Ditched SIEM for SOAR last quarter and it saved our team 20 hours a week

We were drowning in alerts from Splunk at my last job in Denver. Triage alone took 3 people most of the day. We switched to a basic SOAR setup with automated playbooks for common stuff like phishing and brute force attempts. Now our SOC analyst handles what used to take a whole shift in like 2 hours. It's not perfect but the difference in response time is night and day. Has anyone else made that switch and seen similar results?

1 comments

1 Comment

umasullivan2d ago

SOAR just adds more complexity to an already messy stack.