Core SOAR Workflows

Workflow 1: Suspicious phishing email triage. Phishing is the #1 drain on SOC analyst time — and the best candidate for automation.

• Trigger: a user forwards an email to phishing@company.com. The SOAR ingests the .eml file via IMAP/API.
• Extraction: URLs, sender domains, email headers, and file attachments.
• Enrichment (orchestration): sends URLs to URLScan.io or Palo Alto WildFire; detonates file hashes in a malware sandbox (Cuckoo / CrowdStrike); checks sender domain age and SPF/DKIM/DMARC status.
• Logic / decision: if the malicious threshold score is met (> 75/100), proceed to action. If benign (< 20), auto-reply to the user and close the ticket.
• Action (automated containment): API call to O365 / Google Workspace to hard-delete the email from the inboxes of all other recipients globally; API call to the firewalls to block the malicious domain.
• Action (human-in-the-loop): if SIEM logs show a user actually clicked the link, prompt an analyst on Slack: "User clicked malicious link. Force password reset and isolate endpoint via EDR? [Approve] [Deny]".

Workflow 2: Impossible travel / compromised credential.

• Trigger: the SIEM sends an "impossible travel" alert to the SOAR.
• Enrichment: the SOAR queries Active Directory for user details, and the HR system to see if the user is on approved international PTO.
• Validation (automated ping): the SOAR sends an automated ping via Duo, Okta, or Slack to the user's mobile device: "We saw a login from Russia. Was this you? Reply YES or NO."
• Action: on NO — or no reply within 5 minutes — the SOAR automatically suspends the AD account, revokes active O365 session tokens, and pages the on-call SOC analyst.