Common SOAR Use Cases

There are many use cases for SOAR, including event enrichment, intelligence processing, detection and prevention of security incidents, and automated response to incidents. These use cases align with the concept of shifting human involvement from predominately operating in the loop to being on the loop, providing a more supervisory role. SOAR can help security teams increase the speed of detection and response, allowing them to handle a greater volume of alerts. The increasing data related to security events and the complexity of that data exceed the capacity of human analysts to process quickly and effectively. Enrichment use cases can aid in analyzing and assimilating the vast amount of data involved in security incident detection. Further, security automation use cases help address the concern about the scarcity of cybersecurity professionals.