SIEM vs SOAR vs XDR: which tool does what
A SIEM (security information and event management) collects logs from many sources, correlates them and raises alerts. A SOAR (security orchestration, automation and response) runs automated workflows, called playbooks, that act on those alerts. An XDR (extended detection and response) joins detections from one vendor’s endpoint, identity, email and cloud products into single incidents and responds on those same products. The decision rule: if the question is about collecting and correlating data from anywhere, the answer is SIEM; if it is about automating a repeatable response, SOAR; if it is about one incident spanning the protected product set with built-in response, XDR.
The three tools side by side
| SIEM | SOAR | XDR | |
|---|---|---|---|
| Core job | Collect, normalise, correlate, alert, retain | Orchestrate tools and automate response steps | Correlate signals across a product suite and respond |
| Data scope | Any source you connect: firewalls, servers, cloud, identity, third-party | Alerts and incidents it receives, plus whatever the connected tools return | The vendor’s own sensors: endpoints, identities, email, cloud apps |
| Typical output | Alerts, incidents, dashboards, searchable history | Closed tickets, blocked IPs, disabled accounts, enriched incidents | One incident that groups related alerts, plus automated containment |
| Acts on systems | Rarely by itself | Yes, through connectors and APIs | Yes, natively on its own products |
| Microsoft | Microsoft Sentinel | Sentinel automation rules and playbooks | Microsoft Defender XDR |
Microsoft’s documentation describes Sentinel as a cloud-native SIEM and lists automation rules and playbooks among its response capabilities, so it covers the SOAR role too, which is why exam answers about “Sentinel automation” are not a contradiction. Its playbooks are built on Azure Logic Apps, and automation rules decide when they run (Microsoft Sentinel overview). Defender XDR is described as a coordinated suite that natively correlates detection, investigation and response across endpoints, identities, email and applications (Defender XDR overview). Cisco also sells an XDR product, which the Cisco platforms topic in 200-901 expects you to place among its security products.
One incident through all three
Take a finance clerk whose account signs in from two countries within ten minutes.
- SIEM. Sign-in logs from the identity provider and records from the VPN and a third-party firewall are already in the SIEM. A rule that joins them flags impossible travel and raises an alert. Only a tool that holds data from several unrelated sources can make that join.
- SOAR. The alert triggers a playbook. It looks up the IP address in threat intelligence, adds the result to the incident, opens a ticket and, if the reputation is bad, revokes the user’s sessions. No analyst typed anything.
- XDR. Meanwhile the endpoint sensor on the clerk’s laptop reports a suspicious process and the mail protection reports a phishing email delivered earlier. The XDR groups the three alerts into one incident and shows the chain from email to endpoint to sign-in. With high enough confidence it can contain the device or disable the account without waiting for a human.
The three layers overlap, and real deployments run all of them. Microsoft is also merging the two experiences: Sentinel is generally available in the Microsoft Defender portal, and its documentation states that after March 31, 2027 Sentinel will no longer be supported in the Azure portal.
Where products blur the lines
- Sentinel is SIEM plus SOAR. A question that asks for “the SIEM” and one that asks for “the automation” can both be answered with Sentinel. Read what is actually being done.
- XDR is not just a bigger EDR. EDR watches endpoints. XDR extends detection to identity, email and cloud apps and merges them into one incident.
- XDR sees what its sensors see. Defender XDR correlates signals from the products you have licensed and provisioned. A firewall from another vendor reaches an analyst through a SIEM.
- Two kinds of automation. In SC-200 terms, Defender XDR has automated investigation and remediation and automatic attack disruption, which act by themselves. Sentinel has automation rules and playbooks you design. The first is built in, the second is built by you. See Sentinel explained and Defender XDR vs Defender for Cloud.
Which exams test this
| Exam | How it appears | On this site |
|---|---|---|
| SC-200 | Manage a security operations environment (40–45%), the largest domain: configure the Sentinel SIEM, its automation rules and playbooks, and Defender XDR automation and attack disruption; Respond to security incidents (35–40%): work incidents in both | Manage security operations, Respond to incidents |
| SC-900 | Capabilities of Microsoft security solutions (35–40%): define SIEM and SOAR, describe Sentinel, and describe the Defender XDR services | Microsoft security solutions |
| SC-500 | Manage and monitor security posture (20–25%): set up event collection in the Sentinel SIEM and implement its automation rules and playbooks | Security posture |
| SY0-801 | Security operations (27%): EDR and XDR as endpoint security (4.1), SIEM among the monitoring tools (4.4) and automation and orchestration of security tasks (4.6); SOAR appears only in the acronym list | Security operations |
| N10-009 | A minor topic. Network operations (19%): log aggregation with a syslog collector and a SIEM, under network monitoring technologies (3.2) | N10-009 network operations explained |
| AB-900 | A minor topic. Core features and objects of Microsoft 365 services (30–35%): features and capabilities of Defender XDR; SIEM and SOAR are not named | Microsoft 365 core features |
| 200-901 | A minor topic. Cisco platforms and development (15%): describe Cisco security platforms and APIs, with XDR in the list (3.5) | Cisco platforms |
SC-200, SC-900 and AB-900 rows follow the English outlines that take effect in October 2026 (minor changes). SY0-801 launches on November 17, 2026; until then SY0-701 is the live Security+ exam.
How the questions are built
Questions give you a job and four tools. The constraint words decide.
- “From multiple sources”, “third-party”, “on-premises”, “retain for investigation” point to the SIEM.
- “Automatically”, “without analyst intervention”, “when an incident is created”, “open a ticket” point to SOAR, which in Microsoft terms means an automation rule or a playbook.
- “Single incident across email, endpoint and identity”, “attack disruption”, “self-healing” point to XDR.
- The common trap is picking the SIEM for a response task because it “has everything”. A SIEM that only alerts does not remediate.
- The second trap is picking a playbook when the question is about grouping alerts, which is correlation, a SIEM or XDR function.
- On SY0-801, a SIEM alert on impossible travel is an indicator of compromise, and the tool is only the messenger.
Next steps: the incident response lifecycle shows where each tool fits in the process, and KQL is the language you use in both Sentinel and Defender hunting.
Practice questions
Question 1. A company wants to collect logs from on-premises firewalls, a third-party SaaS application and Azure resources in one place, correlate them and alert on suspicious patterns. Which category of tool is designed for this?
- A. EDR
- B. XDR
- C. SIEM
- D. A password manager
Show answer
Answer: C
A SIEM ingests and correlates data from many different sources and raises alerts. A SOAR automates response to alerts but is not the primary collector. An XDR correlates signals from its own product suite, so a third-party firewall and SaaS app are outside its natural scope. An EDR monitors endpoints only.
Question 2. Whenever a high-severity incident is created in Microsoft Sentinel, a ticket must be opened in the service desk system and the affected user's sessions revoked, with no analyst action. What should you configure?
- A. An automation rule that runs a playbook
- B. A workbook
- C. A watchlist
- D. A hunting query
Show answer
Answer: A
Sentinel automation rules run when an incident is created and can run a playbook, which is built on Azure Logic Apps and can call the service desk and identity systems. A workbook only visualises data. A watchlist stores reference data for queries. A hunting query finds activity but takes no action.
Go deeper
- What is Microsoft Sentinel SIEM? on Microsoft Learn
- What is Microsoft Defender XDR? on Microsoft Learn
- Automate threat response with playbooks in Microsoft Sentinel
- Related guides: Sentinel explained, Zero Trust explained, how to read a skills outline