In short: Todyl Security Automation, billed as Todyl Security Orchestration & Response, is the platform's SOAR module. Prebuilt and custom playbooks use Todyl Automated Response Actions to contain threats such as Microsoft 365 account takeover and malware, with a simulation mode and exclusion lists for critical systems. It is licensed once per tenant.
What Todyl Security Automation is
Many attacks move faster than a person can respond, particularly a compromised Microsoft 365 account sending phishing to your contacts at two in the morning. Todyl Security Automation, billed as Todyl Security Orchestration & Response, is the security orchestration, automation and response (SOAR) module of the Todyl platform. It runs playbooks: rules that take a trigger, such as a suspicious sign-in or a malware detection, and carry out a sequence of response actions automatically.
Playbooks are built from Todyl Automated Response Actions (TARA) and work on the cases raised by Todyl SIEM and Todyl Endpoint Security. Todyl gives the example of an unusual Microsoft 365 sign-in: the playbook revokes the user's access and alerts administrators, then can escalate to disabling or deleting the account if the signs of takeover continue.
What is included
| Feature | What it does |
|---|---|
| Prebuilt playbooks | Ready-made responses to Microsoft 365 threats, such as business email compromise, and endpoint threats such as malware |
| Custom playbooks | Build your own sequences from Todyl Automated Response Actions |
| Simulation mode | Run a playbook for 7, 14 or 30 days, or indefinitely, to see what it would have done before letting it act |
| Exclusion lists | Keep uptime-critical systems and accounts, such as a domain controller or a Microsoft 365 admin, out of automatic actions |
| Response tracking | Automated responses are tracked in detail for auditing, and managed per tenant from the Cases page |
In Todyl's packages, Essentials and Advanced include five SOAR playbooks and Complete includes unlimited playbooks.
How it is licensed
Unlike most Todyl modules, Security Orchestration and Response is licensed per tenant: one licence covers your organisation rather than each device. It is billed monthly in arrears alongside your other Todyl modules, with no annual contract.
It needs data to act on, so it is normally taken with Todyl SIEM, Endpoint Security or a Todyl package. Ask us for a quote and we will show whether the module or a package with more playbooks is better value.
Deployment and safe rollout
Automation that blocks the wrong account can do as much damage as an attacker, so we roll it out carefully:
- Connect Microsoft 365 and confirm that endpoint and identity data is reaching the SIEM.
- Agree which accounts and systems must never be acted on automatically, and add them to exclusion lists.
- Enable prebuilt playbooks in simulation mode and review what they would have done.
- Switch playbooks to live once the results are right, and add custom playbooks for your own processes.
Where you also use Todyl MXDR, we agree with you which actions run automatically and which wait for an analyst or for you.
Who it suits and how we help
Todyl Security Automation suits organisations on Microsoft 365 that want account takeover and malware contained in seconds, at any hour, and teams that want to cut repetitive manual response work. It is most valuable alongside SIEM and MXDR.
We design the playbooks, tune exclusions, review automated actions with you and keep the licence on your single invoice. Compare other options in EDR, XDR and MDR. See all vendors on our vendors A to Z, or go back to the Todyl overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is SOAR in Todyl?
SOAR stands for security orchestration, automation and response. In Todyl it is the Security Automation module, which runs playbooks that contain Microsoft 365 and endpoint threats automatically.
Is Todyl Security Automation licensed per device?
No. Security Orchestration and Response is licensed per tenant, so one licence covers your organisation, billed monthly with your other Todyl modules.
Can I test playbooks before they take action?
Yes. Simulation mode runs a playbook for 7, 14 or 30 days, or indefinitely, so you can see what it would have done before letting it act.
How many playbooks are included?
Todyl's Essentials and Advanced packages include five SOAR playbooks and the Complete package includes unlimited playbooks.