Protecting against cyber threats continues to be an evolving challenge. Adversaries are developing rapidly advancing and complex tactics to compromise enterprise systems and networks. The number and complexity of the systems needed to conduct defensive cyber operations is also increasing at an exponential rate. The solution space abounds with technology to find and mitigate threats. Organizations are turning to artificial intelligence or AI to aid in their mission to counter adversary cyber threats by helping identify patterns in enterprise attacks. The key benefit of AI is its ability to make mitigating decisions faster and at the scale required of today's digital ecosystem. Organizations are also adopting security, orchestration, automation, and response or SOAR platforms into their protective architecture for faster actions at the required digital scale. Threat identification and mitigation can occur faster and with greater efficiency and consistency through increased orchestration of automated delegated tasks. Combining faster action from SOAR with faster decisions from AI will yield the type of response needed to not only mitigate but anticipate sophisticated cyber threats. The Integrated Adaptive Cyber Defense Team, or IACD, conducted research to understand how to combine SOAR with AI. The team investigated how to bridge these technologies while maintaining human control. Key objectives of the research were to leverage the strengths of both SOAR and AI platforms to create a more modular architecture that simplifies decision making while maintaining the system's ability to adapt its responses. The IACD team achieved this by identifying high-level desired outcomes known as cyber effects from a decision-making platform as inputs to a SOAR platform. These outcomes describe the net effects without having to specify the exact steps or actions to execute encountering a threat. Once an effect is selected after an event, additional information is gathered and a set of policies applied. The combination of the desired effect, contextual information, and predefined policies allows for the selection of appropriate effects-based courses of actions, or COAS. IACD utilized Dark Light, an AI expert system as a primary decision-maker within a defensive cyber operations workflow. In the effects-based COAS experiment, these scenarios demonstrated tasks within Dark Light to distinguish between two types of malicious software. One that executed data exfiltration, and the other that contained characteristics of ransomware. Dark Light determined the desired cyber effect for each triggered malicious behavior. The scenario also utilized orchestration workflows for three separate cyber effects. Detect, recover, and contain. By implementing an effects-based COA approach to the workflow, the experiment leveraged the strengths of both the decision-making and SOAR platforms. By dividing up the responsibilities, the overall workflow was more modular, which simplified the development, testing, and implementation in each platform. Defining effects-based COAs gives network defenders the tools they need to bridge the gaps between SOAR, AI, and human users for a better and faster decision-making process to counter today's cyber threats. For more information on how to utilize SOAR to defend your networks, visit IACDautomate.org.