31. SOC, SIEM and Incident Response
31.11 SOAR: Security Automation
Example first. A busy SOC may get thousands of alerts a day. For a phishing report, an analyst used to do the same ten steps by hand every time. Tools like Palo Alto Cortex XSOAR or Microsoft Sentinel's automation now do those steps in seconds, and let the human make only the final call. That is SOAR.
Why it matters
Analysts waste time on the same boring steps. That causes slow response and tired staff who miss things. Automating the repeats makes response faster and frees people for real thinking.
What it is
SOAR = Security Orchestration, Automation and Response. It runs saved step-by-step plans, called playbooks, across your security tools.
| Word | Simple meaning |
|---|---|
| Orchestration | Making many tools work together, like email, EDR and firewall. |
| Playbook | A saved list of steps the tool runs for a type of alert. |
| Enrichment | Adding extra facts to an alert, like "is this IP known bad?". |
| Human in the loop | A step where a person approves before a big action. |
| SIEM | SOAR |
|---|---|
| Collects logs and raises alerts (Chapter 31.3) | Takes action on those alerts |
| Tells you something happened | Does the response steps |
| Watching | Acting |
How to use it
- Pick one alert type you handle often, like phishing.
- Write the steps you do by hand, in order.
- Turn safe, sure steps into an automatic playbook.
- Keep a human approval step before big actions, like isolating a host.
- Test it on past alerts before going live.
- Review and improve the playbook often.
Worked examples
Worked example 1: Phishing report (simplest)
- A user reports a suspect email.
- The playbook checks the sender and links against threat lists.
- It searches other inboxes for the same email.
- It shows the analyst a summary, who clicks approve to delete it everywhere.
Worked example 2: Block a known-bad IP
- A SIEM alert names an IP already on a threat list.
- The playbook adds the IP to the firewall block list.
- It writes a note in the ticket, so there is a record.
Worked example 3: Auto-isolate on high-confidence malware
- EDR flags clear ransomware behaviour on a laptop.
- The playbook asks the analyst to approve isolation.
- On approval, it tells the EDR to isolate the host at once.
- It opens a ticket and pages the on-call engineer.
Real incident: the 2024 CrowdStrike outage and the value of staged automation
1. What happened
On 19 July 2024, a faulty CrowdStrike update crashed about 8.5 million Windows machines at once (Chapter 31.8). It spread fast because it went everywhere together.
2. The lesson for SOAR
- Automation is powerful, so a wrong action also spreads fast.
- Keep a human approval step for actions that hit many machines.
- Test playbooks and roll changes out in stages.
3. How to stay safe
- Automate small, sure steps first.
- Add approvals for wide or risky actions.
- Log every automatic action so you can undo it.
In short
- SOAR runs saved playbooks to respond to alerts automatically.
- A SIEM detects; SOAR acts.
- Keep a human approval step for big actions.
- Automate the boring repeats, not the hard judgement.