SOAR is a frequently used word these days in the world of cyber security which comprises of, Security Orchestration, Automation and Response. As cyber security threats increase in volume and veracity, SOCs are struggling to synchronize the many tools, employees, and data silos in their organisation.
A SOAR platform provides a means of enabling human and machine tasks to be woven together for unified orchestration that centralises operations for efficiency, effectiveness, and simplifies many of the operational processes akin to a SOC’s day to day activities.
SOAR operationalises the incident response processes via playbooks or workflows which help identify malicious behaviours or intent and can then orchestrate the next steps in threat mitigation or remediation depending on where in the kill-chain the activity has been identified
Whether or not a traditional SIEM (Security Incident Event Monitoring) is in place to amalgamate and correlate security event data from a variety of log sources (e.g. network infrastructure such as firewalls, load balancers or end user machines), a SOAR platform can be the key to identifying a potential threat before it transcends into a “real” threat.
SOAR platforms can be used to integrate with a SIEM or a disparate set of systems/tools in order to obtain the crucial early warning signs that malicious or suspicious activities are being performed by threat actors.
The key objectives for any SOAR platform are to:
- Rapidly uncover and disrupt complex cyber-attacks via orchestration.
- Assign and track tasks to analysts based on custom benchmarks, roles and responsibilities.
- Capture key custodians, digital and physical evidence for forensic analysis.
- Drive efficiency and flexibility of processes associated to incident response.
- Provide the data required to create the detailed metrics as part of the incident lifecycle.
As part of the kill-chain analysis during the incident lifecycle the MITRE ATT&CK® framework was introduced. MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
Establishing the right metrics and demonstrating performance
through trend reporting are critical for SOC managers. D3 provides a report library, plus a slice-and-dice report-builder that allows you to
track any number of proactive and reactive metrics, which can be easily exported directly to Snowflake or PowerBI datasets for all your data modelling needs.
