Testing SOAR Tools in Use
Robert A. Bridges, Ashley E. Rice, Sean Oesch, Jeff A. Nichols, Cory, Watson, Kevin Spakes, Savannah Norem, Mike Huettel, Brian Jewell, Brian, Weber, Connor Gannon, Olivia Bizovi, Samuel C Hollifield, Samantha Erwin

TL;DR
This study evaluates the practical use of SOAR tools in security operations centers, analyzing their impact on efficiency, accuracy, and user preferences through a comprehensive user study involving multiple tools and scenarios.
Contribution
First hands-on user study of SOAR tools in SOCs, including experimental design, testing methodology, and insights into configuration and user preferences.
Findings
SOAR configuration is critical for effectiveness.
SOAR tools increase investigation efficiency and reduce context switching.
Ticket accuracy and completeness decrease with SOAR use.
Abstract
Modern security operation centers (SOCs) rely on operators and a tapestry of logging and alerting tools with large scale collection and query abilities. SOC investigations are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, and correlate the data into information and then document results in a ticketing system. Security orchestration, automation, and response (SOAR) tools are a new technology that promise to collect, filter, and display needed data; automate common tasks that require SOC analysts' time; facilitate SOC collaboration; and, improve both efficiency and consistency of SOCs. SOAR tools have never been tested in practice to evaluate their effect and understand them in use. In this paper, we design and administer the first hands-on user study of SOAR tools, involving 24 participants and 6 commercial SOAR tools. Our contributions…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Software System Performance and Reliability
