# What is Security Orchestration, Automation and Response (SOAR)?

> Security orchestration, automation and response (SOAR) is a capability for coordinating security tools, case data, and repeatable workflows.

- Canonical URL: https://yellowcube.eu/glossary/security-orchestration-automation-and-response/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It lets a security team represent a process as a playbook, automate suitable steps, and preserve human approval for decisions that require judgment or could disrupt the business.

A SOAR workflow might enrich an alert with asset and identity context, check indicators against intelligence sources, open a case, request approval, and then block an address or isolate a host. Automation is most valuable for well-understood, high-volume actions with reliable inputs.

The usual maturity path is enrichment first and containment later: fully automated blocking earns trust only after the same playbook has run safely under human approval. Reversibility is the design boundary — automated steps should either be easy to undo or gated behind explicit sign-off, because a fast wrong action at machine speed creates its own incident.

### Key points

- **Primary purpose:** Make security operations faster, more consistent, and easier to audit.
- **Good candidates:** Enrichment, evidence collection, notifications, ticket updates, and reversible containment actions.
- **Governance need:** Playbooks require owners, testing, access controls, error handling, change management, and outcome measurement.
- **Important limitation:** Automation amplifies flawed logic as efficiently as sound logic; unsafe playbooks can block legitimate activity or destroy evidence.

### Related terms

[Security information and event management (SIEM)](<https://yellowcube.eu/glossary/security-information-and-event-management/>) · [Security operations center (SOC)](<https://yellowcube.eu/glossary/security-operations-center/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Security playbook](<https://yellowcube.eu/glossary/security-playbook/>) · [Extended detection and response (XDR)](<https://yellowcube.eu/glossary/extended-detection-and-response/>)

### Sources

[NIST SP 800-61r3: Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) · [NIST SP 800-215: Guide to a Secure Enterprise Network Landscape](https://csrc.nist.gov/pubs/sp/800/215/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.