What is SOAR?

SOAR stands for Security Orchestration, Automation and Response. This term is used to describe three different capabilities. These are threat and vulnerability management, cyber incident response management and security operations automation.

Thanks to these capabilities, data on security incidents from many sources is collected and analyzed. While performing these operations, it also allows the use of the least possible number of sources for analysis, ensuring that the processes are carried out quickly and actions are taken in an automated manner with the highest level of integration.

The features provided by SOAR are mainly categorized under the three headlines.

1- Security Orchestration and Automation:

It covers all the features that enable these components to work like an orchestra by organizing workflows across multiple technologies, systems, and applications used in the infrastructure, managing automation, and reporting.

2- Security Incident Response:

It’s the sum of the features that enable fast and accurate cyber incident response by incorporating the capabilities and integrations required for cyber incident response.

3- Threat Intelligence Platforms:

It defines features that facilitate the detection of cyber attacks by utilizing paid and/or free cyber threat intelligence resources provided by third-party sources to detect TTPs used by attackers.

What is a Managed SOAR Service?

The Managed SOAR service offered by ADEO provides customers with the opportunity to become a tenant in ADEO's SOAR platform, rather than purchasing and managing their own SOAR solution. By doing so, customers can benefit from all the features of a SOAR platform, with the added support and expertise of ADEO.

ADEO offers two different operating models for its Managed SOAR service, depending on the level of involvement desired by the customer. The Fully Managed model is suitable for customers who prefer a hands-off approach and want ADEO to handle all aspects of SOAR operations. Alternatively, the Co-Managed model is more appropriate for customers who want to be involved in the SOAR process and collaborate with ADEO in its operation.

Fully Managed SOAR

In our Fully Managed SOAR service, SOAR is fully managed by ADEO analysts and all configurations and analyses are performed by ADEO. Our customers are not involved in any way in the incident management process on the SOAR platform. Real-time notifications are delivered through communication channels specially designed for our customers.

In this structure, a SOAR tenant can be created on ADEO's own master server, or a SOAR tenant can be installed on a server owned by our customer at their location upon request. In this case, all data belonging to our customers is stored on servers in their own locations.

Co-Managed SOAR

In the Co-Managed working model, SOAR is managed by both our clients' analysts and ADEO analysts. Our customers can perform real-time case tracking on the SOAR platform with read-only rights. In this structure, our customers see ADEO's SOAR as the master and all features, such as common case management, playbook sharing, and war room usage, are available on the tenant offered to the customer. The incident management process is carried out through the SOAR platform. If requested, real-time notifications are sent to our customers through specially designed communication channels, such as Slack or PagerDuty.

For the SOAR tenant to be established in this structure, a server is needed at the customer's location. All data belonging to the customer is stored on the server at the customer's location.