CompTIA CySA+ (CS0-003)Security OperationsMedium
A SOC lead explains that when a phishing email is reported, the SOAR platform automatically extracts indicators, queries threat intelligence feeds, and quarantines the message across all mailboxes without any analyst involvement. Which SOAR concept does this fully unattended, end-to-end workflow represent?
- AAutomation
- BThreat intelligence enrichment
- CCase management
- DOrchestration
Show answer & explanationAnswer & explanation
Correct answer: A. Automation
Automation refers to a fully machine-executed workflow with no human decision point required. Orchestration is the broader concept of coordinating multiple tools/systems together, but the key distinguishing detail here—'without any analyst involvement'—defines automation specifically.
Why the other options are wrong
- B. Threat intel enrichment is just one action within the workflow, not the overall concept being described.
- C. Case management tracks and organizes incident tickets/workflow status, not the execution of remediation steps.
- D. Orchestration describes integrating and coordinating multiple security tools, which may still require human approval steps.
SOAR Automation vs Orchestration
Orchestration coordinates multiple tools/data sources into a unified workflow, while automation executes tasks within that workflow without human intervention.
- Orchestration = connecting tools together (integration layer)
- Automation = machine-executed actions with no analyst input
- Playbooks often combine both concepts in a single response
Memory trick: Orchestration connects the band; Automation plays the song without a conductor.