SOAR
REAL response automation: the playbooks act on the app's own data (they block devices, open incidents) and are logged in the SIEM.
Playbooksoperational
2
Executions
0
Integrationconnected
Network · Incidents · SIEM
Latest
—
Playbooks
Real actions on the network and incidents
Block new devices on the WiFi
Blocks on the network all devices in "new" status
Open incident from the latest alert
Creates a real incident from the most recent high/critical alert in the SIEM
Isolate a device by MAC
Blocks the given MAC on the network (it must exist in Network authentication)
Execution log
What SOAR actually did (also visible in the SIEM)
No executions
Run a playbook. The actions are real and appear here and in the SIEM.