SOAR
A category of security operations products that automates the handling of security alerts and incident response workflows through predefined playbooks, combining security orchestration, automation, and response capabilities.
Timeline (last 90 days)
Agentic security means security controls are driven by agents with goal understanding, autonomous planning and tool-calling capabilities, unlike traditional SOAR orchestration or automation scripts that execute fixed playbooks.
SOAR (Security Orchestration, Automation and Response) builds on top of SIEM by orchestrating actions such as queries, blocking and ticketing into automated processes through playbooks.
SOAR's limitation is that playbooks are pre-written directed flows with poor adaptability to unknown or variant attacks, and once branch conditions exceed the preset scope, manual intervention is required.
The core of traditional SOAR (Security Orchestration, Automation and Response) is predefined playbooks, where when a certain type of alert is triggered, the system executes a fixed process written in advance by humans.
In the 'SOAR + chatbot' model, the LLM layer typically handles three things—summarization, recommendations, and Q&A—but does not participate in or change how the playbook itself is executed.
SOAR platforms emerged around 2015, initially created to address the 'alert fatigue' problem faced by SOC teams.
SOAR (Security Orchestration, Automation and Response) is currently the most mainstream type of automation platform in SOCs, automatically handling tasks such as alert triage, ticket creation, and threat intelligence queries through pre-written playbooks.
The core limitation of SOAR is that all automation logic must be written in advance by humans, and when faced with novel or unanticipated attack scenarios, the system can only stop and wait for manual intervention.
Tines is a company focused on the security automation (SOAR — Security Orchestration, Automation and Response) space.
The developer mentioned that related research directions include the cognitive architectures ACT-R and SOAR, emotional modeling in reinforcement learning, and developmental psychology.
1 more timeline events
All Facts (11)
Agentic security means security controls are driven by agents with goal understanding, autonomous planning and tool-calling capabilities, unlike traditional SOAR orchestration or automation scripts that execute fixed playbooks.
50%UnverifiedSOAR (Security Orchestration, Automation and Response) builds on top of SIEM by orchestrating actions such as queries, blocking and ticketing into automated processes through playbooks.
50%UnverifiedSOAR's limitation is that playbooks are pre-written directed flows with poor adaptability to unknown or variant attacks, and once branch conditions exceed the preset scope, manual intervention is required.
50%UnverifiedThe core of traditional SOAR (Security Orchestration, Automation and Response) is predefined playbooks, where when a certain type of alert is triggered, the system executes a fixed process written in advance by humans.
50%UnverifiedIn the 'SOAR + chatbot' model, the LLM layer typically handles three things—summarization, recommendations, and Q&A—but does not participate in or change how the playbook itself is executed.
50%UnverifiedSOAR platforms emerged around 2015, initially created to address the 'alert fatigue' problem faced by SOC teams.
50%UnverifiedSOAR (Security Orchestration, Automation and Response) is currently the most mainstream type of automation platform in SOCs, automatically handling tasks such as alert triage, ticket creation, and threat intelligence queries through pre-written playbooks.
50%UnverifiedThe core limitation of SOAR is that all automation logic must be written in advance by humans, and when faced with novel or unanticipated attack scenarios, the system can only stop and wait for manual intervention.
50%UnverifiedTines is a company focused on the security automation (SOAR — Security Orchestration, Automation and Response) space.
50%UnverifiedThe developer mentioned that related research directions include the cognitive architectures ACT-R and SOAR, emotional modeling in reinforcement learning, and developmental psychology.
50%UnverifiedSOAR platforms introduced predefined Playbooks to automate security response processes, while XDR attempts to connect multi-source data across endpoints, networks, and the cloud to enable correlation analysis.
50%