General Concepts

SIEM vs. SOAR

Definition

A SIEM (security information and event management) collects and analyzes security data from across the organization to detect threats and investigate incidents. A SOAR (security orchestration, automation, and response) automates the response, for example by disabling accounts or opening tickets.

Exam context

In SC-900 Microsoft Sentinel is the example of SIEM + SOAR: connectors and analytics rules to detect, and Azure Logic Apps-based playbooks to automate response.

Studying for the SC-900?

SIEM vs. SOAR is a concept that can show up on the exam. Check the full guide to see it in context.