A SOC already collects logs centrally and writes detection rules, but each confirmed alert still requires an analyst to run the same lookups and containment steps by hand. The team asks whether it needs a SIEM, a SOAR, or both. What fills the gap described?
Select an answer to reveal the explanation.
Short Explanation
Your SIEM is the smoke detector; it already tells you where the fire is. What's missing is the sprinkler system that kicks in automatically. That's SOAR, running playbooks so analysts stop repeating the same steps by hand.
Full Explanation
A SIEM collects, normalizes, stores and correlates log data to produce detections and support investigation. A SOAR platform orchestrates actions across tools and automates repeatable response through playbooks: enriching indicators with threat intelligence, querying other systems, opening tickets and executing containment such as blocking a domain or isolating a host, with analyst approval where required. The SOC in the scenario already has the SIEM functions, collection and detection, and lacks automation of repeated post-detection steps, which is precisely what SOAR provides. Deploying a second SIEM duplicates collection and detection but automates nothing, so analysts would still run every step by hand. Extending retention helps historical hunting and compliance but does not reduce manual response effort. Installing EDR on analyst workstations protects those machines; it does not automate response to alerts about other systems. Exam caveat: SIEM and SOAR are complementary, and many platforms integrate them, for example Splunk Enterprise Security with Splunk SOAR, but the exam distinguishes collect and correlate from orchestrate and automate. Operational check: pick one repeated triage procedure, implement it as a playbook, and measure the reduction in analyst handling time.