<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-soar-workflows
description: >-
  Design and implement SOAR automation workflows for SOC operations including
  playbook orchestration, API integrations, enrichment chains, containment
  actions, and multi-tool coordination across XSOAR, Splunk SOAR (Phantom),
  and Tines platforms.
domain: cybersecurity
subdomain: soc-operations
tags:
  - soar
  - automation
  - xsoar
  - phantom
  - tines
  - orchestration
  - playbook
  - api-integration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing SOAR Workflows

## Overview

SOAR platforms orchestrate security operations by automating enrichment,
containment, and response actions across toolsets. Effective SOAR workflows
reduce MTTR, ensure consistent response quality, and free analysts from
repetitive manual tasks. This skill covers workflow design patterns across
major SOAR platforms.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SOAR platform (XSOAR/Phantom/Tines) | Workflow engine |
| API keys for security tools | Tool integration |
| SIEM webhook or polling config | Alert ingestion |
| Network segmentation for containment | Safe automated actions |

## Key Concepts

### Workflow Design Patterns

```yaml
# Pattern: Enrichment Fan-Out
# Send IOC to multiple sources in parallel, aggregate results
enrich_fanout:
  trigger: new_alert
  parallel:
    - virustotal_lookup:
        input: alert.ioc
        timeout: 30s
    - abuseipdb_check:
        input: alert.ioc
        timeout: 15s
    - greynoise_query:
        input: alert.ioc
        timeout: 15s
  aggregate:
    method: merge_results
    verdict: majority_malicious

# Pattern: Conditional Escalation
# Route based on enrichment results
conditional_route:
  if: verdict == "malicious"
  then:
    - contain_endpoint
    - create_incident
    - notify_soc_lead
  elif: verdict == "suspicious"
  then:
    - add_to_watchlist
    - schedule_followup
  else:
    - close_alert
    - log_false_positive
```

### XSOAR Playbook (Demisto)

```python
# XSOAR integration command
def ip_enrichment_command():
    ip = demisto.args().get("ip")
    results = []

    # VirusTotal enrichment
    vt_response = http_request("GET", f"/api/v3/ip_addresses/{ip}",
                               headers={"x-apikey": VT_API_KEY})
    vt_score = vt_response.get("data", {}).get(
        "attributes", {}).get("last_analysis_stats", {})

    # AbuseIPDB enrichment
    abuse_response = http_request("GET", "/api/v2/check",
                                  params={"ipAddress": ip},
                                  headers={"Key": ABUSE_API_KEY})
    abuse_score = abuse_response.get("data", {}).get(
        "abuseConfidenceScore", 0)

    verdict = "malicious" if (
        vt_score.get("malicious", 0) > 3 or abuse_score > 80
    ) else "clean"

    return CommandResults(
        outputs_prefix="IOC.IP",
        outputs={"address": ip, "verdict": verdict,
                 "vt_malicious": vt_score.get("malicious", 0),
                 "abuse_score": abuse_score},
    )
```

### Splunk SOAR (Phantom) Action

```python
# Phantom playbook action block
def containment_action(action, success, container, results):
    """Block malicious IP at firewall."""
    parameters = []
    for result in results:
        if result.get("verdict") == "malicious":
            parameters.append({
                "ip": result["ip"],
                "direction": "both",
                "comment": f"Blocked by SOAR - Alert {container['id']}"
            })

    if parameters:
        phantom.act("block ip",
                     parameters=parameters,
                     assets=["palo_alto_firewall"],
                     callback=containment_callback)
```

### Tines Story (Low-Code)

```json
{
  "name": "Phishing Auto-Triage",
  "agents": [
    {
      "type": "webhook",
      "name": "receive_alert",
      "options": {"path": "/phishing-alert"}
    },
    {
      "type": "http_request",
      "name": "check_virustotal",
      "options": {
        "url": "https://www.virustotal.com/api/v3/urls/{{url_id}}",
        "headers": {"x-apikey": "{{CREDENTIAL.virustotal}}"}
      }
    },
    {
      "type": "trigger",
      "name": "is_malicious",
      "options": {
        "rules": [{"path": "$.malicious_count", "type": "field>value", "value": "3"}]
      }
    },
    {
      "type": "http_request",
      "name": "block_in_proxy",
      "options": {
        "url": "https://proxy.internal/api/blocklist",
        "method": "POST",
        "body": {"domain": "{{extracted_domain}}"}
      }
    }
  ]
}
```

## Workflow

1. **Map** — Identify top alert types and current manual response steps
2. **Design** — Draw workflow with decision points and parallel paths
3. **Integrate** — Configure API connections to all required tools
4. **Build** — Implement workflow in SOAR platform
5. **Test** — Validate with known-good and known-bad test data
6. **Deploy** — Enable in production with human-in-the-loop gates
7. **Monitor** — Track execution metrics and failure rates
8. **Optimize** — Remove bottlenecks, add error handling

## Verification

| Check | Method |
|---|---|
| Workflow executes end-to-end | Test with synthetic alert |
| API integrations functional | Health check each connector |
| Error handling covers failures | Inject API timeout/failure |
| Human approval gates work | Test escalation path |
| Execution time within SLA | Measure workflow duration |
