Skip to content

Understanding SOAR

Security Orchestration, Automation, and Response (SOAR) connects security tools and executes repeatable workflows. It helps teams enrich alerts, coordinate decisions, perform approved response actions, and preserve an audit history.

What you will learn

By the end, you should be able to explain how a SOAR playbook works, place a safe human-approval boundary, handle a failed action without repeating containment, and judge automation by its safety and reliability.

What is SOAR?

Core concept

A SOAR platform receives a trigger, gathers context from connected tools, follows documented decision logic, and coordinates approved response work. It is most useful when the workflow is repeatable, observable, and safe to recover when a step fails.

TriggerContextDecisionActionAudit record

Keep in mind: SOAR automates a process—not judgement, evidence quality, or authority. Every action still needs a defined owner, scope, permission boundary, and recovery path.

PlaybookThe documented workflow and its branches IntegrationA controlled connection to another tool Approval gateA pause for an authorised human decision

Orchestration, automation, and response

1 Orchestration Connect tools, APIs, data, and teams so information and actions can move between them.
2 Automation Execute validated, repeatable steps without requiring an analyst to perform each one manually.
3 Response Apply a decision to the incident, notify stakeholders, and record the result.

What SOAR is not

SOARCoordinate repeatable response workflows
SIEMDetect and correlate security activity
SIRPManage evidence, ownership, and decisions
Connected toolsRemain the source of their data and actions
Human authorityOwns disruptive or high-impact decisions

Connected, but not interchangeable

A SIEM commonly creates the alert, a SIRP holds the case, and SOAR moves information and approved actions between tools. SOAR does not make weak evidence reliable or grant permission to act.

Why SOAR matters

Connect tools

Move evidence and actions between security products without repeated copy and paste.

Reduce repetition

Automate validated, routine steps so analysts can focus on decisions and exceptions.

Control response

Use approvals, exact scope, and rollback plans before disruptive actions occur.

Preserve evidence

Record inputs, decisions, actions, results, and errors in a reviewable audit trail.

How a playbook works

A playbook moves from evidence to a recorded outcome. Approval protects potentially disruptive actions.

  1. ReceiveAccept the alert and confirm that the required fields are present and valid.
  2. EnrichGather relevant threat, identity, asset, and reputation context from connected tools.
  3. DecideEvaluate the available evidence and select the branch defined by the playbook.
  4. ApprovePause for an authorised analyst before making a potentially disruptive change.
  5. ActPerform the approved response action using the exact target and scope recorded.
  6. RecordPreserve the inputs, decision, action, result, and any errors in the case.

Build and run a response playbook

Review a suspicious-email case, choose safe automation, approve a bounded action, and recover without repeating containment.

Try it: contain only what the evidence supports

Complete all four stages. This exercise rewards a controlled, reviewable response—not the largest or fastest action.

Synthetic training case · SOAR-1042Contain a confirmed phishing campaignTwelve matching messages are present. No recipient has opened the attachment.
Step 1 of 4
  1. 1Evidence
  2. 2Design
  3. 3Approve
  4. 4Run and recover

Review the evidence. Open all three records to confirm confidence and exact scope.

ReadyReview the evidenceOpen all three evidence records before continuing.
Exercise debrief

Automate read-only work, approve disruptive actions, and recover without repeating completed steps.

What makes SOAR useful

Start with an automation question

Can this repeatable response workflow run safely?

  1. 1Select workChoose a repeatable task with a clear owner and outcome.
  2. 2Validate inputsCheck alert fields, API results, permissions, and representative cases.
  3. 3Control actionApprove disruptive changes and record exact scope and rollback.
  4. 4Verify and recoverConfirm the outcome and resume safely from any failed step.
Plan for operational friction
Invalid inputsExpired credentialsAPI outagesApproval delaysRepeated actionsUnclear ownership

A successful API call is not the same as a successful outcome. Verify the target changed as intended, preserve completed results, and keep a tested manual fallback.

Security automation platform in this kit

Shuffle is the SOAR platform used in this kit. It provides a visual workflow builder for connecting security products and APIs.

Visual, team-owned automation

Shuffle

Choose it when: Your team is ready to design, test, and maintain its own security workflows.

Workflow: Triggers, application actions, conditions, variables, and branches.

Strength: Open-source automation with existing applications and custom API connections.

Plan authentication, secrets, permissions, workers, upgrades, logging, and failure monitoring before using disruptive actions.

Start with one safe workflow

Begin with read-only enrichment and case updates. Add approval-gated response actions only after the workflow and its failure path are tested.

Continue learning