Explain like I'm five · Security

What is SOAR?

SOAR (Security Orchestration, Automation and Response), told as a story about a guard-room machine that flips through the book on its own when a bell rings.

a thousand rings a daywhen do I look at all these…checking every one by handso many bells, one friend in the guard room

The guard room's bells ring a thousand times a day.There is one friend in the guard room. Every bell, checked by hand.

the bookflipping the book by hand, every timenine in ten are cats…the real thief waits in linewhile we check the cat, the thief's bell waits

Every bell means flipping through the book by hand. And nine in ten are cats.While we check the cat, the real thief's bell waits. The book is good — human hands are just slow.

the machine1 find the log2 ask the tower3 a cat? dismiss4 a thief? lock the doorthe logtower friendguard dogsummarythe person reads one notewhen a bell rings, the machine runs firstthe person only sees what the machine can't solve

SOAR is the guard room's automatic book.When a bell rings, the machine runs first. It finds the log, asks the tower, dismisses cats, locks doors on thieves — and sends the person one summary note.

The book, in a machinefollows the steps on its own
Friends in a rowasks the log, tower, and dog for you
All on one pageone bell = one note
People take the hard onesthe machine handles the cats
bellfind the logask the towercat → dismissthief → lock the doornotea summary for the personthe machine dismisses the cat and locks up the thiefall that reaches the person is one note

The machine asks in a fixed order and picks a path at the fork.It finds the log, asks the tower friend, dismisses cats, and has the guard dog lock the door on thieves.

before: a person, a thousand bells990by the machine10now: the person, tenthose ten are thieves the machine has never seen — a person looks at those

Of a thousand bells, the machine takes 990 and a person takes ten.Those ten are thieves the machine has never seen. It only follows what was written — the new ones go to a person. The big screen gathers the bells; this machine handles them.

In one breath

SOAR = when a bell rings, the machine runs first — finds the log, asks the tower, dismisses cats, locks doors on thieves — and hands the person one summary note.

When an alert arrives, it runs a playbook that calls the security tools (SIEM, CTI, EDR, ticketing) to investigate and respond automatically; people receive only the cases that need judgment.

When grown-ups say it

SOAR
The automatic book. When a bell rings, it flips the book itself and asks the other friends for you.
Playbook automation
The written steps, run by a machine. The book people used to follow, followed by a machine. → the book for when a thief gets in
Orchestration
Lining the friends up. Asking and instructing the log, the tower, the dog, and the doorkeeper, in order.
Case management
One note per bell. Who saw what and did what, gathered on one page.
Automated response
A thief? Lock the door. The machine contains it before a person arrives. → the guard dog
Alert fatigue
Dismissing cat bells. The machine filters out the nine-in-ten cats so people can look at the thief.
SIEM
The big screen that gathers bells. The big screen rings the bells; this machine handles them. → the guard room's big screen
Ticket
The note that reaches a person. Only what the machine can't solve lands on a person's desk.
Next story
Setting the Footprint in Plaster →
Want another term as a picture book? Request →