Security Engineering · Topic 8 of 8
SOAR and AI Assisted Security
Use SOAR playbooks, enrichment, orchestration and AI or machine learning assistance in the SOC, with human approval, guardrails and awareness of AI risks.
- 5 min
- Includes a diagram
- SOAR chains tools and actions into playbooks that run on triggers such as SIEM alerts.
- Enrichment adds context and often saves the most analyst time.
- Automate low risk, high volume tasks, and keep humans on high impact decisions.
What it is
Security orchestration, automation and response (SOAR) platforms connect security tools and run predefined workflows called playbooks. Automation does a task. Orchestration chains many tasks across many tools into one process.
Artificial intelligence (AI) and machine learning (ML) add pattern finding and language based help for analysts. Both aim to cut the time between an alert and a correct response, but both need limits so that speed does not become reckless action.
How it works
Playbooks and runbooks
A runbook is a documented procedure that a person follows. A playbook is that procedure turned into an automated workflow, with decision points and actions. Typical triggers are alerts from a security information and event management (SIEM) system, phishing reports from users, or findings from scanners.
A phishing playbook might extract links and attachments from a reported email, check them against threat intelligence, search mailboxes for the same message, delete copies and block the sender, then open a ticket for review. The analyst reviews outcomes instead of doing each step.
Enrichment, response and case management
| Stage | What happens |
|---|---|
| Enrichment | Add context to an alert: reputation of an address, asset owner, user role, recent related alerts |
| Decision | Rule or score decides severity and next step |
| Response | Block an address, disable an account, isolate a host, revoke tokens, reset a password |
| Notification | Message the owner or on call staff |
| Case management | Record every action and outcome in a ticket for audit and learning |
Integrations use APIs and connectors to each product. Enrichment is often the biggest time saver, because analysts spend much of their time collecting context.
Choosing what to automate
Automate steps that are frequent, high volume, well understood and low risk if wrong. Keep a person in the loop for steps that are rare, high impact or hard to reverse, such as disabling an executive's account or isolating a production server.
| Action | Suggested mode |
|---|---|
| Enrich an alert with reputation data | Fully automatic |
| Quarantine a reported phishing email | Automatic with logging |
| Isolate a laptop | Automatic or one click approval, depending on policy |
| Disable a production service account | Human approval |
Useful measures include mean time to detect (MTTD) and mean time to respond (MTTR, which here means respond rather than repair), the number of alerts handled without an analyst, and the false positive rate.
Machine learning and analytics
ML models can find anomalies in sign ins, network flows or process behavior that fixed rules would miss. User and entity behavior analytics (UEBA) builds a baseline for each account or device and scores deviations.
These tools give leads, not verdicts, and they need tuning, since a new baseline or a changed business process can trigger false alarms. Attackers can also try to train the model slowly toward bad behavior or to avoid its features.
Generative AI and large language models
Large language models (LLMs) can summarize alerts and incidents, explain unfamiliar commands, translate between query languages, draft detection rules and write first drafts of reports. They speed up analysts, especially on routine reading and writing.
They also bring risks.
- Hallucination: confident but wrong output, so verify before acting.
- Data leakage: sending logs, code or customer data to an external service may break confidentiality or compliance rules.
- Prompt injection: hostile text inside an alert, email or log could steer an AI agent that reads it.
- Excess authority: an AI agent with broad tool access can cause large harm if it errs or is manipulated.
- Over reliance: analysts may stop questioning output, a form of automation bias.
Guardrails
Practical controls include approved tools with a clear data policy, least privilege for any agent, human approval for high impact actions, logging of prompts and actions, testing against known cases before production use, and regular review of accuracy. Give the system only the data it needs and keep a manual fallback.
What to remember for the exam
- SOAR chains tools and actions into playbooks that run on triggers such as SIEM alerts.
- Enrichment adds context and often saves the most analyst time.
- Automate low risk, high volume tasks, and keep humans on high impact decisions.
- Playbooks need logging, testing and approval steps for risky actions.
- UEBA scores deviations from a learned baseline, and its output needs tuning and confirmation.
- LLMs speed summarization and drafting, but can hallucinate and can leak data.
- Prompt injection is a risk when an AI agent reads untrusted content.
- Limit AI agents with least privilege, approval gates and audit logs.
In a scenario about reducing response time, choose the answer that automates enrichment and containment of low risk cases, while keeping approval for disruptive actions.
Common mistakes
Automating before understanding the process. A playbook that mirrors a messy manual process only hides the mess.
Letting an AI take actions with no review. Errors and manipulation then reach production directly.
Treating an anomaly score as proof. It is a lead that needs confirmation.
Forgetting maintenance. Integrations break when products change versions, so playbooks need owners and tests.
Do not paste sensitive logs or customer data into an unapproved AI service. Check the data handling terms first.
Check yourself
Work through these three questions.
What is the difference between a runbook and a playbook?
A runbook is a documented procedure for people, and a playbook is that procedure automated as a workflow in a SOAR platform.
Which actions should keep a human in the loop?
Rare, high impact or hard to reverse actions, such as disabling a critical production account.
Why is prompt injection relevant to an AI agent reading alerts?
Hostile text inside the data it reads can steer its behavior, so its tool access must be limited and monitored.
Topic 8 of 8 in Security Engineering
Test yourself on Security Engineering
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.