Security Orchestration, Automation and Response (SOAR)

KuppingerCole’s Buyer’s Compass for SOAR solutions is a structured starting point for selecting vendors by aligning product capabilities to prioritized use cases. It guides organizations to identify primary SOAR use cases, weight functional and non-functional criteria accordingly, request and score vendor information, ask targeted questions, then create a shortlist for deeper evaluation through RFIs and proof-of-concepts—while ensuring necessary technical and organizational prerequisites are in place. The approach emphasizes comparing products against real operational needs rather than treating selection as a purely feature-driven exercise.

The document positions SOAR as the next step in the evolution beyond SIEM-centric operations. SIEMs remain foundational for SOCs, but visibility alone does not reduce repetitive manual work, and false positives can overwhelm analysts. SOAR platforms address this by integrating disparate security tooling via out-of-the-box connectors (“integrations”) and APIs, orchestrating workflows, opening cases and tickets, correlating and enriching events, and executing playbooks that automate common investigations and response steps. SOAR’s effectiveness depends heavily on integration breadth and on what downstream tools expose through their APIs.

Five core SOAR use cases are emphasized: investigations, threat hunting, automation and response, SOC management, and cyber threat intelligence (CTI) management. Functional criteria include SIEM integration, automated analysis, case management, analyst console quality, playbooks, and integrations with EDR, email/web gateways, NDR, cloud, and IAM systems. Non-functional criteria include deployment models, time-to-value, vendor scale and customer base, partner ecosystem, strategic focus, documentation, support, roadmap, and pricing models. The prerequisites section highlights architecture and deployment decisions, internal security controls, extensibility, skills, governance, executive support, data policies, SLAs, and training as critical to long-term SOAR success.

• Some security-conscious organizations administer over 50 different and disjointed security tools.
• SIEM products commonly form the foundation of modern Security Operations Centers.
• SOAR solutions generally do not take in raw event data or capture packets.
• SOAR platforms typically use out-of-the-box connectors composed of packaged API calls for integration.
• SOAR case management must interoperate with IT Service Management systems for ticketing in many enterprises.
• SOAR can enrich events by acquiring intelligence about entities such as files, URLs, IP addresses, and user accounts.
• Some SOAR solutions can initiate automated threat hunts for indicators of compromise across multiple nodes.
• SOAR can reduce effort for TLS certificate management by querying expiration dates, generating reports, and alerting owners.
• SOAR is often licensed per analyst user, with some vendors charging by instances, playbooks/actions, or per connector/integration.
• Many SOAR vendors license their products to MSSPs that run SOAR on behalf of customers.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “Visibility of potential security events alone does not help analysts to assess each discovered threat, nor does it reduce the amount of time spent on repetitive manual tasks.”
• “SOAR platforms aim to become the foundation of contemporary SOCs.”
• “All of the foregoing elements of security architectures must be plumbed into SIEM and SOAR solutions for optimum effectiveness.”
• “SOAR’s job is to distinguish between related and unrelated events across all connected systems, assemble it coherently, enrich the event information…”
• “Most organizations allow for full automation of preliminary evidence collection and analysis but require human analysts to approve potentially user and business impacting actions in the workflow.”
• “The maximum utility is achieved by selecting a SOAR that has pre-packaged connectors for all the security and identity elements in your portfolio.”
• “For the most part, the capabilities of SOAR solutions to execute orchestration, automation, and response actions remotely are tightly constrained by what the underlying tool vendors expose in their own APIs.”
• “Some organizations struggle with these topics, not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”
• “There are different approaches in the market on how solutions are licensed, which can drastically affect total cost.”