https://lesitedefrancois.be/en/tags/orchestration/Recent content in Orchestration on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/soar/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/soar/<p><strong>SOAR (Security Orchestration, Automation and Response)</strong> is the actuation complement to a <strong>SIEM</strong>: where the SIEM detects and alerts, SOAR responds and acts. It receives alerts — primarily from the SIEM, but also directly from EDR platforms, vulnerability scanners, cloud security posture tools, and CNI/container security platforms — and executes structured response <strong>playbooks</strong>: predefined, branching workflows that enrich the alert with additional context from connected systems, make automated or human-gated decisions based on that context, and issue remediation actions across the organisation&rsquo;s security tooling. The three pillars of SOAR are <strong>orchestration</strong> (connecting disparate security tools into a unified, API-driven workflow so they exchange data and coordinate actions without human clipboard-copying), <strong>automation</strong> (executing repeatable investigation and containment steps at machine speed, consistently and without analyst fatigue), and <strong>case management</strong> (tracking the full lifecycle of a security incident — detection, triage, investigation, containment, eradication, recovery, and post-incident review — in a structured, auditable record). Leading platforms include Splunk SOAR (formerly Phantom), IBM QRadar SOAR (formerly Resilient), Palo Alto XSOAR (formerly Demisto), Microsoft Sentinel with Playbooks (Logic Apps), and open-source options such as TheHive with Cortex.</p>