Exam MS-900 topic 1 question 408 discussion

SOAR vs. SIEM If you’re exploring security solutions, then you’ve likely come across a related security tool with a similar-sounding acronym: security information and event management (SIEM). What is SIEM, and how does it differ from SOAR? When should one solution be used over the other? While SOAR tools are primarily used to orchestrate and automate threat response, SIEM offers greater visibility into activity through threat detection, log management, incident analysis, and regulatory and standards compliance. This visibility is achieved by logging and consolidating multiple streams of data from across your network, providing a bird’s-eye view of your organization’s overall security landscape. The two systems work best in tandem. SIEM collects and analyzes data, SOAR runs based on that data—forming a complete solution for risk detection, visibility, and response. Answer: NO, NO, Yes

Q1 and Q2 are opposite explanations. So Q1 and Q2 are No.

Q1 and Q2 are opposite explanations. So Q1 and Q2 are No.

Playbook - Yes Start when a new Microsoft Sentinel incident is created. Send a message to your security operations channel in Microsoft Teams or Slack to make sure your security analysts are aware of the incident.