Security Orchestration, Automation and Response (SOAR) platform typically encapsulates an automation engine and an orchestrator module that connects and operate over security devices.

Playbooks, also known as runbooks, and Workflows are the key components of a SOAR platform that drive value out of the platform alongside integrating with multiple security devices including, but not limited to, Security Information and Event Management (SIEM), Vulnerability scanner, Firewalls, ITSM tools in a given network. This enables organizations respond to security events in a repeatable and consistent manner with minimal to no human intervention.