Overview Security Orchestration and Response (SOAR) Orchestration and Automation Threat intelligence Incidence response Cases (security alerts)—ingested from a variety of sources Playbooks—series of automated steps triggered by incoming alerts