SOAR

Orchestration connects the tools so that routine response steps happen without somebody retyping the same thing into four consoles.

It is genuinely useful for the repetitive parts: enriching an alert, checking a reputation, isolating a host, opening a ticket. It does not supply judgement. Automating a bad process makes it happen faster, which is why organisations that automate before they have agreed what good looks like end up with confident, rapid, wrong responses.