{"id":16272,"date":"2026-06-24T03:31:54","date_gmt":"2026-06-24T07:31:54","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&p=16272"},"modified":"2026-06-24T07:52:42","modified_gmt":"2026-06-24T11:52:42","slug":"soar","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/ko\/cyber-glossary\/soar-security-orchestration-automation-response\/","title":{"rendered":"SOAR (Security Orchestration, Automation, and Response)"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is SOAR (Security Orchestration Automation and Response)?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SOAR stands for Security Orchestration Automation and Response. In cybersecurity, SOAR is a category of security technology that helps security teams connect different tools, automate repetitive investigation tasks, and coordinate incident response from a central platform. A SOAR platform<\/a> is commonly used by security operations teams to improve threat management, reduce alert fatigue, accelerate threat detection and response, and standardize how incidents are handled across the organization.<\/span>\u00a0<\/span><\/p>

SOAR security is especially important for modern security operations centers because analysts often work with large volumes of alerts from SIEM, EDR, email security, cloud security, identity, firewall, vulnerability management, and threat intelligence tools. Without SOAR automation, many of these alerts must be reviewed, enriched, prioritized, escalated, and documented manually. SOAR cybersecurity capabilities help convert these manual steps into repeatable workflows so teams can respond faster and more consistently.<\/span><\/p>

SOAR is a security operations technology that combines orchestration, automation, and response into one coordinated workflow. It helps security teams bring together\u00a0disconnected tools, automate routine actions, and manage the full lifecycle of a security incident.<\/span>\u00a0<\/span><\/p>

In practical terms, SOAR acts as a coordination layer for security operations. It can ingest alerts, enrich them with threat intelligence, assign severity, trigger SOAR playbooks, open incident cases, notify analysts, run containment actions, and record what happened. This makes SOAR useful for incident response, SOC automation, threat intelligence management, vulnerability management, and broader cybersecurity automation.<\/span>\u00a0<\/span><\/p>

A SOAR platform does not usually replace existing security tools. Instead, it connects them. For example, a SOAR tool<\/a> may receive an alert from a SIEM, check indicators of compromise against a threat intelligence platform, query endpoint data from an EDR system, create a ticket in an IT service management tool, and trigger a firewall block or identity action if the threat is confirmed.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t