this diverse data in order to comprehend and prioritize incident response actions.

The term is used to describe three software capabilities: threat and vulnerability management, security incident response and security operations automation. SOAR allows companies to collect threat-related data from a range of sources and automate the responses to the threat. The term was originally coined by Gartner, who also defined the three capabilities. Threat and vulnerability management (Orchestration) covers technologies that help amend cyber threats, while security operations automation (Automation) relates to the technologies that enable automation and orchestration within operations.

What security operations teams are looking for: 

• Automate Repeated Response Workflow​ 
• Save Time for Higher Priority Triage Tasks​ 
• Easy Standardized Response to follow

The benefits of SOAR:

• Consolidate process management, technology and expertise​
• Centralize asset monitoring​
• Enrich alerts with contextual intelligence ​
• Automate response and perform inline blocking