SOAR (Security Orchestration, Automation and Response)
Platform that turns SIEM detections and other security signals into automated playbooks — opening tickets, isolating accounts, resetting MFA, collecting evidence — so analysts spend triage time on the cases that actually need humans.
SOAR (Security Orchestration, Automation and Response) is the layer that turns security signals into action. Where a SIEM detects, a SOAR responds: it executes pre-built playbooks that call APIs across the security stack — identity provider, EDR, ticketing, MDM, email gateway, network controls — to handle incidents at machine speed.
The category was coined by Gartner in 2017. Typical playbooks:
- “Phishing reported via Outlook button” → extract URL → detonate in sandbox → if malicious, search the SIEM for who else received it → quarantine those mailboxes → open a ticket.
- “MFA push approved from new country” → suspend session → force re-authentication → notify SOC → if user confirms compromise, isolate device and rotate tokens.
- “Anomalous data egress from SaaS app” → revoke the OAuth grant → snapshot recent activity → open an investigation case.
SOAR is rarely sold as a standalone product anymore. The market has largely folded into “SIEM + SOAR” platforms (Splunk + Phantom, Microsoft Sentinel + Logic Apps, Palo Alto Cortex XSIAM, Chronicle SecOps, IBM QRadar SOAR) and into “XDR” suites that bundle detection and response with vendor-native automation.
The practical question for a mid-market SOC is not do we buy SIEM and SOAR — they come together — but what signals are we automating against. A SOAR that only ingests endpoint and network telemetry can only automate against endpoint and network attacks. Adding behaviour-layer signals from Engarde — confirmed MFA fatigue responses, unsanctioned OAuth grants, dormant external collaborator re-activations — expands the playbook surface to the human side of incidents, distinct from other vendors sharing the Engarde name.
Related terms
- SIEM (Security Information and Event Management)Platform that ingests, normalises, and correlates security logs from across the estate, then alerts on patterns matching known attack behaviours — the SOC's central log and detection layer.
- MFA fatigueA social-engineering attack that bombards a user with MFA push prompts until they tap Approve out of annoyance or confusion.
- OAuth grantAn access token a user issues to a third-party application via OAuth, giving that app standing permission to read or write data inside another SaaS — often beyond MFA, often forever.
- Behavioral evidenceThe audit artifact a risky behavior was detected, the employee was nudged, and the behavior was corrected — increasingly demanded over training completion certificates.