Topic starter
02/08/2026 9:46 am
TL;DR: A Global 1000 security team described four years of daily friction with ServiceNow SOAR, then moved to Morpheus after seeing alert stories, traceable reasoning, and case memory assembled across EDR, identity, email, cloud, and network telemetry, according to D3. The broader lesson is that SOC tooling is now judged by investigation coherence and auditability, not orchestration depth alone.
Editorial analysis by NHI Mgmt Group, based on content published by D3: “Four Years on ServiceNow SOAR Taught One Global 1000 SOC Exactly What to Look For”.
Key questions
Q: Why do legacy SOAR workflows slow SOC triage in practice?
A: Legacy SOAR slows triage when analysts must assemble the incident narrative by moving between separate consoles and re-checking the same evidence repeatedly.
Q: How can organisations tell whether automated triage is actually helping?
A: Look at how quickly the team separates false positives from confirmed identity abuse, how much analyst time is reclaimed, and whether response consistency improves across repeat cases.
Q: What breaks when investigation tools do not retain case memory?
A: When case memory is missing, every follow-up question restarts the analysis and analysts repeat the same context across the workflow.
Practitioner guidance
- Define triage success as case coherence Measure whether an alert view already contains the evidence path, reasoning chain, and recommended next step before the analyst opens secondary consoles.
- Audit decision traceability in automation workflows Review whether every escalated, dismissed, or contained alert can be explained from first signal to final action without reconstructing the story manually.
- Preserve investigation context across tool boundaries Keep incident context attached when analysts pivot between EDR, identity, email, cloud, and network telemetry so the case does not reset at each handoff.
Bottom line: Legacy SOAR can leave analysts stitching together incidents by hand, which turns triage speed and defensibility into a single operational problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:39 pm
Legacy SOAR friction is now a governance problem, not just an operations problem. When analysts cannot reconstruct a case quickly and consistently, the issue extends beyond queue management into auditability, decision quality, and response defensibility. That is why SOC leaders increasingly evaluate investigation coherence alongside automation coverage. The practitioner conclusion is to judge orchestration through the quality of the investigation record it produces.
A question worth separating out:
Q: Should SOC teams keep human approval for automated response actions?
A: Yes, when response actions can disable users, patch hosts, or change production systems. Human approval preserves accountability and reduces the risk of acting on a false or incomplete conclusion. Automation should assemble evidence and recommend actions, but the final trigger for high-impact response should remain explicit and reviewable.
👉 Read our full editorial: SOC triage friction is driving teams to replace legacy SOAR