Which SOAR output represents the manual steps to be taken to a threat Quizlet

What is SOAR?

SOAR platforms have three main components: security orchestration, security automation and security response.

Security orchestration

Security orchestration connects and integrates disparate internal and external tools via built-in or custom integrations and application programming interfaces (APIs). Connected systems may include vulnerability scanners, endpoint protection products, end-user behavior analytics, firewalls, intrusion detection and intrusion prevention systems (IDSes/IPSes), and security information and event management (SIEM) platforms, as well as external threat intelligence feeds.

With all the data gathered comes a better chance at detecting threats, along with more thorough context and improved collaboration. The tradeoff, however, is more alerts and more data to ingest and analyze. Where security orchestration consolidates data to initiate response functions, security automation takes action.

Security automation

Security automation, fed by the data and alerts collected from security orchestration, ingests and analyzes data and creates repeated, automated processes to replace manual processes. Tasks previously performed by analysts, such as vulnerability scanning, log analysis, ticket checking and auditing capabilities, can be standardized and automatically executed by SOAR platforms. Using artificial intelligence (AI) and machine learning to decipher and adapt insights from analysts, SOAR automation can make recommendations and automate future responses. Alternately, automation can elevate threats if human intervention is needed.

Playbooks are essential to SOAR success. Prebuilt or customized playbooks are predefined automated actions. Multiple SOAR playbooks can be connected to complete complex actions. For example, if a malicious Uniform Resource Locator (URL) is found in an employee email and identified during a scan, a playbook can be instituted that blocks the email, alerts the employee of the potential phishing attempt and blocklists the Internet Protocol (IP) address of the sender. SOAR tools can also trigger follow-up investigative actions by security teams if necessary. In terms of the phishing example, follow-up could include searching other employee inboxes for similar emails and blocking them and their IP addresses, if found.

Security response

Security response offers a single view for analysts into the planning, managing, monitoring and reporting of actions carried out once a threat is detected. It also includes post-incident response activities, such as case management, reporting and threat intelligence sharing.

Benefits of SOAR

SOAR platforms offer many benefits for enterprise security operations (SecOps) teams, including the following:

• Faster incident detection and reaction times. The volume and velocity of security threats and events are constantly increasing. SOAR's improved data context, combined with automation, can bring lower mean time to detect (MTTD) and mean time to respond (MTTR). By detecting and responding to threats more quickly, their impact can be lessened.
• Better threat context. By integrating more data from a wider array of tools and systems, SOAR platforms can offer more context, better analysis and up-to-date threat information.
• Simplified management. SOAR platforms consolidate various security systems' dashboards into a single interface. This helps SecOps and other teams by centralizing information and data handling, simplifying management and saving time.
• Scalability. Scaling time-consuming manual processes can be a drain on employees and even impossible to keep up with as security event volume grows. SOAR's orchestration, automation and workflows can meet scalability demands more easily.
• Boosting analysts' productivity. Automating lower-level threats augments SecOps and security operations center (SOC) teams' responsibilities, enabling them to prioritize tasks more effectively and respond to threats that require human intervention more quickly.
• Streamlining operations. Standardized procedures and playbooks that automate lower-level tasks enable SecOps teams to respond to more threats in the same time period. These automated workflows also ensure the same standardized remediation efforts are applied organization-wide across all systems.
• Reporting and collaboration. SOAR platforms' reporting and analysis consolidate information quickly, enabling better data management processes and better response efforts to update existing security policies and programs for more effective security. A SOAR platform's centralized dashboard can also improve information sharing across disparate enterprise teams, enhancing communication and collaboration.
• Lowered costs. In many instances, augmenting security analysts with SOAR tools can lower costs, as opposed to manually performing all threat analysis, detection and response efforts.

SOAR challenges

SOAR is not a silver bullet technology, nor is it a standalone system. SOAR platforms should be part of a defense-in-depth security strategy, especially as they require the input of other security systems to successfully detect threats.

SOAR is not a replacement for other security tools, but rather is a complementary technology. SOAR platforms are also not a replacement for human analysts, but instead augment their skills and workflows for more effective incident detection and response.

Some other potential drawbacks of SOAR include the following:

• failure to remediate a broader security strategy;
• conflated expectations;
• deployment and management complexity; and
• lack of or limited metrics.

Important SOAR capabilities

The term, coined by Gartner in 2015, initially stood for security operations, analytics and reporting. It was later updated to its current form in 2017, with Gartner defining SOAR's three main capabilities as the following:

1. threat and vulnerability management technologies that support the remediation of vulnerabilities, providing formalized workflow, reporting and collaboration capabilities;
2. security incident response technologies that support how an organization plans, manages, tracks and coordinates the response to a security incident; and
3. security operations automation technologies that support the automation and orchestration of workflows, processes, policy execution and reporting.

Gartner expanded the definition further, refining SOAR's technology convergence to the following:

• security incident response platforms, which include capabilities such as vulnerability management, case management, incident management, workflows, incident knowledge base, auditing and logging capabilities, reporting and more;
• security orchestration and automation, which include integrations, workflow automation, playbooks, playbook management, data gathering, log analysis and account lifecycle management; and
• threat intelligence platforms, which include threat intelligence aggregation, analysis and distribution, alert context enrichment and threat intelligence visualization.

SOAR vs. SIEM

While SOAR and SIEM platforms both aggregate data from multiple sources, the terms are not interchangeable. SIEM systems collect data, identify deviations, rank threats and generate alerts. SOAR systems also handle these tasks, but they have additional capabilities. First, SOAR platforms integrate with a wider range of internal and external applications, both security and nonsecurity. Second, whereas SIEM systems only alert security analysts of a potential event, SOAR platforms use automation, AI and machine learning to provide greater context and automated responses to those threats.

Many companies use SOAR services to augment in-house SIEM software. In the future, SIEM vendors are expected to add SOAR capabilities to their services, which means the market for these two product lines will merge.

Many SIEM vendors offer SOAR capabilities in their SIEM products. Other products, such as email security gateways, endpoint detection and response (EDR), network detection and response (NDR) and extended detection and response (XDR), are also adopting SOAR capabilities.

SOAR vendors

Gartner's 2020 SOAR market guide provides a list of representative vendors and their products, including the following:

What are the 3 key elements of security orchestration automation and response soar?

What is a characteristic of the SOAR security platform quizlet?

What does soar technology use to automate and coordinate workflows?

What are soar playbooks?