{"id":7037,"date":"2021-06-23T12:43:59","date_gmt":"2021-06-23T10:43:59","guid":{"rendered":"https:\/\/tekmart.co.za\/t-blog\/?p=7037"},"modified":"2021-06-23T12:44:00","modified_gmt":"2021-06-23T10:44:00","slug":"the-differences-between-soar-and-siem","status":"publish","type":"post","link":"https:\/\/tekmart.co.za\/t-blog\/the-differences-between-soar-and-siem\/","title":{"rendered":"The differences between SOAR and SIEM"},"content":{"rendered":"Reading Time-approximately:<\/span> 2<\/span> minutes<\/span><\/span>\n

When it comes to the SOAR vs. SIEM debate, it’s important to understand their fundamental differences to get the most benefit from your security data.<\/strong><\/h2>\n\n\n\n
\"Andrew<\/figure>\n\n\n\n

By Andrew Froehlich<\/a><\/p>\n\n\n\n

It’s not easy to understand the key differences when looking at SOAR vs. SIEM, because they have many components in common. Security information and event management, or SIEM, tools are a way to centrally collect pertinent log and event data from various security, network, server, application and database sources. <\/p>\n\n\n\n

Common examples of sources include firewalls, intrusion prevention systems, antivirus and\u00a0antimalware software,\u00a0data loss prevention\u00a0tools and secure web content\u00a0gateways.<\/p>\n\n\n\n

The aggregated data is then analyzed by the SIEM in real time to spot potential security issues. Because multiple data sources are analyzed, the\u00a0SIEM identifies threats\u00a0by correlating information from more than one source. The SIEM then intelligently ranks the events in order of criticality.<\/p><\/blockquote>\n\n\n\n

Security administrators are commonly tasked with sifting through the various events to\u00a0track down and remediate the source of the potential threat\u00a0or simply acknowledge it and tune the analysis engine to mark the event as a benign occurrence. Doing so helps the\u00a0SIEM\u00a0software better learn what is considered a true threat versus an event that merely looks suspicious.<\/p>\n\n\n\n

How SOAR and SIEM improve SecOps<\/strong><\/h3>\n\n\n\n

While SIEM tools have been around for years,\u00a0Security Orchestration, Automation and Response\u00a0(SOAR) is the new kid on the block. When looking at SOAR vs. SIEM, both aggregate security data from various sources, but the locations and quantity of information being sourced are different. While SIEM will ingest various\u00a0log and event data\u00a0from traditional infrastructure component sources, a\u00a0SOAR takes in all that and more.<\/p>\n\n\n\n

\n