Security information and event management (SIEM) system collects, analyzes, and stores security related data, including security incidents and events—data could range from firewalls and network devices to patterns that would indicate a cyber attack. SIEM tools typically need a degree of calibration and oversight to determine the accuracy of the data collected and to triage the more important data, which can be labor intensive. SOAR programs are often automated and typically do not require a large degree of expert human oversight to determine if the security events are false positives or actual incidents that require investigation. Time spent investigating and mitigating can be used much more efficiently and usefully.