Elevating Cybersecurity Posture by Implementing SOAR
David Roche, Seamus Dowling · 2023
Security Orchestration Automation and Response (SOAR) is implemented to expedite cyberthreat resolution. This paper is implementing an on-premises architecture for a Splunk Enterprise (SIEM) and SOAR, to assess the impact of overall efficacy of the solution. The Splunk SOAR Validated Architectures (SVAs) are reference designs for deployments that are reliable, effective, and repeatable. SVAs are created to ensure deployment of Splunk SOAR certified architectures. Splunk SOAR foundation is built on a recurrent architecture. Implementing a validated architecture and SVA will address issues with performance, complexity, efficiency, cost, agility, maintenance, scalability, and verification. SVAs architectural designs cover all deployment tiers and integrations according to design principles and best practices. This powerful cyber security solution provides complementary capabilities for optimising an organisation’s security posture. Extensive testing is conducted to validate SIEM/SOAR performance. The results demonstrate seamless integration of Splunk Enterprise SIEM System with Splunk SOAR, resulting in a robust and adaptable solution that efficiently addresses existing and future cybersecurity threats at all stages of the event roadmap.