2.3.1. SIEM, SOAR, and EDR
💡 First Principle: SIEM, SOAR, and EDR form a detection-response stack — SIEM provides the centralized view, SOAR automates the triage and response, and EDR provides endpoint depth that network-level tools can't see.
SIEM (Security Information and Event Management) centralizes log collection and correlation from across the environment. Core functions:
| SIEM Function | What It Does | Why It Matters |
|---|---|---|
| Log aggregation | Collects logs from all sources into one place | Enables cross-source correlation |
| Normalization | Converts different log formats into a common schema | Allows correlation across unlike systems |
| Correlation rules | Matches patterns across events from multiple sources | Surfaces multi-step attacks invisible in single logs |
| Alerting | Generates actionable notifications when rules fire | Directs analyst attention |
| Retention | Stores logs for investigation and compliance | Forensic investigation, regulatory requirements |
| Dashboard/reporting | Visualizes security posture | Management reporting, trend analysis |
Common SIEMs: Splunk, IBM QRadar, Microsoft Sentinel, Elastic SIEM. The CySA+ exam is vendor-neutral but expects understanding of SIEM functions.
SOAR (Security Orchestration, Automation, and Response) extends the SIEM by automating the response workflow. When a SIEM alert fires, SOAR can automatically: enrich the alert (query threat intel for the IP; look up the user in HR systems), execute containment actions (block the IP at the firewall, disable the user account), and ticket the incident. Human analysts review completed playbook runs rather than manually executing each step.
Key distinction: SOAR automates defined, repeatable responses. Novel attacks or complex investigations still require human analyst judgment.
EDR (Endpoint Detection and Response) provides deep visibility into endpoint activity — process creation, network connections, file modifications, registry changes, memory access — and the ability to respond (isolate the endpoint, kill a process, pull a forensic image). EDR is the evolution of antivirus: instead of only blocking known-bad signatures, it records everything and enables behavioral detection.
XDR (Extended Detection and Response) extends EDR to correlate signals across endpoints, network, cloud, and identity — essentially a more integrated version of the SIEM+EDR combination.
⚠️ Exam Trap: SOAR does not eliminate the need for analysts — it eliminates the need for analysts to perform repetitive, well-defined tasks. The exam will present scenarios where SOAR is appropriate (block known-bad IP, disable compromised account) vs. where human judgment is required (investigate novel malware, decide on incident severity). Know the difference.
Reflection Question: A SOAR playbook automatically blocks outbound connections to IPs flagged in a threat intelligence feed. An attacker pivots to using a compromised legitimate CDN as a proxy for C2. Why does the SOAR automation fail to block this traffic, and what kind of detection would be needed instead?
