Inhalt
IT security teams usually have to keep track of numerous, disparate security tools in order to stem the tide of threats. Each alert from the respective software must be monitored, analyzed and interpreted. Cybersecurity automation is critical to managing this constant stream of threats. Security Orchestration, Automation and Response (SOAR) systems provide a platform to efficiently handle incoming alerts from disparate IT security systems across the enterprise.
How SOAR works
SOAR systems bring together all the relevant information needed to process a potential IT security incident. For the initial alarm, SOAR systems obtain information from a SIEM, EDR or NDR system. It is also possible to connect to an email inbox for phishing analysis. For further contextualization, the alarm is enriched with public threat intelligence information, results from file analysis tools or internal databases. Furthermore, SOAR offers the possibility to react automatically to alarm messages via the connected systems and to initiate appropriate protective measures. The deactivation of user accounts, the isolation of affected hosts or the automatic creation of domain block lists can be mentioned here as examples.
Playbooks are used within the SOAR system for the automatic processing of alarms. These contain, related to the respective use case, a defined sequence for information collection, analysis and reaction. Playbooks can react to different results within the analysis process and initiate corresponding action steps. Playbooks can be compared to the structure of a runbook for analysis, but work through the necessary steps automatically.
The main advantages of SOAR for security teams
SOAR, which is integrated into the company, is, along with a SIEM, the central tool for handling potential security incidents.
Specifically, SOAR helps security analysts by automatically (pre-)processing information and alerts. For this purpose, it combines all security tools on one platform, combines the available information and supports the collaboration of several analysts on one case. This enables security analysts to work more efficiently and avert potential damage in a targeted manner. The SOAR also serves to document past events.
In summary, security teams achieve with a SOAR:
- Central connection of all security tools
- Automatic (pre-) processing of incoming security alarms
- Display of all relevant information at a glance
- Easy collaboration between analysts and cases
- Automatic reaction to confirmed incidents
- Continuous documentation of all events
Can SOAR replace the work of security analysts?
The SOAR system supports the work of security analysts in a targeted manner, but cannot replace them. The solution automates recurring tasks, aggregates alarms of one alarm type and reacts to threats with specific measures. It also unites all security-relevant systems in the company on one platform for central control and provides an overview for all security analysts.
SOAR systems aim to support the work of security analysts through automated processing steps and to initiate initial protective measures.
However, the final assessment of an alert remains the responsibility of the analyst.
How SOAR and SIEM work together
SOAR and SIEM complement each other in several ways, as the combination of a SIEM’s work (logging and analysis) and SOAR’s automated response can be very effective.
A SIEM system is responsible for the initial detection of potential security incidents. To do this, it first collects data from various sources and analyzes it in real time using use cases. If anomalies are detected, the SIEM issues an alarm. After the initial alarm from the SIEM system, it is the task of the security analyst to contextualize it and assess the threat to the company. If the alarm turns out to be a concrete threat, it is necessary to react accordingly within the framework of the incident response process and to initiate appropriate protective measures, such as isolating a host or blocking user accounts.
In all steps after the initial alert, a SOAR supports the security analyst in his work. This includes automating recurring analysis steps, initiating initial protective measures, centrally controlling various security tools, and continuously documenting all steps taken and their results.
How companies find the best SOAR solution
More and more companies want to improve their security process with a SOAR – but this is difficult or even impossible, especially when budgets are small or in-house IT security experts are lacking. In this case, the best solution is to implement their individual SOAR according to a modular principle. For this purpose, cyber defense experts like SECUINFRA plan the implementation and optimization of various analysis scenarios and automations together with the company. The support of a SOAR system is not a one-time task, but a continuous process in order to react to the constantly changing threat situation in the best possible way.
Conclusion
SOAR supports threat and vulnerability management, the incident response process and the automation of various security-related processes. The application of SOAR thus represents a significant tool for ensuring the IT security of companies. The solution helps to optimize coordination and collaboration between security teams, automate activities and gain a more precise overview of an organization’s security posture.
