zcrSOAR - Security Orchestration, Automation & Response
zcrSOAR turns triage into a pull queue and runs playbooks under per-step Autonomous, Approval or Blocked gating, tracking Notify and Respond SLAs separately.
How does zcrSOAR decide which playbook actions run automatically?
Each playbook step is set to Autonomous, Approval, or Blocked. Autonomous steps run immediately; Approval steps wait for a role-gated sign-off; Blocked steps never run until the gating changes.
Can zcrSOAR generate new playbooks?
Yes — an AI assistant can draft a playbook from a prompt for review, and a playbook definition can also be imported directly as YAML or JSON.
Does zcrSOAR require zcrSIEM?
No. zcrSOAR connects to zcrSIEM as a bidirectional bridge when both are deployed, and it can also ingest from other connected sources such as an EDR platform — it is not limited to zcrSIEM alone.
How does zcrSOAR track SLA compliance?
Notify and Respond SLA are tracked separately, by case severity, against a compliance target, with mean time to acknowledge and mean time to respond, plus a breach list for cases that missed SLA.