Instructor: In this lesson,
we will learn about security orchestration,
automation and response, or SOAR, platforms.
SOAR platforms include a suite of tools and processes
that streamline and automate security operations,
enabling organizations to detect, respond to,
and mitigate threats more efficiently.
SOAR platform implementation concepts
include playbooks and runbooks,
where playbooks are predefined workflows
typically outlined in incident response plans
that detail the steps to be taken
in response to specific types of security events.
Runbooks execute playbook workflows step by step,
incorporating automation to efficiently carry out tasks.
Let's learn more about playbooks and runbooks.
First, we have playbooks.
Incident response playbooks outline specific actions to take
in response to different types of security incidents.
A playbook acts as a checklist,
guiding teams through detection and response processes
for each incident type.
By preparing these playbooks in advance
as part of incident response documentation,
organizations ensure their teams
have a clear documented approach ready for emergencies,
streamlining their response efforts when incidents occur.
Most organizations create incident response plans
for major types of incidents.
Then, when an analyst identifies something suspicious,
they can categorize it as an incident
and assign it to an incident handler.
The incident handler then follows the appropriate playbook
using standardized procedures to guide their response.
For instance, incidents such as
distributed denial of service attacks,
malware infections, phishing, or data exfiltration
may each have dedicated playbooks
with detailed response steps to mitigate these threats.
In this way,
playbooks serve as incident operating procedures,
providing analysts and incident handlers
with clear instructions for each scenario.
If your organization lacks incident response playbooks,
pre-made examples are available.
Created by the Incident Response Consortium,
these playbooks offer templates
you can tailor to meet specific needs.
For example, the phishing playbook is a 10-page guide
based on the NIST,
or National Institute of Standards and Technologies,
incident response process,
with detailed steps for automating responses,
detecting and analyzing threats,
and containing, eradicating, and recovering from attacks.
This playbook includes flowcharts for each response phase,
from preparation and detection to post-incident review.
For instance, in the prepare phase,
there is guidance
on forming the core operations team, reviewing timelines,
and conducting incident response interviews.
In the detect phase,
flowcharts outline ways to categorize incidents.
While in the analyze phase,
the playbook helps define risk factors for effective triage,
so each phase is designed to provide actionable steps
for handling phishing incidents efficiently.
These playbooks are generic templates
that serve as a foundation
for creating customized guides within an organization.
They provide analysts with the guidance they need
to act efficiently,
using flowcharts to clarify each response action.
Additionally, Microsoft provides technical playbooks
at learn.microsoft.com
/e-us/security/operations/incident-response-playbooks.
These include response actions for specific threats
such as phishing, password attacks,
or malicious applications.
Next, for efficiency and consistency,
response actions can be automated using tools like a SOAR,
or security orchestration,
automation and response platform.
SOAR platforms streamline incident response
by orchestrating playbooks and integrating data
from security information and event, or SIEM, platforms.
This aids analysts with actionable insights,
allowing them to respond appropriately
to indicators of compromise or indicators of attack.
Additionally, modern SOAR platforms
leverage machine learning and artificial intelligence
to enhance decision-making and response accuracy.
By analyzing patterns across vast amounts of security data,
machine learning algorithms within SOAR platforms
can identify emerging threats
and learn from previous incidents,
allowing the system to refine its responses
independently over time.
AI-driven insights also help SOAR systems
dynamically adapt to new threats,
improving their ability to detect, prioritize,
and respond to incidents effectively.
These intelligent capabilities
reduce the need for manual intervention,
enabling automated playbooks that respond faster
and make context-aware decisions.
By combining playbook automation, data enrichment,
and AI-driven insights,
SOAR systems empower security teams
to respond swiftly and accurately
even in complex threat landscapes.
Second, we have runbooks.
During an incident,
a playbook may drive the provisioning of new resources,
creating accounts, disabling old accounts,
launching new virtual machines,
or fully re-imaging a client device.
For example, you might have a playbook
for a successful phishing campaign
that outlines a series of steps
that are taken anytime someone clicks on a link
in a phishing email.
These steps could include
deleting the email from the user's inbox,
checking if other users received the email,
isolating workstations that opened that email,
running virus scans on those machines,
performing a registry scan to confirm infection,
backing up user data,
then re-imaging the workstation
and restoring the user's data,
and finally reconnecting the workstation to the network.
Doing all of that manually would be time-consuming
while still being time-critical,
making the process prone to errors.
But by automating it with a SOAR platform,
we can create a runbook,
where a runbook is the automation of a playbook
that can partially or fully handle
the incident response process
with periodic checkpoints for human intervention.
In the previous phishing response example,
a runbook could perform the first six steps automatically
then pause to allow the analyst
to confirm whether the workstation should be re-imaged
in the seventh step.
Once the analyst confirms the action,
the runbook can resume,
completing the remaining steps.
Using runbooks increases efficiency
and allows a single analyst to handle much more work
than they could if they were managing everything manually.
This level of automation frees analysts
to focus on more complex tasks
rather than spending time on routine processes
that can be automated.
So, what types of playbooks and runbooks
should your organization implement?
Well, most organizations encounter
at least three common threats
that can benefit from proceduralized responses
in runbooks and playbooks.
Those are ransomware, data exfiltration,
and social engineering attacks.
First, let's discuss ransomware.
A ransomware playbook should outline the personnel,
processes and tools
to employ during a ransomware attack.
It should include steps
for determining which systems are impacted,
understanding the method of infection,
isolating affected systems,
and identifying the stakeholders for different scenarios
based on the data being held for ransom.
A key priority in ransomware playbooks
is to isolate and disconnect networks and systems quickly
to prevent the spread of ransomware across the network.
However, systems should remain powered on
to retain encryption keys in random access memory,
which forensic technicians
may need to access during analysis.
Second, data exfiltration.
Data exfiltration playbooks guide the steps necessary
to stop or mitigate a data exfiltration attack.
These playbooks should include notification requirements,
system analysis and forensic analysis
to determine what data was accessed and exfiltrated.
Forensic analysis often reveals which data was viewed
or exfiltrated out of the network.
Data exfiltration can occur through various methods
such as SQL injection, password compromise,
and lateral movement across the network
to access and remove data in sensitive data stores.
So data exfiltration playbooks
should emphasize protecting key data stores
and then identifying
any other potential points of compromise within the network.
Third is social engineering.
Social engineering, typically in the form of phishing,
requires a specific playbook.
This playbook should outline steps
for identifying phishing emails,
determining which users interacted with those emails,
and assessing the extent of the exploitation.
This playbook may also recommend notifying the user base
to be cautious of suspicious emails.
The playbook should further include steps
to identify all users who received, opened,
or clicked on the email,
then reset their passwords and re-image their workstations.
Additionally, analysts should open the email
in a sandboxed environment
to perform dynamic analysis on it,
identifying any IP addresses, URLs,
or other indicators of compromise
to detect similar threats in other locations of the network
and for future events.
So, remember, security orchestration,
automation and response, or SOAR, platforms
offer a range of tools and processes
that help streamline and automate security operations,
allowing organizations to detect, respond to,
and mitigate threats more efficiently.
Playbooks and runbooks are key elements
in SOAR implementation.
Playbooks are predefined workflows
that outline step-by-step actions
for responding to specific security incidents,
forming a clear guide for incident response teams.
Runbooks take this a step further
by automating these workflows,
usually with a SOAR platform,
executing tasks automatically
with periodic pauses for analyst input.
This automation allows security teams
to respond faster and more accurately,
especially in complex threat landscapes,
while freeing analysts to focus on higher-level tasks.