SOAR
What is SOAR?
Security Orchestration, Automation and Response platforms that combine security tool integration, workflow automation, and case management for efficient incident handling.
Terms that appear alongside soar
Each of these is named in at least one of the same controls as soar. The number is how many controls name both.
- mitre 6 shared controls
- incident response 6 shared controls
- security monitoring 5 shared controls
- threat intelligence 5 shared controls
- cloud security 5 shared controls
- threat hunting 4 shared controls
- iso 27001 4 shared controls
- internal audit 4 shared controls
Frameworks that govern soar
What the standards actually require on soar
Requirements naming soar across 6 standards, quoted from the control text.
CSF 2.0 outcome: potentially adverse events are analyzed to better understand associated activities. Priority High. R1: use tools such as SIEM and SOAR to monitor log events continuously for known malicious and suspicious activity and report findings.
nist-sp-800-61-rev-3::DE.AE-02 · DE.AE-02 Log events analyzed with SIEM or SOAR tools, current CTI and manual review →Work with popular SIEM and SOAR providers and selected customers to learn how incident responders use the product's logs, so that log entries tell a correct and complete story during an investigation instead of reflecting only what developers assumed would hel...
secure-by-design-a-guide-for-manufacturers-cisa::P1-PD7 · Test SIEM and SOAR integration →Integrate D3FEND with broader cybersecurity ecosystem and frameworks. ATT&CK-D3FEND bidirectional mappings - each D3FEND defensive technique is mapped to ATT&CK offensive techniques it counters + each ATT&CK offensive technique maps to D3FEND defensive techniq...
MITRE-D3FEND-Integration-Mapping-ATTACK-CWE-CVE-CAPEC-NIST-CSF-CIS-ISO-27001-STIX-OpenC2 · MITRE D3FEND Integration + Mapping + ATT&CK + CWE + CVE + CAPEC + NIST CSF + CIS + ISO 27001 + STIX + OpenC2 →HKMA TM-G-1 Cyber + Audit + Outsourcing + Cloud. (1) SECURITY MONITORING AND SIEM (TM-G-1.7.1) - SIEM + SOC + 24x7 monitoring + log management + correlation + use cases + alert handling + escalation + UEBA + behavior analytics + SOAR automation + threat detect...
HKMA-TMG1-Cyber-Monitoring-Threat-Intel-IR-Audit-Outsource-Cloud · TM-G-1 Security Monitoring + SIEM + Threat Intel + Cyber IR + Audit + Outsourcing + Cloud Computing Risk →ISMAP Cloud Operations covers the day-to-day security operations of cloud services. (1) Cloud Security Monitoring and Logging: 24x7 Security Operations Center (SOC) + SIEM Security Information and Event Management + UEBA User and Entity Behaviour Analytics + S...
ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA · ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management →Kuwait NCF Detect function. Security Monitoring and Logging: comprehensive logging (Identity + Network + Endpoint + Cloud + Application + Database + Privileged Access + Network Devices + Cloud Trail + Container + IoT/OT) + centralised log management + Security...
KNCF-Detect-Monitoring-SIEM-SOC-Threat-Intel-CTI-MITRE-ATT-CK-EDR-XDR-MDR-24-7-Continuous · Kuwait NCF Detect + Monitoring + SIEM + SOC + Threat Intel + EDR + XDR + 24/7 →Questions people ask about soar
What is SOAR?
Why is SOAR important for compliance?
Which compliance frameworks address SOAR?
Where can I learn more about SOAR?
See how SOAR applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.