From the course: Introduction to SecOps on Google Distributed Cloud (GDC) by Google

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Security Orchestration, Automation, and Response (SOAR)

Security Orchestration, Automation, and Response (SOAR) - Google Cloud Platform Tutorial

From the course: Introduction to SecOps on Google Distributed Cloud (GDC) by Google

Start my 1-month free trial Buy for my team

Security Orchestration, Automation, and Response (SOAR)

“

- [Presenter] SOAR stands for Security Orchestration, Automation, and Response. The SOAR system serves as a centralized security solution designed to automatically prioritize and respond to security incidents. This capability is enabled by machine learning-driven automation and orchestration. For effective incident response automation, the SOAR system requires access to both platform logs and security feeds. Similar to a SIEM system, SOAR collects logs from compute and network devices and platform workloads. Additionally, SOAR integrates with threat intelligence feeds and incident management operations from the SIEM system, as well as with other relevant SecOps tools. With the combination of these data sources, the SOAR system can access and monitor platform events. The SOAR system can also execute playbooks and response workflows when an alert is triggered. Let's look in more detail at how the SOAR system manages incident…

Contents