I. Introduction
Organizations today face a massive challenge in managing the growing number of security alerts. The capabilities of human security analysts are being pushed to their limits by the increasing complexity of cyberattacks. Security Operation Centers (SOCs) are responsible for protecting sensitive data and digital assets within an organization. However, they frequently receive an excessive amount of alerts from different security tools. The resulting alert fatigue, inefficiency, and potential gaps in incident response have raised critical concerns in the cybersecurity domain. Security Orchestration, Automation, and Response, or SOAR, has become an effective strategy to address these issues [1].
Cybersecurity incidents and breaches can lead to severe outcomes, including financial losses and harm to reputation. As a result, businesses have made big investments in security solutions like firewalls, intrusion detection systems (IDS), antivirus software, and other threat intelligence tools. These tools generate a constant stream of alerts, indicating potential security incidents. Although the goal of using these technologies is to improve security, security professionals may become alert fatigued and respond to incidents too slowly or not at all due to the high frequency of alerts [2].
Human security analysts have a tough job going through security alerts one by one to figure out if they're real and how serious they are. Doing this manually takes a lot of time, can have mistakes, and uses up a lot of resources. As cyber threats get smarter, there's a growing need for a better system to manage these alerts quickly and effectively.
Dealing with too many alerts and managing them manually is a big problem for organizations. Businesses are looking for smart solutions to boost their cybersecurity posture, and that's where SOAR technology comes in. It helps by automating tasks, sorting alerts, and providing more information on incidents, making human security analysts better at spotting and dealing with security threats. This research project is all about understanding how SOAR technology has evolved, its benefits, and how it changes the job of human analysts in today's security operations — particularly how SOAR tools can help solve the problem of handling too many alerts.
II. Terminologies
- SOC (Security Operations Center) — A combination of people, processes, and technology that monitors an enterprise IT infrastructure 24/7 to detect and address cybersecurity events in real time. A team of security professionals scans the network around the clock to flag abnormalities or suspicious activity.
- SIEM (Security Information and Event Management) — Software that combines security information management (SIM) and security event management (SEM) to provide real-time analysis of security alerts generated by applications and network hardware.
- Phishing — A social engineering attack where malicious emails, texts, or instant messages deceive a victim into disclosing private information or downloading malware, often to steal credentials or financial data.
- Correlation rules — Techniques (pattern recognition, rule-based logic, alerting) used in SIEM to link related records and flag suspicious patterns — for example, flagging simultaneous logins from different geographic locations as "impossible travel."
- VPN (Virtual Private Network) — An encrypted connection over the internet between a device and a network, protecting sensitive data from eavesdropping and enabling secure remote work.
III. Literature Survey
This literature survey examines how organizations currently respond to incidents, the integration of security tools, real-world case studies of successful implementations, and the importance of user experience in shaping effective cybersecurity practices.
Twenty-four participants evaluated six commercial SOAR products in one study, with investigative work totaling more than 200 hours. The findings highlight that streamlining the process of gathering and correlating data is crucial to improving cybersecurity posture; switching between multiple tools for data collection is time-consuming, distracting, and often delays reaction to issues [3]. Centralizing data from various sources onto a single platform was found to reduce context switching and increase efficiency, though it may also affect ticketing accuracy.
Due to the gap between OT and IT, digitizing SCADA systems presents security challenges, with critical sectors often relying on outdated tools. Researchers propose SOAR platforms — leveraging machine learning and AI — as an ideal solution for resolving security flaws and performance interruptions, helping protect smart grid SCADA systems from emerging threats [4].
Other work provides a detailed implementation strategy for deploying SIEM solutions, emphasizing that corporations need a clear goal (reporting, compliance, or threat management) for a SIEM deployment to succeed. The same deliberate approach is recommended when deploying SOAR solutions [5].
A recent survey found that roughly three-quarters of surveyed firms are testing AI/ML for cybersecurity, underscoring the crucial role of ML and AI in developing SOAR systems that automate threat detection and response and support both offensive and defensive SOC capabilities [1].
Additional proposed systems integrate honeypots (e.g., T-Pot), Suricata for network threat detection, ELK for log parsing and visualization, and Spiderfoot for threat intelligence gathering, combined with an AI agent that determines true versus false positives and generates supporting reports and playbooks [6][7]. For Distributed Energy Resource (DER) systems, a technique called SOAR4DER combines cyber and physical data via a BITW device to detect and respond to attacks — including man-in-the-middle assaults, brute-force logins, malicious Modbus commands, and denial-of-service attacks — within seconds [8].
A Palo Alto Networks survey of North American security professionals found that many incident response teams remain small, as shown below, leaving them exposed to high stress and full responsibility for handling security incidents [1].
IV. Existing System
A. Where does SOAR fit in?
In a typical SOC workflow, numerous tools generate huge quantities of logs, processed through a SIEM system. In a large organization these logs originate from sources like Active Directory, firewalls, endpoints, antivirus, web access firewalls, DNS/DHCP servers, web servers, IPS/IDS, routers, switches, and email servers. Correlation rules in the SIEM trigger roughly 80–120 alerts per day. Security analysts then analyze these alerts, and confirmed incidents are escalated to incident handlers for response.
In the SOC workflow with SOAR, the process remains largely the same, but SOAR handles the bulk of the workload. Analysis by security analysts and response by handlers are still essential, but the technology streamlines and automates many tasks. While the number of required security analysts may decrease, human involvement remains crucial [1]. SOAR's role begins with processing alerts and concludes with executing incident response actions — enhancing efficiency and reducing the workload on human analysts.
