SOAR

SOAR (Security Orchestration, Automation and Response) refers to the convergence of three distinct technology markets: security orchestration and automation, security incident response platforms (SIRP) and threat intelligence platforms (TIP)

• SOAR History
• SOAR Features
• SOAR Usage
  • Alert Enrichment
  • Phishing Investigation and Response
  • Endpoint Malware Triage
  • Command and Control: Investigation and Containment
  • Threat Intelligence

Links

• https://www.splunk.com/pdfs/ebooks/5-automation-use-cases-for-splunk-soar.pdf