Which SOC function allows for accelerated incident response through the execution of standardized and automated playbooks that work upon inputs from security technology and other data flows?1 pointSIEMEDRSOARDLP

The SOC (Security Operations Center) function that allows for accelerated incident response through the execution of standardized and automated playbooks, which work upon inputs from security technology and other data flows, is SOAR (Security Orchestration, Automation, and Response).

Here's a step-by-step explanation:

1. Understanding the Options:

   • SIEM (Security Information and Event Management): This technology provides real-time analysis of security alerts generated by applications and network hardware. It focuses on collecting and analyzing data.
   • EDR (Endpoint Detection and Response): This focuses on detecting and investigating suspicious activities and potential threats on endpoints (computers, mobile devices, etc.).
   • SOAR (Security Orchestration, Automation, and Response): This technology helps in automating and orchestrating security operations, including incident response, by using standardized playbooks.
   • DLP (Data Loss Prevention): This technology is used to prevent data breaches by monitoring and controlling data transfers.

2. Identifying the Key Requirement:

   • The question specifies the need for "accelerated incident response" through "standardized and automated playbooks" that work with inputs from various security technologies and data flows.

3. Matching the Requirement to the Function:

   • SOAR is designed to automate and orchestrate security operations, including incident response. It uses standardized playbooks to automate responses to security incidents, thereby accelerating the response process.

4. Conclusion:

   • The function that fits the description provided in the question is SOAR.

Therefore, the correct answer is SOAR.