Cybersecurity · 9 min
SIEM, SOC and SOAR in plain language
Three ideas: collect events, staff a response, automate the boring steps. Tools are optional until the ideas work.
SIEM (security information and event management) is centralized collection and search. Logs from identity, endpoints, network and cloud land in one place so someone can ask 'what happened'. Without sources and retention, a SIEM is an empty warehouse.
SOC (security operations centre) is the operating model: who watches, during which hours, how they escalate, what they are allowed to shut down. A SOC can be three people with a rota. It is not a room in a film.
SOAR (orchestration, automation, response) is playbooks: when this alert fires, do these steps, ask this human, ticket that system. Automation without a playbook just moves noise faster.
Buy tools after you can describe those three sentences for your organization. Otherwise you will pay for dashboards nobody queries.
Shefa will consult on this design. We will not pretend a logo is a capability. If you need testing of whether detection actually fires, that is a scoped, authorized exercise — not a surprise scan.