Which term refers to security operations that automate incident response and threat hunting without human input?

• A. Playbook
• B. Automation
• C. SOAR
• D. Runbook

Answer: (C)

The main idea here is a security operations approach that ties together multiple tools, runs predefined workflows, and automatically responds to incidents and hunts for threats with little or no human guidance. That integrated capability is SOAR.

SOAR stands for Security Orchestration, Automation, and Response. It brings together different security tools, coordinates their actions, and executes automated response steps when alerts occur. It can also run automated threat-hunting routines, pulling in data from various sources, enriching findings, and triggering containment or remediation without waiting for a human to intervene. The automation part handles repetitive tasks, but the real power of SOAR is the orchestration across tools and the end-to-end automated response workflow.

A runbook is simply a documented sequence of steps to follow, usually performed by a human operator. A playbook is a written plan for incident handling, which may be executed manually or automated within a SOAR. Automation refers to performing tasks without human input, but it doesn’t by itself describe the coordinated, cross-tool, end-to-end workflow that SOAR provides.