SOAR: Security Orchestration, Automation and Response implementieren

A well-functioning SOC team is inundated with alerts every day - phishing reports, EDR alerts, SIEM correlations. SOAR (Security Orchestration, Automation, and Response) automates the repetitive tasks: analyzing email headers, checking reputation, creating tickets, and notifying users. What used to take 45 minutes now takes 45 seconds with SOAR. The SOC team can focus on real threats.

SOAR Architecture

SOAR System Components

Orchestration (connection layer):

• Connects all security tools via APIs
• Normalization: various formats → unified data model
• Bidirectional: SOAR can control tools (not just read them)
• Integrations: SIEM, EDR, firewall, email gateway, TI feeds, CMDB, ITSM

Automation (Playbooks):

• Predefined workflows for common incidents
• Triggers: SIEM alert, incoming email, manual start
• Actions: Analyze files, block IP, deactivate user, create ticket

Response:

• Automated Response: automatic actions without an analyst
• Analyst-in-the-Loop: System makes a recommendation → Analyst approves
• Case Management: all incident data collected in a single case

Typical SOAR data flow:

Alert (SIEM/EDR) → SOAR trigger → Enrichment (TI, WHOIS, GeoIP, CMDB) → Triage (severity, asset criticality) → Auto-response OR analyst task → Ticket (ServiceNow/Jira) + Documentation → Closure + Lessons-Learned Feed

SOAR Platforms

Microsoft Sentinel (Azure Playbooks)

• Basis: Azure Logic Apps (Low-Code/No-Code Workflows)
• Strengths: Native M365 integration, affordable for Azure customers
• Price: Pay-per-execution (cost-effective for low to medium usage)

Playbook example (JSON Logic App):

{
  "triggers": {
    "When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {}
  },
  "actions": {
    "Get_account_info": {
      "type": "ApiConnection",
      "inputs": {
        "host": {"connection": {"name": "@parameters('$connections')['azuread']"}},
        "method": "get",
        "path": "/v1.0/users/@{triggerBody()?['Entities']?[0]?['Name']}"
      }
    },
    "Condition_high_severity": {
      "type": "If",
      "expression": {
        "equals": ["@triggerBody()?['Severity']", "High"]
      },
      "actions": {
        "Disable_user": {...},
        "Create_incident": {...},
        "Notify_security_team": {...}
      }
    }
  }
}

Ready-made playbooks (Community):

• Azure Sentinel GitHub: 400+ ready-made playbooks
• Phishing: Automatically delete email from inbox
• MDE: Isolate endpoint on critical alert
• Entra ID: Disable user on credential compromise

---

Splunk SOAR (formerly Phantom)

• Strengths: Market leader, Python-based custom apps, most comprehensive integration
• Cost: Expensive (Enterprise), but free Community Edition
• Code-first playbooks, 500+ connector apps

Python playbook example:

def phishing_triage(action=None, success=None, container=None,
                    results=None, handle=None, **kwargs):
    """Automatic phishing triage playbook"""

    # 1. Retrieve email headers from alert
    sender = container.get('data', {}).get('from_address')
    subject = container.get('data', {}).get('email_subject')
    urls = container.get('data', {}).get('urls', [])

    # 2. Check IP reputation
    phantom.act('ip reputation', parameters=[{'ip': sender_ip}],
                assets=['virustotal'],
                callback=check_reputation)

    # 3. Check URL reputation
    for url in urls:
        phantom.act('url reputation', parameters=[{'url': url}],
                    assets=['urlvoid'],
                    callback=check_url_rep)

    # 4. Header analysis
    phantom.act('analyze email headers', parameters=[{...}],
                assets=['mail_listener'],
                callback=header_analysis_callback)

def check_reputation(action=None, success=None, results=None, **kwargs):
    score = results[0].get('data', {}).get('positives', 0)
    if score > 5:  # VirusTotal: > 5 engines flag IP
        # Critical: Auto-Block + High-Priority Alert
        phantom.act('block ip', parameters=[{'ip': results[0]['ip']}],
                    assets=['fortigate_firewall'])
        phantom.severity(container=container, severity='high')

---

Palo Alto XSOAR (Cortex XSOAR)

• Strengths: Most comprehensive out-of-the-box playbooks, powerful visualization
• Special feature: War Room (collaborative incident response interface)
• Integrations: 1000+ pre-built integrations

YAML Playbook Structure:

id: phishing-investigation
name: Phishing Investigation
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: start
    type: start
    nexttasks:
      '#none#': ["1"]
  "1":
    id: "1"
    task:
      id: get-indicators
      name: Extract Indicators from Email
      type: playbook
      playbookId: Extract Indicators - Generic v2
    nexttasks:
      '#none#': ["2"]
  "2":
    id: "2"
    task:
      id: check-reputation
      name: Check Reputation
      script: VirusTotal|||file
      scriptarguments:
        file: ${ExtractedIndicators.File}
    nexttasks:
      malicious: ["3"]
      clean: ["4"]

---

TheHive + Cortex (Open Source Stack)

• Cost: Free (Community), Enterprise support optional
• Strengths: FOSS, fully customizable, GDPR-compliant (on-premise)
• Stack: TheHive (Case Management) + Cortex (Automation) + MISP (TI)

