Also known as: SOAR
Technology that coordinates security workflows across tools and automates defined investigation or response steps.
SOAR connects security tools and runs defined workflows for tasks such as enrichment, ticket creation, evidence collection, containment, notification, and case handling.
SIEM and SOAR answer different questions. SIEM collects and analyzes security data. SOAR coordinates actions across systems. Modern security platforms may combine both functions.
Automation should preserve roles, approvals, tenant scope, evidence, and audit history. A faster action is not automatically a safer one.