Which platforms coordinate and automate security tasks across multiple tools and processes?

• A. SIEM
• B. EDR
• C. SOAR platforms
• D. NDR

Answer: (C)

SOAR platforms coordinate and automate security tasks across multiple tools and processes. They act as a central automation hub that connects different security tools—like SIEM, EDR, NDR, firewalls, threat intel feeds, and ticketing systems—and runs standardized workflows called playbooks. These playbooks guide incident handling from detection to remediation, automatically triaging alerts, enriching them with data from various sources, performing containment actions, and creating or updating tickets for the SOC team. This orchestration speeds response, reduces manual handoffs, and provides a clear, auditable trail of what actions were taken. By design, SIEMs focus on collecting and analyzing logs, EDRs specialize in endpoint detection and response, and NDRs focus on network-based detection; they can operate independently, whereas a SOAR brings them together to automate cross-tool actions and coordinated response.