Security orchestration and automation (SOAR)
Analysts lose hours to the same steps: look up an address, check a user, open a ticket, disable an account. Security orchestration, automation and response (SOAR) turns those steps into workflows that run the moment an alert arrives, with a person approving the risky ones.
What we do
- Workflow design from existing runbooks
- SIEM and ticket integration
- Approval gates for risky actions
- Phishing triage automation
- Error handling and audit logs
- Workflow testing before go-live
- Metrics on analyst time saved
Our team works with Shuffle, an open-source automation platform, with Tines for no-code workflows, and with Microsoft Sentinel playbooks built on Azure Logic Apps. We connect them to the SIEM, the ticket system, the identity provider and the email gateway, and we keep a human approval step before any account lockout or isolation.
This group links to our Cyber Automation and Cybersecurity services. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Shuffle
- Tines
- Microsoft Sentinel playbooks
- Palo Alto Cortex XSOAR
- Splunk SOAR
Platforms and practices
- Alert enrichment workflows
- Phishing report triage
- Ticket creation and updates
- Account disable with approval
- Endpoint isolation requests
- Threat intelligence lookups
- Runbook documentation
- Workflow testing and versioning
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Security orchestration and automation (SOAR) for clients
Cyber Automation
Custom AI agents that do repetitive work around the clock, with human review where it matters.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan an automated workflow lock out the wrong person?
It can if it is built carelessly, so we put a human approval step before any account lockout or device isolation. Workflows first run in a report-only mode that shows what they would have done. Low-risk steps such as looking up an address or opening a ticket run on their own.
What should we automate first?
Start with the repetitive, low-risk steps: enriching an alert with threat intelligence lookups, triaging reported phishing emails and creating or updating tickets. These save analyst time and carry little risk. Actions that change systems, such as disabling accounts, come later and keep an approval gate.
Do we need a SIEM before we can use SOAR?
A SOAR platform needs a source of alerts, and a SIEM is the usual one, though email gateways, endpoint tools and a shared mailbox for reported phishing can also feed it. Microsoft Sentinel combines both, with playbooks built on Azure Logic Apps. We look at what alert sources you already have before recommending a platform.
How do you keep automation from breaking when a tool changes?
Each workflow has error handling, an audit log and a version history, and it is tested before go-live and again after the connected tools update. If a step fails, the workflow raises a ticket for a person instead of stopping quietly. We also review workflows on a schedule, since APIs and fields change over time.