A SOAR platform detects a malware alert from the EDR agent and automatically coordinates a response across multiple tools: it instructs the firewall to block the malicious IP, tells the EDR to isolate the infected host, and opens a ticket in the ITSM system, all as part of a single unified workflow. Which capability of the SOAR platform is best illustrated by coordinating actions across these different security tools?
- AVirtualization
- BOrchestration
- CFederation
- DAutomation
Show answer & explanationAnswer & explanation
Correct answer: B. Orchestration
Orchestration refers to the coordination of multiple disparate security tools and systems to work together as part of a unified response workflow. Automation refers to executing a single repetitive task without human intervention (such as one tool running one script), federation relates to identity trust relationships between organizations, and virtualization refers to abstracting hardware resources—none describe multi-tool coordination.
Why the other options are wrong
- A. Virtualization abstracts computing resources, unrelated to security tool coordination.
- C. Federation relates to trust between identity providers, unrelated to tool coordination.
- D. Automation is executing a single task automatically, not coordinating multiple distinct tools.
SOAR Orchestration
The coordination of multiple different security tools and systems to work together within a single automated workflow, as opposed to automating just one task.
- Orchestration = coordinating many tools together
- Automation = executing one repetitive task
- Together they form the core of SOAR platforms
Memory trick: Orchestration is a conductor 🎼 directing many instruments (tools) to play together; automation is one instrument playing on autopilot.