Security Orchestration, Automation and Response (SOAR)
Gartner defines SOAR as solutions that combine incident response, orchestration and automation, and threat intelligence platform management capabilities in a single solution.
SOAR tools can be used for many security operations tasks, including:
Documenting and implementing processes, supporting security incident management.
How does it work?
Data entry
The input commands define the sources of information (Lynx, SIEMs, databases, files, APIs, among others) from which the data will be extracted for the evaluation.
Data processing and transformation
The processing commands are used to select and process the raw data in order to contextualize the situation using filters, correlations with other sources, counting and various other tools.
Response, orchestration and automation
The outgoing commands initiate the response based on the results of the processing, such as sending emails, notifications, alarms, creating FW rules, among others.
Zerum Okami highlights
Playbooks for immediate action
Playbooks offer a standardized response and processes for cyber security incidents and describe the steps from detection to the conclusion of the incident, considering all
the phases of the Cyber Kill Chain.
Automation with a few clicks
Users are provided with graphical tools to facilitate the creation, implementation and application of Playbooks, with an extensive library of pre-configured scripts for the rapid composition of comprehensive Playbooks.
Tailor-made execution for each scenario
Different settings to define parameters such as the frequency and time of execution, the priority of the findings, among others.
Fast returns, in one place
The results screen brings together the feedback from the Playbooks you’ve run, so you can consult the information quickly and centrally. Few clicks, lots of effect.
Complete library of use cases
The Playbooks library covers a wide variety of use cases, made up of several scripts that work together to deliver the result.
Easy and reusable customization
If the user needs a customized script, the graphical interface allows quick testing of scripts and subsequent storage to use the same logic in other contexts.
Questions and answers
Do you want expert support
to identify and eliminate cyber threats?
We’re here
to help you.
