SOAR-as-a-Service: Implementing Cloud-Based Security Automation on AWS

Security Orchestration, Automation, and Response (SOAR) platforms play a critical role in today’s cybersecurity landscape, as they enable rapid detection and response to threats and efficiently manage Incidents. A number of security and automation tools are offered by Amazon Web Services (AWS); however, AWS does not offer a unified native SOAR (Security Orchestration, Automation, and Response) solution. This paper presents and discusses the design, deployment, and experimental evaluation of a scalable, cloud-native SOAR architecture built entirely on AWS. The proposed system integrates different AWS services, like GuardDuty for threat detection, Lambda for automated responses, S3 for log storage, and API Gateway for secure data transmission. A cloud-hosted dashboard on Amazon EC2 provides real-time visibility for analysts, the secure access managed via AWS Certificate Manager and Route 53. The architecture emphasizes asynchronous processing using AWS Lambda to maintain performance under high data volumes. Security best practices, including IAM, KMS, and HTTPS, are followed to ensure compliance and data integrity. The system is evaluated using live cloud-based attack scenarios, including malicious IP communication and runtime reverse-shell exploitation, demonstrating automated containment and controlled human-in-the-loop remediation for high-severity incidents. Experimental results show that the proposed SOAR platform provides a timely detection, automated response, and the ability to efficiently scale orchestration of cloud security incidents, addressing a key gap in AWS’s current security offerings.