What Is SIEM? What Is SOAR? How Do They Compare? Do You Need Both?

by Nimmy Reichenberg on July 6, 2020

With all the acronyms floating around in cybersecurity, it is easy to get confused by what means what. Security information and event management, or SIEM, is often confused with security orchestration, automation and response, or SOAR, and vice versa. The reason why stretches beyond their similar syntax.

Both SIEM and SOAR live in the security operations center and act as the key technologies to helping organizations detect and respond to threats in an organized and timely manner. As a result, they are complementary solutions, yet different in capabilities and the roles they play.

Let’s examine both and help you better understand the distinction between the two so you can extract the most value out of SIEM and SOAR.

What Is SIEM?

SIEM, at its core, collects log, event and security data produced by point systems, devices and applications living across the enterprise environment – and aggregates this information onto a single platform. SIEMs then help to “connect the dots” about potential incidents by correlating events from these different sources, generating alerts for analysts about potentially malicious activity happening within the network.

Sponsorships Available

It is that last step – generating alerts for analysts – that creates the need for something more. Given the manual-intensive, time-consuming and repetitive nature of alerts, several ramifications can result, including analysts being overwhelmed by their sheer volume. This can result in poor outcomes, like missing something important or even burning out.

What Is SOAR?

SOAR refers to a security solution that allows businesses to collect and analyze data from multiple sources to identify security incidents within their IT systems. In addition, SOAR helps to streamline the management of security issues through automated playbooks, manage disparate security tools through a single interface and coordinate responses to security incidents.

[Guide] Free Download: The Business Case for SOAR

A SOAR solution consists of three main components:

Orchestration: Security orchestration refers to the integration and management of the tools security operations teams use to triage, investigate and remediate threats. Security orchestration is typically achieved using playbooks that define the process and related tools required to address a specific threat, and typically leverage the APIs of these tools to execute the relevant functionality, eliminating the need to constantly switch among various consoles.

Automation: Security automation means using software tools to perform tasks that would otherwise need to be executed by human security personnel. Although not every type of security task can be fully automated, many can be. From completing repetitive tasks, such as enriching data with threat intelligence, to inspecting files by detonating them in a sandbox, applying automation for these tasks means analysts are freed up to work on more strategic initiatives that require critical thinking.

Response: Security response is the act of reacting to and remediating security issues, which typically requires taking steps to contain and resolve the issue and ensure that the threat does not happen again. While the decision to initiate response is rarely automated, remediation activities such as resetting user credentials or blocking malicious URLs, can often be initiated by a SOAR platform.

Do You Need Both SOAR and SIEM?

It’s not an either-or situation when considering the adoption of SOAR and SIEM – the technologies are complementary.

A SIEM collects logs and security data from multiple sources, performs correlation and generates alerts for security teams to investigate, while providing a central interface for analyzing and tracking alerts.

However, SIEM platforms do not address the processes required for efficiently and effectively triaging, investigating and responding to the alerts that they generate, nor do they provide the orchestration and automation features of SOAR. SIEM focuses mostly on monitoring and alerting rather than the broader set of functionality and integration that is critical for streamlined security operations.

This is why most organizations are best served by both. While SIEM acts as an aggregator of logs and generator of alerts, SOAR platforms serve as the main workbench for security teams, where they can assess and respond to threats, as well as track and measure SOC activity.

Want to learn more? Visit siemplify.co to sign up for the free Siemplify Community Edition or a 14-day free trial of Siemplify Cloud.

Nimmy Reichenberg is CMO at Siemplify.

The post What Is SIEM? What Is SOAR? How Do They Compare? Do You Need Both? appeared first on Siemplify.