SOAR Security Orchestration, Automation and Response
Automate SOC work — on alert: run the playbook (block IP, isolate host, gather evidence, open ticket).
Builds on top of SIEM. Tools: Palo Alto XSOAR, Splunk SOAR, Tines, Torq. Reduces alert fatigue. Modern variant: AI-based copilots that triage alerts. Handle trivial incidents fully automatically; escalate hard ones to humans.