Overview¶

OpenSOAR is an open-source SOAR platform built around Python-native playbooks, case management, integrations, and async execution.

This is the canonical documentation site for OpenSOAR.

Start Here¶

• Getting Started
• Alert Lifecycle
• Incident Workflow
• Playbooks
• Loading and Syncing Playbooks
• Deployment
• Authentication and SSO
• Engineering

Notes¶

• Playbooks are code-first Python modules loaded from configured directories.
• The migrate service is for database schema migrations, not playbook syncing.
• Third-party auth is not part of the core-only deployment path; see Authentication and SSO for the current status.
• If you need a specific topic beyond the four entry points above, use the left navigation.