we have Splunk ES for security monitoring & ITSI for system monitoring. Now alerts and incidents are manual process it consumes lot of time due to involving different teams.
so incident management we are using BMC helix, now i am planning to implement SOAR platform to reduce human error & resolution time.
my question is
1. SOAR platform configuration Prerequisites (single & multi-site)
2. security & non-security PoC's using SOAR.
3. compatibility matrix SOAR platform with different vendors.
Much Appreciated if anyone share your knowledge & guidance.
