What does SOAR stand for?
SOAR stands for Security Orchestration, Automation, and Response. Security orchestration, automation and response: a platform that runs playbooks to automate response steps across security tools.
SOAR platforms connect security tools through their APIs and run playbooks: ordered steps such as enriching an alert with threat intelligence, isolating a host, disabling an account and opening a ticket. Steps can run fully automatically or stop for an analyst to approve. The aim is to handle repetitive alerts the same way every time and in seconds instead of minutes.
SOAR in practice: an example
A phishing report arrives. The playbook extracts the URL, checks it against a reputation service, searches every mailbox for the same message, removes the copies, blocks the URL on the proxy and adds a note to the case. The analyst reviews the result instead of doing the five steps by hand.
What SOAR is confused with
SOAR vs SIEM: what is the difference?
The SIEM finds the problem by correlating logs. SOAR acts on it. Many products now ship both, but the exam treats detection and automated response as separate functions. What SIEM stands for
Which exams cover SOAR?
SOAR is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: on the acronym list, not tied to one objective.
- CySA+ CS0-004: 1.5 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A security team receives two hundred phishing reports a day and each one needs the same six manual checks. What reduces the workload most?
- A longer log retention period
- A SOAR playbook
- A second firewall
- Full-disk encryption
Show the answer
B. A SOAR playbook. Identical, repetitive steps are exactly what a playbook automates. Retention, firewalls and encryption do nothing for the handling time of each report.
2. Which step in a SOAR playbook is the best candidate for a manual approval instead of full automation?
- Looking up a file hash
- Adding a comment to the ticket
- Wiping an executive's laptop
- Recording the alert time
Show the answer
C. Wiping an executive's laptop. Destructive actions with business impact should wait for a person. Lookups and notes are safe to automate because a wrong result costs nothing.
Sources: NIST glossary: security orchestration, automation, and response; Microsoft Learn: Automation in Microsoft Sentinel (SOAR). The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.