What is the difference between EDR, SIEM, and SOAR in a modern Security Operations Center (SOC)?

A mature enterprise Security Operations Center (SOC) deploys EDR, SIEM, and SOAR as an integrated defensive triumvirate:

• EDR (Endpoint Detection and Response):
  Scope: Host level (laptops, desktops, virtual servers).
  Function: Continuously records process trees, memory injections, registry changes, and local network sockets. It provides deep visibility on endpoints and allows analysts to isolate machines from the network with one click.
• SIEM (Security Information and Event Management):
  Scope: Enterprise wide (firewalls, routers, cloud audits, AD logs, VPNs, databases, EDR feeds).
  Function: Ingests high-velocity logs, normalizes heterogeneous data formats, correlates events across disparate sources, and triggers alarms when suspicious event chains occur.
• SOAR (Security Orchestration, Automation, and Response):
  Scope: Operational workflows and cross-tool orchestration.
  Function: Executes automated playbooks (e.g., when SIEM triggers a phishing alert, SOAR automatically queries VirusTotal, blocks the sender on the email gateway, and creates a Jira ticket without human delay).