Python Cortex Analyzer:

class VirusTotalAnalyzer(Analyzer):
    def run(self):
        data = self.get_data()
        vt = VirusTotal(api_key=self.get_param('config.key'))
        result = vt.get_file_report(data)

        if result['positives'] > 5:
            self.report({
                'summary': f"{result['positives']}/{result['total']} detected",
                'level': 'malicious',
                'taxonomies': [
                    self.build_taxonomy('malicious', 'VirusTotal',
                                        'Score', str(result['positives']))
                ]
            })
        else:
            self.report({'level': 'safe'})

Playbook Design for Common Incidents

Playbook 1: Phishing Response

Trigger: User reports suspicious email (via "Report Phishing" button in Outlook → O365 API → SOAR)

Step 1 - Automatic Analysis (0-30 seconds):

• Extract email headers (From, Reply-To, Received)
• Check SPF/DKIM/DMARC → Fail = +Risk
• Extract URLs → URLVoid/VirusTotal Reputation
• Hash attachments → VirusTotal File Hash Check
• Sender IP → AbuseIPDB + GeoIP
• Domain age (whois) → New domain < 30 days = +Risk

Step 2 - Triage decision:

• Risk Score < 30: Benign → Notify user + Close
• Risk Score 30-70: Analyst review required (Ticket + Queue)
• Risk Score > 70: Malicious → Automated Response!

Step 3 - Automated Response (for Score > 70):

• Delete email from ALL mailboxes (O365: Remove-MailboxMessage)
• Block sender domain (Email Gateway API)
• Block URLs (proxy/DNS filter via API)
• Create ticket (ServiceNow/Jira) with all findings
• Notify analyst (Teams/email)
• SIEM correlation: other recipients of this email?
• Update TI feed: IOCs (domain, URL, hash) in MISP

Step 4 - Analyst Actions (for scores 30-70):

• War Room / Case: all data in a single view
• One-Click Actions: "Confirm Malicious" → Execute Step 3
• "Mark as Benign" → Close + Update training data

---

Playbook 2: Credential Compromise Response

Trigger: SIEM Alert: User login from an unknown country OR EDR Alert: mimikatz/credential dumping

Step 1 - Risk Assessment (automatic):

• User Profile: normal login locations, normal working hours
• Asset Criticality: regular user vs. admin vs. service account
• Concurrent Sessions: is the user logged in elsewhere at the same time?
• Recent Indicators: has this user appeared in other alerts?

Step 2 - Automatic Actions (high risk):

• Entra ID: Revoke user session (Revoke-AzureADUserAllRefreshToken)
• MFA: Forced MFA re-enrollment
• Conditional Access: Temporary block until analyst approves
• AD: Optional - Temporarily disable account
• Teams notification: Security team + user’s manager

Step 3 - Analyst Approval:

• "Confirm + Lock Account" → AD deactivation + reset
• "Confirm + Normal Processes" → Session revocation alone is sufficient
• "False Positive" → Add to allowlist for this IP/region

---

Playbook 3: Ransomware Detection

Trigger: EDR Alert: Mass File Encryption OR SIEM: Many file changes in a short period of time

Step 1 - Immediate Actions (AUTOMATED, < 60 seconds):

• Isolate endpoint (EDR API: Network Isolation)
• Disable user account (AD API)
• Notify CISO + Management (Email + SMS)
• Create incident ticket (P1 - highest priority)
• Activate business continuity plan (document link in ticket)

Step 2 - Forensic Support:

• Export EDR timeline (last 48 hours of activity)
• Back up endpoint network flows (last 24 hours)
• All other endpoints: Search for same indicators
• Check backup status: Last good backup? (CMDB API)

Step 3 - Containment Assessment:

• Has ransomware moved laterally? (Network flows)
• Which file servers did the endpoint access?
• Isolate other affected endpoints (bulk action)

SOAR Integration and Metrics

Technical Integration

API Webhooks (SIEM → SOAR):

# Sentinel → Logic App Webhook:
POST https://prod-XX.eastus.logic.azure.com:443/workflows/.../triggers/manual/paths/invoke
Content-Type: application/json

{
  "AlertName": "Suspicious PowerShell",
  "Severity": "High",
  "Entities": [{
    "Type": "Account",
    "Name": "john.doe@firma.de"
  }],
  "Description": "Encoded Command detected"
}

SOAR → ITSM (ServiceNow):

# ServiceNow Table API:
POST https://instance.service-now.com/api/now/table/incident
Authorization: Basic base64(user:pass)

{
  "short_description": "Security Incident: Phishing Campaign",
  "priority": "1",
  "category": "security",
  "assignment_group": "Security Operations",
  "work_notes": "Automated triage: Score=85, URLs blocked, Email deleted"
}

Bidirectional SIEM integration:

• Alert from SIEM → Launch SOAR playbook
• SOAR actions → Write back to SIEM alert as notes
• Closure in SOAR → Automatically close SIEM alert

---

SOAR success metrics

KPIs:

---

SOAR Implementation - Project Plan

Phase 1 - Foundation (Months 1-2):

• Select SOAR platform (Sentinel/XSOAR/Splunk SOAR)
• Connect key integrations (SIEM, EDR, AD)
• Implement phishing playbook (most common alert type)
• Create runbook documentation for all playbooks

Phase 2 - Expansion (Months 3-4):

• Cover the 5 most common alert types with playbooks
• ITSM integration (ticket automation)
• SOC team training (how to expand playbooks?)
• Build metrics dashboard

Phase 3 - Optimization (Month 5+):

• Feedback loop: Analyst feedback → Playbook improvement
• ML integration: Anomaly scoring improves triage
• New use cases: Cloud alerts, identity events
• Quarterly SOAR playbook review (remove outdated logic)