Skip to content
DMC DEFENSE

What is SOAR?

Security Orchestration, Automation and Response: the layer that runs your response procedure in place of your analysts, the second the alert fires.

5 min read

Compromised-account playbookTotal 118 s
  1. Trigger
    T+0 s → T+2 s · The alert enters the playbook
  2. Enrichment
    T+2 s → T+11 s · Context is gathered
  3. Qualification
    T+11 s → T+17 s · The blast radius is measured
  4. Containment
    T+17 s → T+48 s · The endpoint is cut off the network
  5. Notification
    T+48 s → T+52 s · The right people are told
  6. Documentation
    T+52 s → T+118 s · The case file writes itself
Incident handledKept for your analystsT+118 s
Manual
120 minutes

Durations from a typical scenario, for illustration. Example of a Microsoft playbook, not a DMC DEFENSE commitment.

Contents

Two hours per alert, and the maths still fails

An alert is not an event, it is a procedure. Check it is not a false positive, find out who owns the endpoint, review what the account did in the preceding hours, decide whether to cut, cut, notify the manager, write the report.

Each of those steps is simple, and none of them is optional. End to end they take about two hours, and they are repeated identically on every incident of the same kind.

So the problem is not how hard the work is: it is how much of it there is. No reasonable hiring plan closes a gap of that size, because it is not a matter of effort but of arithmetic.

The arithmetic of one day

  • 38

    qualified alerts to handle per day

  • 120minutes

    of manual procedure per alert

  • 76hours

    of work to absorb every day

76 hours of work to absorb every day

24 hours of analyst time available, across three people

That gap does not close by working faster. It closes by no longer redoing by hand what is already written down.

Worked example, for illustration.

What happens during those hundred and eighteen seconds

A playbook is that same procedure, written once and then executed by the machine. Here is the real sequence of a compromised-account playbook, step by step, with the time each one takes.

  1. T+0 sTrigger

    The alert enters the playbook

    Sentinel raises the incident and the procedure starts, without waiting for an analyst to open their console.

    15 minutes · Manual

    2 seconds · Playbook

  2. T+2 sEnrichment

    Context is gathered

    Endpoint owner, address reputation, the account sign-in history, past incidents: everything is attached to the case.

    25 minutes · Manual

    9 seconds · Playbook

  3. T+11 sQualification

    The blast radius is measured

    The playbook checks whether other accounts or endpoints show the same sign, then computes a criticality level.

    20 minutes · Manual

    6 seconds · Playbook

  4. T+17 sContainment

    The endpoint is cut off the network

    Machine isolation, revocation of active sessions, password reset forced at the next sign-in.

    30 minutes · Manual

    31 seconds · Playbook

  5. T+48 sNotification

    The right people are told

    The employee, their manager and the on-call rota get the same message, listing what has already been done.

    10 minutes · Manual

    4 seconds · Playbook

  6. T+52 sDocumentation

    The case file writes itself

    Every action is timestamped in the incident: who, what, when, with what result. Nothing to re-enter.

    20 minutes · Manual

    66 seconds · Playbook

  7. T+118 sKept for your analysts

    Incident handled

    The endpoint is isolated, sessions are revoked, the case file is complete. An analyst then opens it to decide what comes next, on material that is already assembled.

Total

120 minutes · Manual

118 seconds · Playbook

Both bars share one scale: the grey bar measures the step done by hand, the blue segment the same step run by the playbook. The shortest segments are drawn at a minimum width so they stay visible. Durations from a typical scenario, for illustration. Example of a Microsoft playbook, not a DMC DEFENSE commitment.

What goes to the machine, what stays with you

SOAR is not there to decide for you. It takes the steps whose answer is known in advance, and gives your analysts back the time to handle the ones that are not.

Run by the playbook

  • Gathering the context around an alert
  • Comparing an address or a file against threat intelligence
  • Isolating an endpoint and revoking open sessions
  • Opening, updating and closing the case
  • Notifying the right people at the right moment
  • Writing the timestamped trace of every action

Kept for your analysts

  • Deciding whether an incident falls outside the written scope
  • Weighing a cut-off that would halt a critical activity
  • Investigating what no rule had anticipated
  • Writing and revising the playbooks themselves

Four constraints lifted

These four effects do not follow one another, they all land the moment the procedure is written. Each lifts a different constraint on response work.

  • Delay

    Response no longer waits for you

    Containment starts the second the alert fires, nights and weekends included, without waiting for an analyst to be at their screen.

  • Variation between two cases

    The same step, whichever night it is

    The procedure no longer depends on who is on call or what time it is. It is written, reviewed and versioned like code.

  • Volume

    Capacity stops tracking headcount

    The number of alerts handled is no longer bounded by the number of analysts, but by the number of procedures written.

  • Proof

    The trace is written by default

    Every action leaves a timestamped line, presentable to a NIS2 or ISO 27001 auditor with no after-the-fact reconstruction.

A playbook is not a script

Automating two or three actions with a script is within reach of any team. What sets a playbook apart is what it does when the situation does not go to plan.

A playbook is not a script
SituationA scriptA SOAR playbook
When an API stops answeringIt halts, often without anyone finding out.It retries, falls back to another route, and flags the failed step in the case file.
When the decision affects the businessIt runs anyway, or not at all.It pauses, asks a named person to approve, then resumes exactly where it stopped.
When the auditor asks who did whatSomeone has to read execution logs, if they were kept.Every step is timestamped in the case, with its trigger and its result.
When the threat changesSomeone has to find the script and edit it by hand.The procedure is versioned, tested, then redeployed across every incident of the same kind.

Read next

Your playbooks, written and maintained by our experts

We design your response procedures in Microsoft Sentinel, prove them against your real incidents, and keep them moving with your threat landscape.

Request a free auditDiscover our Microsoft expertise

Discover the 24/7 SOC