SOAR
In security operations, SOAR is security orchestration, automation and response: tooling that connects the systems a security team uses and executes agreed sequences against them automatically. It is not a detection technology. It acts on decisions that have already been made, which is why it amplifies whatever the process already is.
How it works
Three capabilities sit under the acronym. Orchestration connects the platforms through their interfaces, so an analyst is not moving data between consoles by hand. Automation executes defined steps without a human: enrich an address against intelligence, look up the asset owner, pull the file, query the directory for other sign-ins from the same source. Response executes the containment actions themselves, such as disabling an account, isolating a host or blocking a sender.
Those steps are written as playbooks, and a mature deployment usually separates the two halves: enrichment runs automatically on everything, while destructive actions require an analyst to approve them.
What goes wrong
Automating a broken process makes it broken faster. If triage is guesswork, a playbook that acts on the outcome of that triage will disable the wrong account with impressive consistency. The prerequisite is a procedure that a competent analyst already performs the same way every time; automating a decision nobody has written down produces incidents rather than preventing them.
The second failure is maintenance. Playbooks break silently when a connected platform changes its interface, a field is renamed or a permission is revoked, and a playbook that fails quietly is worse than none, because the team believes the step happened. Playbooks need tests and owners, exactly like software.
The third is the wrong target. Automating the response to a class of alert that should not exist is effort spent making a noise problem cheaper to tolerate. The right first move is usually to fix the detection in the SIEM, and the right second is to automate the enrichment that every analyst does by hand.
Where this shows up in an audit
Automated response is directly observable from the attacker’s side, and it is one of the few controls we can time precisely. In an exercise we record how long it took for an account we compromised to be disabled or a host to be isolated, and whether the action was complete: disabling an account without revoking its live sessions and tokens leaves us working, and that is a common result. The finding is the gap between the action taken and the access it actually removed, which the SOC normally cannot see from its own console.