Orchestration vs. Automation
Connect the tools; then — carefully — remove the human.
Key takeaways
- Orchestration connects disparate tools via APIs: SIEM, Active Directory, EDR, firewall, Slack.
- Automation executes steps across those orchestrated tools without human intervention.
- Golden rule: never automate a broken or undocumented process — you will just cause damage at machine speed.
SOAR (Security Orchestration, Automation, and Response) takes over once the SIEM fires an alert. It replaces manual analyst runbooks with machine-speed API workflows: playbooks. Two words in the acronym do different jobs:
- Orchestration — connecting disparate tools via APIs: getting the SIEM, Active Directory, EDR, firewall, and Slack to share data seamlessly.
- Automation — executing steps across those orchestrated tools without human intervention.
The golden rule: never automate a broken or undocumented process. If your manual incident-response process is flawed, automating it will just cause damage at machine speed. Document the manual runbook, prove it works, and only then teach the machine to run it.
Knowledge check
Your manual phishing-response process is undocumented and inconsistent. What does the SOAR golden rule say?