Inventory your SIEM, SOAR and playbooks before you buy

List 1: alert sources

Write down every tool that sends alerts to your queue: SIEM, EDR, identity provider, email security, cloud security and anything else. Put them in order of alert volume. This list is your first filter for any vendor. Integration counts on vendor pages, such as 90+ or 300, tell you breadth; only a named list tells you whether your sources are covered.

List 2: playbooks

If you run SOAR, export the playbook list and mark each one:

• Runs often and works: keep it, whatever else you buy.
• Runs often and needs constant fixes: a candidate to replace.
• Rarely runs: a candidate to retire.

Then look at what vendors offer for the keepers. Approaches differ. Mate Security says it translates SOAR playbooks into its Gamebooks, replacing brittle API calls while keeping custom logic. Torq rebuilds them as workflows in its natural-language builder. Dropzone AI leaves them where they are and hands response to your SOAR; it lists Cortex XSOAR, Splunk SOAR, Tines, Torq, D3 Security, IBM QRadar SOAR and Swimlane among its integrations. Cortex XSOAR, through AgentiX, adds AI prompts inside existing playbooks.

List 3: response actions

Write down the response actions your team actually takes, such as disabling an account, isolating a host, blocking a hash or revoking a session. Next to each, note which tool performs it and who may approve it today. This list becomes your response action catalog (the next lesson in this track) and tells you what any new product must be able to do, natively or through another tool.

What do the lists tell you about the model?

• Many keeper playbooks: SOAR stays, and the question is what to add beside it.
• Few keepers and a SIEM: you can start agent-first.
• No SIEM and few sources: a provider that brings tooling may remove a project.
• Many actions that need approval at night: look again at staffing before choosing.

What to ask vendors with the lists in hand

Send the source list and ask which are supported today, by name. Send three playbooks and ask what happens to them. Send the action list and ask which run natively and which need another tool.

How long does the inventory take?

For most teams, an afternoon. The source list comes from the SIEM's data source settings, the playbook list from the SOAR's export or admin screen, and the action list from a review of the last month's closed incidents. Keep the three lists in one document; they are the attachment to every vendor conversation that follows.

Words in this lesson: Alert, Playbook, SIEM, EDR, SOAR