CompTIA SecurityX (CAS-005)Security OperationsMedium
An organization is evaluating a new Security Orchestration, Automation, and Response (SOAR) platform. One of the key requirements is to automatically enrich incident data by querying various threat intelligence feeds and internal asset management databases. Which component of a SOAR platform is primarily responsible for performing these automated data gathering and enrichment tasks?
- ADashboards and Reporting
- BCase Management
- CConnectors/Integrations
- DPlaybooks
Show answer & explanationAnswer & explanation
Correct answer: C. Connectors/Integrations
Connectors and integrations are the SOAR platform components that enable it to communicate with and retrieve data from external systems like threat intelligence feeds, vulnerability scanners, and asset management databases, thus performing the automated data gathering and enrichment.
Why the other options are wrong
- A. Dashboards and reporting visualize the data but are not involved in the active gathering and enrichment process.
- B. Case management organizes incident information but doesn't perform the data gathering itself.
- D. Playbooks define the automated workflows, but they rely on connectors to actually interact with other systems and gather data.
SOAR Connectors
Modules or APIs within a Security Orchestration, Automation, and Response (SOAR) platform that enable communication, data exchange, and action execution with other security tools and systems.
- Facilitate data enrichment.
- Enable automated response actions.
- Integrate with SIEM, EDR, TI feeds, firewalls, etc.
- Crucial for SOAR functionality.
Memory trick: The robot needs its arms and hands to reach out and do its work.