Security – SOAR programs automate centralized monitoring
Uncategorized February 21st, 2020SANS ISC highlights the relatively new approach of Security, Orchestration, Automation and Response (SOAR) to provide improved centralized monitoring & an almost “AI-like” response for corporate security incidents.
https://isc.sans.edu/forums/diary/SOAR+or+not+to+SOAR/25808/
Security, Orchestration, Automation and Response (SOAR) allow organizations to collect data about security threats from multiple sources to automate an appropriate response on repetitive tasks. As an analyst you need to juggle and pivot several times a day between multiple tools and devices to evaluate a huge amount information and deal with flood of repetitive tasks such as alerts, tickets, email, threat intelligence data, etc. The end goal is to centralize everything in one location to improve analysis using captured institutionalized knowledge.