SOAR

Problem

Your SIEM detects a compromised account at 03:00. Someone now needs to: * disable the account, * block an IP, * create an incident, * notify security. Repeating these steps manually wastes critical time.

Solution — SOAR

SOAR stands for Security Orchestration, Automation, and Response. In Azure, Sentinel can trigger a Logic Apps workflow called a playbook, which uses authorized API calls to disable an account, create a ticket, or notify the team.

Detection
   ↓
Response workflow
 → disable account
 → create ticket
 └→ notify team

SIEM detects suspicious activity and supports investigation; SOAR automates the response. Microsoft Sentinel provides both capabilities.

Core idea: SOAR automates repeatable actions following security detections.