CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

SOAR — Security Orchestration, Automation, and Response — is the category of tooling that takes the repetitive work out of a security operations centre. It connects the tools an analyst would otherwise click through by hand, runs the routine steps automatically, and hands the human what actually needs judgement. SIEM tells you something happened. SOAR does something about it. The problem SOAR addresses is straightforward and familiar to anyone who has worked a queue: a SOC generates far more alerts than its analysts can investigate, and a large share of those alerts require the same dull sequence every time — look up the IP reputation, check the hash, query the EDR, see who the user is, decide whether it matters. That sequence takes fifteen minutes and requires no creativity. Multiply it by four hundred alerts a day. The Three Words Orchestration is the integration layer. SOAR connects to the SIEM, EDR, firewall, identity provider, ticketing system, threat intelligence feeds...

Mean time to detect (MTTD) is the average time between a security incident beginning and the organization noticing it. It is one of the few security metrics that maps directly onto damage, because almost everything an attacker achieves happens during that window. Every hour an intrusion goes undetected is an hour the attacker spends moving laterally, escalating privileges, and locating your data. The uncomfortable truth behind the metric is that industry-wide dwell times have historically been measured in weeks and months rather than hours. They have improved markedly — partly through better tooling, and partly because ransomware announces itself, which drags the average down for reasons nobody should celebrate. The Family of Metrics MTTD sits in a sequence, and exams test the whole set together. Metric Measures Clock starts Clock stops MTTD — mean time to detect Detection speed Incident begins Someone notices MTTA — mean time to acknowledge Triage responsiveness Alert ...