← All cheat sheets

SOAR

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

SOAR = Security Orchestration, Automation and Response (term from Gartner).
It connects your security tools, runs repeatable workflows (playbooks), and
speeds up incident response so analysts spend time on judgement, not clicks.
This is a concept + practice reference, platform-neutral. For the manual
process see INCIDENT-RESPONSE; for detections that trigger playbooks see
SIGMA / DETECTION-ENGINEERING; for enrichment steps see IOC-ENRICHMENT.

THE THREE WORDS#

Orchestration  # connect many tools via APIs/integrations so they act as one
Automation     # run steps without a human (enrich, query, block, ticket)
Response       # run the case: triage -> contain -> notify -> close
Gartner framed three capability areas:
  threat & vulnerability management, incident response, SecOps automation.

SOAR vs SIEM vs XDR#

SIEM  collects + correlates logs, raises alerts            (what happened)
XDR   detection+response across endpoint/identity/cloud    (vendor-integrated)
SOAR  acts on alerts from any source via playbooks         (the "hands")
They overlap: SIEM/XDR increasingly embed SOAR-style automation. Gartner now
covers SOAR via a Market Guide (no standalone Magic Quadrant); standalone SOAR
vendors still exist. Pick by integrations and who raises your alerts.

CORE COMPONENTS#

Integrations / connectors  # APIs to EDR, firewall, SIEM, IdP, ticketing, TI
Playbooks                  # the automated workflow (see anatomy below)
Case / incident management # the record: timeline, artefacts, status, owner
Threat-intel management    # ingest + match IOCs, enrich, dedupe
Dashboards & metrics       # queue, SLA, MTTR, automation rate

PLAYBOOK vs RUNBOOK#

Runbook   = the documented procedure a human follows (the recipe).
Playbook  = that procedure encoded for the SOAR to run (fully or partly auto).
Build the runbook first; automate it only once it is stable and correct.

PLAYBOOK ANATOMY#

Trigger    # SIEM/XDR alert, email, webhook, schedule, manual
Enrich     # pull context: reputation, geo, asset owner, user, prior cases
           #   (VirusTotal, AbuseIPDB, GreyNoise, AD/Entra, CMDB - see
           #    IOC-ENRICHMENT)
Decide     # branch on data; automatic for safe reads, HUMAN for destructive
Act        # block IP/hash/domain, isolate host, disable user, reset creds,
           #   quarantine email, open/annotate ticket
Notify     # chat/email the owner; update the case
Close      # record outcome, dwell time, false-positive flag, lessons

COMMON HIGH-VALUE USE CASES#

Phishing triage   # parse report, detonate URL/attachment, pull similar mails,
                  #   verdict, purge, notify (see EMAIL-HEADER-ANALYSIS)
Alert enrichment  # auto-attach context to every alert before an analyst looks
IOC blocking      # push confirmed indicators to firewall/EDR/DNS, with expiry
Account triage    # on risky-sign-in: enrich, step-up or disable, notify
                  #   (see ACCOUNT-COMPROMISE-TRIAGE)
Vuln/KEV response # on CISA KEV match: ticket owner, track SLA
Case hygiene      # auto-open, tag, assign, SLA-timer, dedupe duplicates

METRICS THAT JUSTIFY SOAR#

MTTD / MTTR      # detect / respond time, before vs after
Automation rate  # % of alerts auto-triaged or auto-closed
Analyst hours saved per use case (count the manual steps removed)
Dwell time, SLA adherence, false-positive rate
Measure the manual baseline FIRST, or you cannot prove the gain.

HUMAN-IN-THE-LOOP (SAFETY)#

Automate freely: reads, enrichment, ticketing, notifications.
Require approval for destructive/irreversible acts: isolate host, disable
  user, block at the perimeter, delete mail - a bad auto-action is an outage.
Guardrails: allowlists (never auto-block your own ranges/VIPs), rate limits,
  dry-run mode, full audit log, easy rollback, break-glass stop.

PLATFORMS (choose by integrations; neutral list)#

Open / free  Shuffle + StackStorm (OSS); Tines (free tier, SaaS);
             n8n (fair-code, general automation)
Commercial   Splunk SOAR (ex-Phantom), Palo Alto Cortex XSOAR (ex-Demisto),
             Microsoft Sentinel playbooks (Logic Apps), Google SecOps SOAR
             (ex-Siemplify, ex-Chronicle SOAR), Swimlane, Torq, Tines
Many SIEM/XDR suites now ship built-in automation - you may not need a
  separate product.

GOOD PRACTICE#

- Start with ONE high-volume, low-complexity, well-understood use case.
- Do not automate a broken process - fix the runbook first.
- Keep a human gate on anything that cannot be undone.
- Version-control playbooks; review and test them like code.
- Handle errors: API down, rate limit, partial failure - fail safe, alert.
- Store secrets in the platform's vault, least privilege per integration.
- Re-measure after rollout; retire playbooks that no longer earn their keep.

REFERENCES (verify against primary sources)#

Gartner      Market Guide for SOAR; Hype Cycle for Security Operations
NIST SP 800-61 Rev 3 (Apr 2025)  IR recommendations, CSF 2.0 profile
                (supersedes Rev 2, 2012 Incident Handling Guide)
Vendor docs  Splunk SOAR, Cortex XSOAR, Microsoft Sentinel, Google SecOps,
             Shuffle, Tines (for exact actions and integration behaviour)

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.