Tenant isolation
Each organization's data is separated by row-level security in the database as well as by the application.
Cibera SOAR · a Cibera Security product
Every alert from every tool, worked in one place.
Cibera SOAR receives alerts from your SIEM and security tools, keeps the original source and a link back to it, removes duplicates, and gives each organization's analysts a secure workspace to triage, assign and close incidents.
- Multi-tenant
- built for SOC teams and managed service providers
- Any source
- signed webhook intake with a documented alert format
- Audited
- tamper-evident audit trail for every change
Capabilities
What Cibera SOAR does today
The case management core is complete. Automation playbooks and more native connectors are on the roadmap, built with customers rather than promised in advance.
- 01
Alert intake
A REST endpoint receives alerts from SIEMs, EDRs and scripts using per-integration credentials that can be rotated, expired and revoked. Retries are safe: the same alert never creates two incidents.
- 02
Source context kept
Each incident keeps the source product, original alert ID, timestamps and a link back to the alert in the originating tool. The raw payload is stored and shown only to authorized users.
- 03
Analyst workspace
Search and filter incidents, assign them, tag them, comment and move them through a clear status workflow. A dashboard shows what is open by severity and status.
- 04
Integrations health
See every inbound event, why it was rejected or failed, and reprocess it after fixing the cause.
- 05
Outbound API
Query and update incidents from your own tools and reports with scoped API tokens.
How it works
From a SIEM alert to a closed case
- Your SIEM or EDR sends the alert to the organization's intake address
- Cibera SOAR validates it, normalizes the fields and merges duplicates
- Analysts triage, investigate with the source link, and record what they did
- Every step is in the audit trail for reviews and customer reporting
Security
Designed for sensitive incident data
Incident data is some of the most sensitive information an organization holds. Isolation and accountability are built into the data layer, not added on top.
Strong sign-in
Two-step verification that administrators can require, login throttling, session revocation and secure password reset.
Accountability
A hash-chained audit log of sign-ins, administration, integration changes and incident updates, with integration secrets encrypted at rest.
Run your SOC on Cibera SOAR
Available as a hosted service or on your own infrastructure, with onboarding by our engineers.