Instructor: SOAR!
Now, when I talk about SOAR
I'm not talking about soaring like a bird.
No, SOAR is an acronym and it stands for
the Security Orchestration, Automation, and Response,
also known as SOAR.
This is a class of security tools
that helps facilitate incident response,
threat hunting, and security configurations
by orchestrating and automating
runbooks and delivering data enrichment.
Basically, think about this as a SIEM, version 2.0.
Now when you're dealing with SOAR,
SOAR is primarily used for incident response,
but there is a large part of it that's used
for threat hunting, as well.
But really, the number one place you're going to see SOAR used
is incident response because it can
automate so many of your actions.
Now as I said, I like to think about this as SIEM 2.0.
Essentially, it's a next-generation SIEM.
This takes a security information
and event monitoring system and integrates it in with SOAR,
and when you put those two together,
this really does become your next-generation SIEM,
just like when you deal with next-generation firewalls.
They took you from dealing with layer three
and layer four and brought you all the way
up to layer seven.
It made it just so much better and so much more capable.
Same thing here.
When you integrate a SOAR in with a SIEM,
you get this really awesome product.
It's going to give you the ability to scan
security and threat data to be able
to identify different things.
You can then analyze it using machine learning
and then you can also automate
the process of doing data enrichment
to make that data inside that SIEM
even more powerful for you as an analyst to use.
And finally, you can do instant response,
so you can provision new resources.
That means you can create new accounts,
you can create new VMs.
If you're using VDI you can actually
delete somebody's infected box
and then create a new virtual machine for them to use,
and all this can be done using automated playbooks
if you use this SOAR capability.
Now, when we talk about this,
I just mentioned the word playbook.
What exactly is that?
Well, a playbook is essentially
a checklist of actions that you're going to perform
to detect and respond to a specific type of incident.
So if you said, hey if I have an alert
that says there's a phishing campaign
and somebody clicked the link on this machine,
we're going to do steps one through 10,
and then we're going to reimage their machine
and we're going to give them a new computer.
That might be your steps.
So for example, if you have somebody
who clicked on a link in a phishing campaign,
you might have steps one through five,
which says go to the machine, isolate it from the network,
do a virus scan to make sure they haven't infected themself,
check the registry to make sure
there's nothing in their for persistency,
and then back up all the user data,
refill them at the computer and then reinstall the computer
and put their data back on.
These might be the actions you're going to do.
Now, these could be manual or automated,
but in the case of a playbook,
usually you're talking about just the steps involved.
Now, if I can automate a lot of that,
that becomes a runbook.
Now a runbook is an automated version of a playbook
and it leaves clearly defined interaction points
for human analysis.
For example, my SOAR might say
if somebody clicks the link in a phishing email,
do these steps one through five.
When you get to step two, pause,
send it to an analyst who will then say
reimage the machine or don't reimage the machine.
These are the ways that we can use these things
and they all work together to create
a better environment and to help reduce the workload
of our analyst, because again,
we only have so many cybersecurity professionals
and if we're having them waste their time
on very minor things that we could automate,
that's not very helpful to us.
So instead, we want to automate what we can,
and SOAR allows us to do a lot of that automation.