SOAR is software that runs a security team's response steps automatically, so that an attack is stopped in minutes instead of an hour. SOAR stands for security orchestration, automation and response. It works in a security operations centre (SOC), after an alert has been confirmed as a real attack.
The response steps are written down in advance, as a playbook. A playbook is a fixed list of steps for one kind of attack. The security team writes it before any attack happens, so nobody has to decide the steps at 3 a.m.
Here is a typical case: a playbook for a phishing email, a fake email that tries to steal passwords. At a mutual fund company in Mumbai, an employee clicks "Report phishing" on an email that asks her to log in to see her salary slip. SOAR now runs five steps. First, it asks the threat intelligence platform about the link in the email. The platform replies that the link leads to a known fake login page. Second, it tells the email filter to find every copy of the same email and delete it. The email had reached 600 inboxes. Third, it searches the SIEM for anyone who opened the fake page. It finds two employees. Fourth, it tells single sign-on (SSO) to reset those two employees' passwords, so that any stolen password stops working. Fifth, it opens a ticket in the IT service desk, so that the IT team calls both employees.
Done by hand, an analyst would log in to each of these tools one after another. This usually takes about an hour. SOAR does it in a few minutes.
Orchestration means that one tool gives instructions to many other tools. SOAR does this through connectors, small programs that know how to talk to each product. A typical SOAR product has hundreds of connectors.
Not every step runs without a person. Some playbooks cut a laptop off from the network through the endpoint detection and response (EDR) software. This is called isolating the device, and it stops that employee's work. So many teams make SOAR wait for an analyst to approve that step with one click. SOAR also records every step it took, with the time. The incident response team uses this record in its report.