V. Current Scenario of Threat Feed Management
In threat management, a significant 50% of analysts still handle threat feeds manually, while the other half use various tools (Fig. 3). The risk associated with manual handling is high given the nature of modern threats: small teams may face overload, leading to mishandled alerts. False positives waste time and resources, while false negatives can result in security breaches. Automating this critical workflow is essential to improving efficiency and reducing errors.
VI. What Can Be Automated?
A. Assignment of alerts to analyst
Alert assignment in a SOC can be significantly streamlined through automation. SOC teams typically operate with just one or two analysts per shift, often using a round-robin approach. Machine learning can replace this rotational model by analyzing historical data — assigning new alerts to the analyst who previously handled a related host or incident, acknowledging potential connections between incidents and optimizing analyst expertise.
B. Information gathering
This phase focuses on extracting key details from triggered alerts — for a malware alert, this includes host name, IP address, the affected user, the malware's name, and the action taken by antivirus software (deletion, quarantine, cleaning). Automating this extraction ensures all important details are gathered consistently, creating a solid base for further analysis.
C. Enrichment of information
Enrichment gathers additional context beyond what's in the original log or alert — connecting to Active Directory for a user's department, role, manager, and location; to vulnerability assessment reports for machine health; and to threat intelligence services for the reputation of IPs, URLs, and files. Automating enrichment produces a more comprehensive, targeted analysis.
D. Analysis
Automatable analysis tasks include retrieving a file from an end-user machine and submitting it to a sandbox, checking an IP's historical communication within the network (informed by earlier reputation findings), and reviewing whether other users received email from the same phishing sender by comparing subject lines and sender details.
E. User interaction
Automation extends to user communication — acknowledging a reported suspicious email, then following up with the analysis outcome. It also covers seeking approval from higher-ups, such as sending a manager a request with "Yes/No" options to delete identified phishing emails, streamlining the permission-seeking process while keeping a human in the loop for the final decision.
F. Respond
Automated response actions include generating tickets for tracking, triggering vulnerability or antivirus scans on suspect systems, and blocking malicious applications, IPs, or URLs on the firewall or web gateway — eliminating the need to manually raise tickets or wait on administrators to update policies.
G. Enhancement / lessons learned
Automation supports continuous improvement: automatically adding a newly detected malware hash to the local threat intelligence database, and checking for its presence across the network. It also extends to organizational awareness — for example, automatically alerting the organization when a new targeted phishing technique tied to a recent company event is identified.
VII. SOAR Playbook Use-Cases
According to the data above, the top three incidents security teams face are phishing alerts (74%), malware alerts (56%), and endpoint security alerts (53%). Network security incidents stand at 40%. The remaining 15–17% consist of anomalous logins, VPN issues, SIEM alerts, and cloud service provider alerts. Addressing these primary threats is crucial for protecting an organization against security breaches.
A. Detonating a URL using VirusTotal
The playbook starts with an incident created in the SOAR platform representing a security event that needs investigation. Relevant information — such as the suspicious URL to detonate — is gathered and stored in the incident context for use throughout the playbook. A VirusTotal integration enriches the incident with the URL's reputation, associated domains, IPs, and other indicators of compromise. Conditional logic based on the reputation score determines whether to proceed with detonation — executing the URL in a controlled environment to observe its behavior. Results are monitored and retrieved from the VirusTotal API, and a report is generated. Depending on findings, response actions may include blocking the URL, isolating affected systems, or notifying stakeholders before the incident is closed.
B. Malware investigation and response
This playbook is triggered by a malware alert and starts an SLA timer to ensure timely response. It assesses whether an analyst needs assignment, then sets tags based on the incoming alert. Once the expected SIEM alert arrives, the playbook retrieves detailed incident data and marks the SIEM state as processed to avoid redundant work. Analysts select an investigation tool — Microsoft Defender for Endpoint, CrowdStrike Falcon, or Palo Alto XDR — to extract and analyze investigation details. Sub-playbooks then carry out malware remediation and hunt for detonation activity elsewhere in the company.
C. Phishing
A phishing playbook begins with an instant notification to the management chain, followed by a thorough initial inspection of the reported email — checking for malicious URLs, attachments, suspicious sender names or addresses, and hostname legitimacy. If the email is not phishing, the case closes as a false positive. If confirmed, severity is assessed and analysts are assigned for a deeper Investigation Step 2: extracting URLs and hostnames, fetching linked files, and running malicious hash inspections. Investigation Step 3 checks whether the incident is part of a broader campaign. In the response phase, actions can include notifying the internal PR team (if a campaign), blocking the email on the server, updating spam filters, informing the email security vendor, removing the email from inboxes, blackholing the phishing domain, blocking the download URL, and reporting malware samples to antivirus systems.
| Type of Alert | 30–60 min | 1–4 hrs | 5–8 hrs | 1–2 days | 2+ days |
|---|---|---|---|---|---|
| Phishing | 40% | 29% | 15% | 5% | 2% |
| Malware | 21% | 42% | 15% | 8% | 2% |
| Endpoint | 21% | 42% | 15% | 8% | 2% |
| Cloud Service Provider | 16% | 35% | 21% | 7% | 2% |
| Remote Access / VPN | 25% | 31% | 17% | 12% | 1% |