Cybersecurity incidents occur on a daily basis at most large organizations. This steady stream of incidents poses a challenge for incident response professionals, who must sort through them and identify appropriate courses of action. This becomes even more challenging when the number and complexity of incidents exceeds the technical, financial and staff resources available to incident response teams. In this unfortunate situation, stress levels rise and significant incidents may be overlooked.

Security orchestration, automation and response (SOAR) programs promise to bring some relief for overworked incident response teams. Automating incident response activities improves the efficiency and effectiveness of incident response efforts and increases the number of incidents that a team may handle.

Published March 2019 in SearchSecurity
Read the full article: Automating incident response with security orchestration