SOAR
SOAR stands for security orchestration, automation and response. A SOAR platform ingests alerts, runs playbooks across connected tools and tracks cases. It takes containment actions through integrations and does not detect threats itself, so it usually sits behind a SIEM or detection tool.
Definition
Orchestration connects tools. Automation runs steps without a person. Response is the actions taken against the threat. The three together are what a buyer expects when they say SOAR.
Newer platforms add AI agents on top of the playbook engine. The same questions apply: which actions, what gates, what record.
SOAR in Google Security Operations's documentation
Google's SOAR documentation describes a code-driven automation platform on Google Cloud with unified data ingestion, a playbook engine for response workflows and integration with SIEM, vulnerability scanners and other tools. vendor claim docs.cloud.google.com, read
The example names a vendor and its own page. A vendor's use of SOAR may differ from the definition above; the rubric uses the definition on this page.