logo
Technology

Introduction to SOAR

Info

Gartner has recently announced a new cybersecurity technology analysis model called Security Operations, Analytics, and Reporting (SOAR). Sometimes you may also hear cybersecurity professionals refer to it as SOAPA (security operations analytics platform architecture), perhaps because they want to teach us another cybersecurity acronym, but that is not necessary to focus on because Gartner calls it SOAR and we should too.

|
Jul 10, 2023
Introduction to SOAR

In a sense, SOAR can truly help your CSOC feel like it has wings. SOAR is a security operations and reporting platform that leverages machine-readable data from various sources to provide management, analysis, and reporting capabilities to support cybersecurity analysts. The SOAR platform applies decision-making logic, combined with context, to provide standardized workflows and enables triage (priority assignment) of cybersecurity remediation tasks. The SOAR platform provides actionable intelligence, allowing you to stay on top of your workflows.

What is the difference between SOAR and SIEM?

SIEM has been around for some time and has evolved from being a security event correlation tool to a full-fledged security analysis system. Traditionally, SIEM practices involve collecting your security logs and events to provide visibility into what is happening within your organization from a cybersecurity perspective. The evolution of the tools we use is an ongoing process, and while alerts about suspicious behavior are necessary, the primary goal is to act quickly and effectively upon those alerts. Traditional SIEM will notify you that something is happening on your network, while a SOAR platform allows you to take action based on that information. SOAR collects and consolidates all the data from your security applications and threat intelligence feeds, but its capabilities can go beyond SIEM by enabling automated response and coordination of security tasks across connected applications and processes. SOAR allows you to integrate third-party threat intelligence from various sources and simultaneously provides you with the ability to develop a playbook consisting of actionable and follow-up activities to respond to any threats.

How can SOAR help cybersecurity analysts?

Physicist William Pollard once said, "Information is a source of learning. But unless it is organized, processed, and available to the right people in a format for decision-making, it is a burden, not a benefit," and this holds true in the realm of cybersecurity. The remarkable thing about this 19th-century quote is that it succinctly describes the challenge faced by many modern CSOC teams in certain cases. Often, CSOC analysts are overwhelmed by the sheer volume of alerts and information available to them, often scattered across various systems. Much of the CSOC analyst's time is typically spent filtering and organizing information in a conducive manner for decision-making. This is where SOAR comes in and aims to relieve CSOC analysts of these tasks, enabling them to focus on higher-priority work and deliver measurable return on investment (ROI) in a relatively short time. It is worth noting that the best SOAR platforms are those that can demonstrate evidence of producing ROI, and you will typically see clear savings of 15%+ in your cybersecurity team's time.

What capabilities should a modern SOAR platform have?

Endpoint Detection and Response (EDR): After prioritizing security alerts, security analysts also want to dig deeper into incidents through endpoint monitoring and investigation. This makes EDR capabilities an important part of any SOAR platform.

Vulnerability Management: Part of the SOC analyst's job is to know which alerts need to be prioritized and managed. This decision is usually driven by the vulnerability management capabilities of the SOAR platform, based on direct data.

Threat Intelligence: Integrating SOAR into various threat intelligence platforms and sources facilitates and accelerates analysts in comparing potential threats against known threats.

Case Management-Based Incident Response: Analysts will collect, process, and analyze security data, but they also need to leverage it to prioritize alerts and respond to threats as quickly as possible. Therefore, robust incident response capabilities are important for a SOAR platform.

Playbook Management: Since SOAR is geared towards incident response, a crucial part of SOAR is the ability to create and manage playbooks that align with your incident response policies and streamline your incident response processes.

SOAR IS A KEY COMPONENT IN CYBERSECURITY EFFORTS

The growing threat of cyberattacks and the administrative burden involved in managing data security puts pressure on SOCs to prevent data breaches, operational disruptions, and reputational damage. SOAR provides a different approach to equipping cybersecurity teams—one that is not constrained by manual processes and utilizes automation, predictive analytics, and increasingly advanced AI to help identify and respond to unauthorized intruders before they gain a foothold in the network. SOAR promises to reduce the dwell time of attackers (the time it takes to detect threats after initial compromise) as well as detection and remediation times (the time between identification and response). By integrating automation, incident management, orchestration processes, visualization, and reporting into a single pane of glass, SOAR provides a fast and accurate way to process alert and log data, helping analysts identify and respond to ongoing attacks, enhancing the strength of SOC teams, and making them many times more efficient in handling their workflows.

Share this post

You may also like

A Brief History of the Internet
Technology

A Brief History of the Internet

I got hooked on computers when Oregon Trail was first released. Back then, if you wanted your computer to be useful, you had to manually code all your applications in BASIC or endure the tedious process of "blipping" sounds at it. The only alternative to typing hundreds of lines of code was to load pre-recorded cassette tapes with a series of "beeps," whistles, and instructions for your computer to follow when played back. You know, those pre-recorded "beep" sounds were EXACTLY what the internet sounded like when I first heard it. No, it's not a typing mistake. I heard the internet before I actually saw it. So much so that I still believe my cable internet is fake because it's always so quiet. No, I didn't hear the internet because I'm some kind of internet whisperer. We ALL heard the internet before we actually used it. Its arrival was heralded by a series of high-pitched screeches and digital buzzing that came through your telephone line. That's how

AdministratorAdministrator
|
Jul 09, 2023 9 minutes read
Guide to Open Source Intelligence (OSINT)
Technology

Guide to Open Source Intelligence (OSINT)

Tips
Hacks

OSINT can enable you to see further, and this can bring significant benefits to your business, such as protecting you from threats, providing insights into your competitors' strategies, and helping you understand partners and individuals before investing in them. Most importantly, OSINT is an important investigative tool for lawyers, detectives, law enforcement personnel, and anyone with a need to gather intelligence and investigate a subject. This article, the first in a series I'm writing on OSINT, will explain what OSINT is and how you can use OSINT to your professional advantage because we can all benefit from looking deeper and knowing more rather than just assuming. INTRODUCTION Over time, the internet has transformed the world into a very small place. The widespread access to the internet by billions of people worldwide for communication and the exchange of digital data has ushered in the "information age." In this information age, the term open-source intelligence (OSINT) refers to all publicly available information that you can see, and some parts that you can't

|
Jul 10, 2023 8 minutes read
This is Why You Need Cybersecurity Honeypots!
Technology

This is Why You Need Cybersecurity Honeypots!

How can we know this? Just like how we can learn about most global cyber threats, the techniques used, the timing chosen, and the tools utilized, the answer lies in honeypots. Honeypots are information system resources whose value lies in the unauthorized or illegal use of those resources, meaning they prove their worth when a hacker attempts to interact with them. Honeypot resources are typically disguised as network servers, appearing and feeling like legitimate servers, but in reality, they are traps used to lure unauthorized intruders. How did analysts discover EternalRocks? It happened because of the presence of honeypots. It's a creative game of cat and mouse that sets clever traps. The adversaries who come either try to outsmart the trap or recognize something suspicious and avoid it, or in some cases, sabotage it. This was humorously responded to by one researcher who wrote a tweet entertaining many, saying, "For those of you who know my honeypot is a honeypot, can you stop placing Pooh bear (honey) pictures on it?" Please

|
Jul 09, 2023 5 minutes read

Receive weekly
updates on new posts

Subscribe