4.3.1. SIEM and SOAR Concepts

💡 First Principle: SIEM (security information and event management) is about collecting and analyzing security data from across an environment to detect suspicious patterns, while SOAR (security orchestration, automated response) is about automatically acting on what's detected — and Microsoft Sentinel is significant specifically because it combines both into a single, cloud-native service rather than requiring two separate products stitched together.

A traditional SIEM alone tells you what happened, but a human still has to manually investigate and respond to every alert. Adding SOAR closes that gap: predefined playbooks can automatically isolate a compromised device, disable a suspicious account, or notify a team the moment a matching incident is detected — cutting response time from hours to seconds for well-understood threat patterns.

⚠️ Exam Trap: SIEM and SOAR are two distinct concepts (detect/analyze vs. respond/automate) that Sentinel happens to combine — don't describe Sentinel as "only" a SIEM; that omits half of what makes it distinctive.

Reflection Question: Why does adding automated response (SOAR) meaningfully reduce the time between detecting a threat and actually containing it, compared to detection (SIEM) alone?