## SOAR Platforms Overview

### 1. Palo Alto XSOAR (Demisto)
The market leader.
*   Uses a drag-and-drop playbook editor.
*   Thousands of integrations.
*   "War Room" feature where chat and commands are mixed.

### 2. Splunk SOAR (Phantom)
*   Tightly integrated with Splunk.
*   Python-centric.

### 3. Tines
*   The modern, lightweight challenger.
*   No-code. Looks like a flowchart. Very popular because it is easy to learn.

### 4. Microsoft Logic Apps / Sentinel
*   If you use Sentinel, you create "Playbooks" using Logic Apps.
*   Very cheap and powerful for Azure environments.

### The Workflow of a Playbook
1.  **Trigger**: New Alert from SIEM.
2.  **Enrichment**:
    *   Query threat intel (VirusTotal).
    *   Query LDAP (Get user's manager).
3.  **Decision (Condition)**:
    *   Is it Malicious? (VirusTotal > 5/70).
4.  **Action**:
    *   If Yes -> Isolate Host.
    *   If No -> Close Ticket as False Positive.