Q10Security Concepts
What differentiates SIEM from SOAR?
← → navigate · a answer
Community votes
Discussion · 2
4
correct
siem is log managment
soar is vulnerability managment that automates and response
B 1
Selected Answer: B
The correct answer is B. SIEM's main role is to collect and detect anomalies, while SOAR is more centered on security operations automation and response.
- SIEM (Security Information and Event Management): Works as the "brains" or centralized aggregator. Its main job is to ingest logs from throughout the network, correlate events, and detect security anomalies or threats.
- SOAR (Security Orchestration, Automation, and Response): Works as the "muscle" or responder. Its main job is to take the alerts produced by the SIEM (or other tools) and use automated playbooks to coordinate, investigate, and mitigate the threat without needing human intervention for every step.