About cookies on this site Our websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising. For more information, please review your options. By visiting our website, you agree to our processing of information as described in IBM’sprivacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here.
Use Cases
Using apps to integrate with your existing IT security solutions, the SOAR platform provides a centralized platform for cyberattack investigation and remediation. Orchestrated response with intelligent automation across tools unlocks the value of your cyber security investments and makes your team smarter and faster.
There are levels of integration from the relatively simple to more complex and tightly integrated systems. The level of integration depends on your use case.
Monitoring and Escalation
When a significant event occurs, applications connect to the SOAR platform using the REST API to escalate incidents from email, SIEMs, ticketing systems, and other sources, and include artifacts such as IP addresses, file hashes, URLs, usernames and machine names.
The App Exchange contains two such apps, QRadar integration and Splunk Add-on.
Identification and Enrichment
Automatic threat intelligence lookups, workflows and menu-driven actions deliver valuable context, reduce time to identify scope and impact, enabling a rapid, decisive response. Trigger sandbox evaluation and build rules to act on the results. Search logs and endpoints and make decisions based on the data. Include Configuration Management Database (CMDB) and directory information to help analysts make accurate assessment of severity and impact. Pivot on these critical data elements to dynamically adjust the way your team responds.
Click here for a list of threat intelligence apps.
Containment, Response and Recovery
Based on trigger conditions, or based on manual actions, the system can send notifications or initiate external activities to contain and adjust your security posture as a part of your response playbook. The Ansible for SOAR is an example of this type of app.
Communication and Coordination
By integrating beyond the SOC, users can coordinate a fast and effective incident resolution from the platform. Integrate bi-directionally with ticketing and service management, smart notifications, communication platforms and other business applications. Email is a good simple example of the communication and coordination aspect. See the description of the Outbound Email for SOAR.