A security automation platform (also known as a security orchestration and automation platform - SOA) is employed when a threat is detected and it responds automatically. Security automation platforms have features such as:
Customized Playbook Creation
SOAR security automation platforms allow security teams to either build and customize playbooks or pick from prebuilt ones, enabling them to filter data, make informed decisions, or remind a user for input/confirmation. Organizations are moving toward low-code security automation that allows security teams to customize playbooks for any security workflow.
Streamlined Response Processes
Playbooks drive SOAR automation platforms on how to respond to threats or incidents, ensuring standardized and streamlined security operations aimed at accelerating incident response and mitigating risk. The streamlined processes can include deleting or quarantining malware-infected files, conducting geolocation lookups on IP addresses, or blocking URLs on perimeter devices.
Integration with Other Security Tools
Security automation platforms seamlessly integrate with other security assets and tools, including endpoint products, firewalls, and SIEMs. Moreover, they provide a means to monitor the entire infrastructure of an organization within one interface.