Security Automation & Orchestration (SOAR) Flashcards

What is the primary purpose of SOAR (Security Orchestration, Automation and Response) in a security operations center?

Answer: To automate repetitive security tasks and orchestrate tools for faster incident response

SOAR platforms automate repetitive tasks such as alert triage and coordinate multiple security tools to accelerate incident response and reduce analyst workload.

Which Fortinet product is the dedicated SOAR solution for automating security workflows and managing incidents?

Answer: FortiSOAR

FortiSOAR is Fortinet's purpose-built SOAR platform that provides playbook automation, case management, and integrations for orchestrated incident response.

In FortiSOAR, what is a playbook?

Answer: A visual, automated workflow that defines the sequence of actions taken in response to a security event

A playbook in FortiSOAR is a visual automated workflow — a series of defined steps and decisions executed in response to a specific alert or event type.

Which integration mechanism does FortiSOAR primarily use to connect with third-party security tools?

Answer: REST API connectors

FortiSOAR uses REST API-based connectors to integrate with third-party tools, enabling data exchange and action execution across the security ecosystem.

What is the key difference between automation and orchestration in the context of SOAR?

Answer: Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow

Automation refers to executing individual repetitive tasks without human input, while orchestration coordinates the flow across multiple tools and processes to achieve an end-to-end response.

In FortiSOAR, which feature allows a playbook to pause and wait for a human analyst to approve or reject an action before continuing?

Answer: Approval-based (human-in-the-loop) step

FortiSOAR supports human-in-the-loop steps within playbooks, which pause automated execution and request analyst approval before proceeding with high-impact actions.

What does MTTR stand for, and how does SOAR directly impact it?

Answer: Mean Time to Respond; SOAR reduces it by automating triage and response actions

MTTR (Mean Time to Respond) measures how quickly incidents are addressed; SOAR reduces MTTR by automating alert triage, enrichment, and response steps that would otherwise require manual effort.