SIEM vs SOAR illustrated via the Tesla App

In IT security, the terms SIEM (Security Information and Event Management) and SOAR (Security Orchestration and Automated Response) sometimes causes confusion or are used interchangeably. A recent notification on a Tesla App will help to illustrate the differences.

On the Apple Watch, the owner received a notification from the Tesla App that they left the trunk open on their Tesla:

So let's map this to cybersecurity terms.

Tesla detects the trunk is open and notifies you → in the cybersecurity world, this is done by  SIEM

1. It monitors the state of the system.
2. It detects an event ("trunk left open").
3. It alerts you.

Tesla app lets you tap a button to close the trunk → in the cybersecurity world, this is done by  SOAR (because human is needed to press the Close Rear Trunk button, this is the human in the loop version of SOAR)

• The app is enabling a response.
• In cybersecurity, SOAR goes a step further by automating the response or guiding it through a predefined workflow

In conclusion - using everyday experience of the Tesla App informing the owner that the trunk is open and allowing them to close the trunk remotely - this example can be mapped to cybersecurity SIEM versus SOAR:

• SIEM: "Your trunk is open." (Detection + Alert)
• SOAR (human in the loop): You tap Close Trunk. (Response orchestrated through the app)
• SOAR (fully automated): If the trunk has been open for 5 minutes and no one is nearby, the car automatically closes it and logs the action. (Automated response)