It's not easy to understand the key differences when looking at SOAR vs. SIEM, because they have many components in common. Security information and event management, or SIEM, tools are a way to centrally collect pertinent log and event data from various security, network, server, application and database sources. Common examples of sources include firewalls, intrusion prevention systems, antivirus and antimalware software, data loss prevention tools and secure web content gateways.
The aggregated data is then analyzed by the SIEM in real time to spot potential security issues. Because multiple data sources are analyzed, the SIEM identifies threats by correlating information from more than one source. The SIEM then intelligently ranks the events in order of criticality.
Security administrators are commonly tasked with sifting through the various events to track down and remediate the source of the potential threat or simply acknowledge it and tune the analysis engine to mark the event as a benign occurrence. Doing so helps the SIEM software better learn what is considered a true threat versus an event that merely looks suspicious.
How SOAR and SIEM improve SecOps
While SIEM tools have been around for years, Security Orchestration, Automation and Response (SOAR) is the new kid on the block. When looking at SOAR vs. SIEM, both aggregate security data from various sources, but the locations and quantity of information being sourced are different. While SIEM will ingest various log and event data from traditional infrastructure component sources, a SOAR takes in all that and more.
This article is part of
For example, SOAR will pull in information from external emerging threat intelligence feeds, endpoint security software and other third-party sources to get a better overall picture of the security landscape inside the network and out. SOAR takes analytics to a different level by creating defined investigation paths to follow based on an alert.
Again, when comparing SOAR vs. SIEM, SIEM will only provide the alert. After that, it's up to the administrator to determine the path of an investigation. A SOAR that automates investigation path workflows can significantly cut down on the amount of time required to handle alerts. It also provides lessons about the security admin skill set required to complete an investigation path. Ultimately, a properly implemented SOAR can make your cybersecurity team more efficient.
Dig Deeper on SIEM, log management and big data security analytics
Related Q&A from Andrew Froehlich
An IAM system introduces risks to the enterprise, but the consensus is the benefits of IAM outweigh the drawbacks. What are some of the issues that ... Continue Reading
The network edge is where an enterprise network connects to third-party network services. Edge computing is a distributed architecture that processes... Continue Reading
PAP uses a two-way handshake to authenticate client sessions, while CHAP uses a three-way handshake. Both authentication processes are common, but ... Continue Reading