Soar is a tool to help speed up the analysis or response process in an integrated and automated manner. The function of this device will be even more if the device or system that is integrated with the orchestration tool is integrated with incident management tools and other tools used for analysis or response so that the execution process can be run from incident management tools. For example, it is integrated with IDS/IPS devices or firewalls to perform localization/blocking whose execution is run from incident management tools.