Myth Busted: SOAR is Only About Orchestration and Automation
Gartner • Oct 9, 2020
One of the most common myths surrounding SOAR is that it purely does the function of orchestration and automation alone. To debunk this myth, let us start by defining what SOAR is. SOAR stands for Security Orchestration, Automation, and Response. As per Gartner’s definition in its 2020 Market Guide for SOAR, SOAR solutions are the merging of three distinct technologies, not just orchestration and automation:
-
Security incident response platforms (SIRPs)
-
Security orchestration and automation (SOA)
-
Threat intelligence platforms (TIPs)
Let’s take a closer look at each of these technologies. Security incident response platforms (SIRPs)involve case and incident management, process workflows, and incident knowledgebase to counter threats and coordinate effective response on a case-by-case basis. Security orchestration and automation (SOA) include technological integrations, processes, playbooks, and workflow automation. Lastly, threat intelligence platforms (TIPs) include aggregation, curation, and distribution of threat intel, alert enrichment, and threat intel visualization.
Security orchestration and automation can provide a big boost to increasing the speed and efficiency of security teams, but many are looking to also increase accuracy, collaboration, context, and analytics. By combining these three tools (SIRP, SOA, and TIP) organizations can improve their security operations by standardizing processes, automating manual workflows, improving alert triage and prioritization, and leveraging timely threat intelligence in incident response, SOC automation, vulnerability management, and more.
Over the years, security analysts have taken a reactionary approach by focusing on incidents instead of threats, hence resulting in higher MTTRs. By moving to a proactive approach, it becomes necessary to include a true SOAR solution with cyber fusion and threat response capabilities in one’s security plan. Cyber fusion and threat response solutions help organizations / Incident response teams to draw contextual intelligence on complex threat campaigns, identify potential attacker trajectory, and establish hidden threat patterns. These solutions do this by uncovering correlations between seemingly isolated threats and incidents. This, in combination with security automation, results in lower MTTRs and MTTDs.
By combining Cyware’s solutions for threat intelligence sharing and analysis (CSAP and CTIX), with threat response (CFTR) and security orchestration (CSOL), we offer not only a complete SOAR solution but the future-focused technology required to build a virtual cyber fusion center for organizations.
Want to read Gartner’s 2020 Market Guide for Security Orchestration, Automation, and Response Solutions? View and download it here, courtesy of Cyware.
