SIEM vs SOAR in one picture

In IT security, the terms SIEM (Security Information and Event Management) and SOAR (Security Orchestration and Automated Response) sometimes causes confusion or are used interchangeably. A recent notification on a Tesla App will help to illustrate the differences.

On the Apple Watch, the owner received a notificaiton from the Tesla App that i left my trunk open:

Tesla detects the trunk is open and notifies you → SIEM

1. It monitors the state of the system.
2. It detects an event ("trunk left open").
3. It alerts you.

Tesla app lets you tap a button to close the trunk → SOAR (human in the loop)

• The app is enabling a response.
• In cybersecurity, SOAR goes a step further by automating the response or guiding it through a predefined workflow

In conclusion -  SIEM versus SOAR - using a trunk left open:

• SIEM: "Your trunk is open." (Detection + Alert)
• SOAR (human in the loop): You tap Close Trunk. (Response orchestrated through the app)
• SOAR (fully automated): If the trunk has been open for 5 minutes and no one is nearby, the car automatically closes it and logs the action. (Automated response)