The Most Common SOAR Use Cases

How SOAR platforms are used in (and beyond) the SOC

Security orchestration, automation and response (SOAR) technology has grown in popularity in the security operations industry, and for good reason. SOAR platforms are designed to help SOC teams automatically execute repetitive tasks, such as responding to phishing alerts, SIEM, or EDR alert triage. That means less time performing manual tasks and more time responding to high-complexity alerts. When analysts’ time is freed in favor of more strategic work, it helps to improve job satisfaction and retain highly sought-after security practitioners.

How is SOAR most often used?

SOAR platforms are most often used to address tasks in the SOC, by integrating a variety of tools (security orchestration) and automatically executing those tasks at machine speed (security automation). The degree of automation is completely customizable, from fully automated to fully manual – or a hybrid of both.

Learn more about SOAR platform architecture in our Beginner’s Guide to SOAR Products.

Common SOAR use cases often involve incident response automation like managing phishing attempts and containing malware. SOAR platforms also expedite security processes like threat hunting and patching/remediation.

Threat hunting

Slow, manual processes limit a SOC team’s proactive threat hunting capabilities. Most threat research typically includes collecting evidence by manually drilling down into logs and accessing multiple third-party systems. Fortunately, threat hunting can be improved with SOAR solutions. SOAR automates the analysis, correlation, and enrichment of data from those logs, significantly improving the speed of the threat research process.

For example, a threat hunter might normally have to go into a SIEM application and search through dozens of different logs, then download the results for analysis. A SOAR platform can perform all those steps automatically without human intervention. As a result, analysts can then spend more time hunting new threats and getting ahead of advisories.

Managing phishing attempts

Millions of phishing emails are sent every day, leading to increasingly-damaging attacks. For a typical organization, it can take between 10 to 45 minutes to manually triage just one of these suspected emails. It’s nearly impossible for SOC teams to investigate every phishing attempt that targets their company.

When you use SOAR to combat phishing attacks, your incident response processes are clearly defined and consistently executed. Rather than relying on human intuition, SOAR tools bring rigorous logic that speeds up response times and reduces human error. It’s also possible to automate containment based on observed behaviors, rather than waiting until a phishing attempt is reported or discovered by your security team. SOAR automates the investigation process and quarantines suspected emails so your SecOps team can focus on bigger threats that require more intense investigation.

Malware containment

Malware detection is often manual and unstructured, requiring hours to identify it across multiple endpoint sources and then quarantine devices that have been infected. With SOAR, this process can be automated. As soon as malware is detected on one endpoint, it can be immediately checked against other endpoints to see if they have been infected as well. If an infection is identified, the platform can quarantine potentially infected devices before they spread across the network.

Patching & remediation

The idea of using SOAR platforms for patching systems may not seem exciting, but it’s an underrated use case with great potential. Utilizing SOAR to monitor and automatically apply patching management removes the mundane cycle of manually monitoring and updating patches. Not only does this save time for the SecOps team, but also dramatically reduces an organization’s risk of falling victim to a successful attack.

SOAR platforms also grant access to valuable information about vulnerabilities in an organization. Security flaws like missing patches, errors in firewall rules, and misconfigured encryption settings are made visible, allowing your team time to address vulnerabilities efficiently.

The future of SOAR

It’s safe to say that SOAR platforms will continue to change at a rapid pace to tackle growing security threats and changes in the security landscape. Low-code security automation solutions will gain even more popularity to combat analyst burnout and difficulty hiring qualified talent.

A major next step in SOAR security will be extending use cases beyond the SOC. Unconventional use cases have already become more prevalent – onboarding and offboarding, mobile phishing, and brand impersonation, to name a few. Watch our webinar to learn more about Unexpected SOAR Use Cases.

SOAR platforms eliminate much of the grunt work that security operations teams have to deal with every day. It enables them to focus on the newest and most pressing security risks, which are rapidly changing. The list of SOAR use cases will only continue to grow, both in and beyond the SOC. The end result will be a better, faster, and more resilient response to threats.