Security orchestration, automation and response (SOAR)

The layer that turns a SOC decision into an action across the tools the organization already runs: enrich this alert from threat intel, open a case, isolate the host, notify the owner. Orchestration is the connective tissue; automation is running it without a human; response is the part that changes something.

SOAR exists because of the volume problem security-operations-center describes. Once an organization concedes that most alerts will never be read by a person, the question stops being who looks and becomes what fires, on what evidence, and who is accountable when it fires wrongly.

The two answers, and the spoke holds both

The corpus now has an instance of each, which is why this page exists as a separate node rather than a paragraph on the SOC page.

• Drawn workflows. shuffle — a graph of explicit steps an operator builds in a visual editor, integrated over OpenAPI definitions. Deterministic: inspectable before it runs, identical each time. The failure mode is brittleness — it does exactly what it was drawn to do, including when the situation has changed underneath it.
• Model verdicts. soc-fast-slow-thinking‘s autonomous System-1 triage, reaching a conclusion in under two minutes across memory scans and cross-signal correlation. Adaptive: it generalizes to alerts nobody anticipated. The failure mode is that you cannot read the decision before it happens, and the source declines to publish a false-negative rate.

These are not competing products so much as competing places to put the judgement. The drawn workflow front-loads it into design time, where it is auditable; the model defers it to run time, where it is fast and opaque. Nothing in this corpus measures which loses more incidents.

The accountability question

Response actions are not read-only. Isolating a host, revoking a credential or blocking an address has a blast radius, and an automation that misfires at machine speed does so repeatedly before anyone notices. That is the same asymmetry zero-trust tightens from the other side — per-action authorization exists precisely because the actor may be wrong or hostile — and google-beyond-zero extends it to agents for this reason. An autonomous responder is an agent acting on production infrastructure, whatever the marketing calls it.

What is missing

No source in this spoke reports what automation costs when it is wrong: no false-positive rate on automated containment, no count of actions reverted, no analyst-hours displaced. mean-time-to-adapt is the closest the corpus comes to a metric that would capture it, and it was proposed for vulnerability response rather than alert response.

Related

shuffle · security-operations-center · soc-fast-slow-thinking · defensive-security · zero-trust · google-beyond-zero · mean-time-to-adapt