What is Chronicle SOAR?

Chronicle SOAR is the security orchestration, automation, and response side of Google SecOps, originating from Google's 2022 acquisition of Siemplify, providing case management, automated playbooks, and integrations that let analysts respond to threats faster than manual, ticket-by-ticket investigation would allow.

Its core building blocks are cases (grouping related alerts together for investigation), entities (the users, hosts, IPs, and other objects involved in a case, which can be explored for further context), and playbooks (automated, drag-and-drop-built workflows that can enrich, investigate, or remediate without requiring an analyst to manually perform every step).

Chronicle SOAR ships with a large catalog of third-party integrations — connecting to firewalls, EDR tools, ticketing systems, and identity providers — which is what lets a playbook actually take action across an organization's existing security stack (blocking an IP, disabling a user account, opening a ticket) rather than only surfacing information for a human to act on manually.