What is SOAR in Security+?
D4 · Operations · CompTIA Security+ SY0-701SOAR (Security Orchestration, Automation, and Response) platforms integrate security tools and automate repetitive tasks through playbooks — predefined workflows that automatically respond to common security events.
SOAR capabilities: orchestration (integrates disparate tools), automation (executes playbooks without human intervention), response (contains threats automatically).
Example: SIEM detects phishing email → SOAR playbook automatically isolates endpoint, blocks sender domain, creates ticket, and notifies analyst.
SOAR capabilities: orchestration (integrates disparate tools), automation (executes playbooks without human intervention), response (contains threats automatically).
Example: SIEM detects phishing email → SOAR playbook automatically isolates endpoint, blocks sender domain, creates ticket, and notifies analyst.
SIEM = detect and alert. SOAR = automate the response. SOAR reduces MTTR (Mean Time to Respond). On the exam, if a question asks about automating incident response or reducing analyst workload, SOAR is the answer. SOAR uses playbooks; SIEM uses correlation rules.