Logsign SOAR

Short Summary

Cyberattacks have grown in number and sophistication while many organizations still rely on fragmented security stacks, sometimes operating 50+ disjointed tools. Although SIEM products remain foundational in many Security Operations Centers (SOCs), they have not fully solved the problem of efficient incident handling. In parallel, incident investigation and response platforms have evolved into SOAR solutions, driven by demand for centralized, automated control over analysis and response workflows across disparate tools. SOAR platforms complement or integrate with SIEMs to reduce Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR), which can reach roughly six months and two months respectively, increasing the damage from incidents.

SOAR’s core value is orchestration and automation via out-of-the-box connectors (integrations) that pull telemetry from upstream sources and can also trigger actions in downstream tools through exposed APIs. Beyond collecting and correlating events, SOAR can open cases, enrich alerts with additional forensic evidence (e.g., EPP scan outputs, non-standard logs, memory dumps), initiate automated threat hunts, and query cyber threat intelligence (CTI) sources. Some solutions add machine learning to reduce false positives and deliver more actionable intelligence, ideally automating substantial work before analysts are alerted.

Logsign, founded in 2010, launched SIEM in 2015 and SOAR in 2021. Logsign SOAR is primarily on-premises on Ubuntu Linux, with cloud-ready and SaaS plans targeting GCP. Licensing is based on incidents tracked per day and the number of integrations. Logsign highlights its Personal Workbench as a differentiator: an analyst-centric console with prioritized task lists, drill-down investigation views, collaborative case management, an emergency escalation button, and visibility into playbook execution. Playbooks are executed by specialized “bots” (investigation, analysis, response, remediation) enabling parallel activity streams. The product offers extensive integrations (roughly 300), a visual playbook editor, CTI and sandbox feed ingestion, dashboards for MTTD/MTTR, and a customer-extensible knowledge base. Key challenges include the need for broader cloud/SaaS integrations and the absence (so far) of strong console authentication/MFA, which is on the roadmap.

Interesting Facts

• Some organizations administer over 50 different and disjointed security tools.
• Mean Time to Detect (MTTD) can be in the neighborhood of six months or more.
• Mean Time to Resolve (MTTR) can take two months or more depending on incident severity.
• Logsign was founded in 2010 and has offices in the Netherlands, Turkey, and the US.
• Logsign’s SIEM product launched in 2015 and Logsign SOAR debuted in 2021.
• Logsign SOAR is primarily an on-premises product running on Ubuntu Linux.
• Containerized, cloud-ready versions are in development for GCP, with plans to launch SOAR as SaaS in 2021 running in GCP at launch.
• Licensing is based on the number of incidents tracked per day and the number of utilized integrations, packaged monthly or annually.
• Logsign has roughly 300 integrations for IT management and security products and services available.
• Logsign SOAR includes more than 300 playbook actions.

Notable Quotes

• “SOAR solutions can help organizations reduce the Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR) security incidents.”
• “Orchestration and automation of responses is key to reducing these KPIs and damage resulting from security incidents.”
• “Integrations are the key to success with SOAR.”
• “Logsign considers their Personal Workbench analyst console to be their prime differentiator in the SOAR market.”
• “Personal Workbench is designed with typical security analyst and incident investigator workflows in mind.”
• “Logsign's case management facilitates collaboration and allows analysts to invite others to work on tickets together, or to hit the emergency button to get an entire team focused on a major incident.”
• “For Logsign SOAR, playbooks are enacted by ‘bots’, including separate bots for investigations, analysis tasks, response, and remediation actions.”
• “This allows Logsign playbooks to process multiple activity streams in parallel rather than only sequentially.”
• “The single console for incident management and analyst investigations is the way forward in the modern SOC, whether managed in-house or by service providers.”
• “Given that attackers are orchestrating and automating their malicious activities, the only way for businesses, non-profits, and government agencies to have success in security is by using automation as well.”