EP77 Operational Realities of SOAR: Automate and/or Enrich, Playbooks, Magic

Guest:

• Cyrus Robinson, SOC Director and IR Team lead at Ingalls Information Security

Topics:

• You've been using SOAR tools for years, so what do you think of the technology so far?
• What is driving SOAR adoption today? And what is inhibiting SOAR adoption?
• Realistically, how hard is SOAR to operationalize for a typical company?
• What are your favorite SOAR playbooks to start with?
• How to build, train and keep the SOAR team? Do they need to code to succeed?
• We like the SOAR maturity model approach. How would you imagine a SOAR adoption maturity model?
• How to implement SOAR from scratch in scaling operations? How to start? How to plan? How to not fail?

Resources:

• "A Simple SOAR Adoption Maturity Model" blog
• "Planning Is Paramount When Adopting SOAR" blog
• Siemplify community version