{"id":2653,"date":"2026-10-06T06:18:58","date_gmt":"2026-10-06T06:18:58","guid":{"rendered":"https:\/\/www.newevol.io\/resources\/?p=2653"},"modified":"2026-10-06T06:19:00","modified_gmt":"2026-10-06T06:19:00","slug":"decision-support-system-soar-analysts","status":"publish","type":"post","link":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/","title":{"rendered":"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them"},"content":{"rendered":"<p>&#8220;Decision support&#8221; comes up in almost every SOAR demonstration. A recommended action appears on screen, a risk score sits beside it, and the presenter calls it decision support. Yet buyers, analysts, and vendors rarely mean the same thing by the term.<\/p>\n<p>That gap matters. If a team cannot define decision support, it cannot test it, compare it, or hold it to a standard.<\/p>\n<p>In this <strong><a href=\"https:\/\/www.newevol.io\/\">NewEvol<\/a><\/strong> guide, we set out a practical definition, separate decision support from automation, and describe what a decision support system SOAR teams can trust should actually provide. It is written as a reference point for SOC analysts, security managers, and CISOs evaluating security orchestration and automation.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_66_1 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title ez-toc-toggle\" style=\"cursor: pointer\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #0a0a0a;color:#0a0a0a\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #0a0a0a;color:#0a0a0a\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#What_Is_Decision_Support_in_SOAR\" title=\"What Is Decision Support in SOAR?\">What Is Decision Support in SOAR?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Automation_vs_Decision_Support_Executing_vs_Informing\" title=\"Automation vs. Decision Support: Executing vs. Informing\">Automation vs. Decision Support: Executing vs. Informing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#What_a_Decision-Support_Layer_Actually_Provides\" title=\"What a Decision-Support Layer Actually Provides\">What a Decision-Support Layer Actually Provides<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#1_Assembled_context\" title=\"1. Assembled context\">1. Assembled context<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#2_Similar_incident_history\" title=\"2. Similar incident history\">2. Similar incident history<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#3_Recommended_action_with_reasoning\" title=\"3. Recommended action with reasoning\">3. Recommended action with reasoning<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#4_Stated_confidence_level\" title=\"4. Stated confidence level\">4. Stated confidence level<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Why_Analyst_Accountability_Is_a_Design_Requirement\" title=\"Why Analyst Accountability Is a Design Requirement\">Why Analyst Accountability Is a Design Requirement<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#What_Decision_Support_Should_Never_Do_Silently\" title=\"What Decision Support Should Never Do Silently\">What Decision Support Should Never Do Silently<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Practical_SOC_Examples\" title=\"Practical SOC Examples\">Practical SOC Examples<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Why_Security_Analysts_Need_Decision_Support\" title=\"Why Security Analysts Need Decision Support\">Why Security Analysts Need Decision Support<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Decision_Support_vs_Automated_Response\" title=\"Decision Support vs. Automated Response\">Decision Support vs. Automated Response<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Where_Decision_Support_Fits_in_the_SOAR_Process\" title=\"Where Decision Support Fits in the SOAR Process\">Where Decision Support Fits in the SOAR Process<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#What_Good_Decision_Support_Looks_Like\" title=\"What Good Decision Support Looks Like\">What Good Decision Support Looks Like<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Key_Takeaways\" title=\"Key Takeaways\">Key Takeaways<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Final_Thought\" title=\"Final Thought\">Final Thought<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#Frequently_Asked_Questions\" title=\"Frequently Asked Questions\">Frequently Asked Questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#1_What_is_decision_support_in_SOAR\" title=\"1. What is decision support in SOAR?\">1. What is decision support in SOAR?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#2_How_is_decision_support_different_from_automation\" title=\"2. How is decision support different from automation?\">2. How is decision support different from automation?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#3_Why_do_SOC_analysts_need_decision_support\" title=\"3. Why do SOC analysts need decision support?\">3. Why do SOC analysts need decision support?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#4_What_information_should_SOAR_decision_support_provide\" title=\"4. What information should SOAR decision support provide?\">4. What information should SOAR decision support provide?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#5_Should_decision-support_systems_automatically_execute_security_actions\" title=\"5. Should decision-support systems automatically execute security actions?\">5. Should decision-support systems automatically execute security actions?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#6_Why_is_confidence_important_in_security_recommendations\" title=\"6. Why is confidence important in security recommendations?\">6. Why is confidence important in security recommendations?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#7_Can_decision_support_and_automated_response_work_together\" title=\"7. Can decision support and automated response work together?\">7. Can decision support and automated response work together?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_Is_Decision_Support_in_SOAR\"><\/span>What Is Decision Support in SOAR?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In a SOAR environment, decision support is the layer that helps an analyst understand an incident and choose a response before any action is taken. It gathers relevant evidence, relates it to past incidents, suggests a next step, explains why, and states how confident it is.<\/p>\n<p>Its output is not an action. Its output is a better-informed analyst.<\/p>\n<p>A simple test: if a capability changes what the analyst knows, it is decision support. If it changes the state of a system, such as blocking an IP address or disabling an account, it is automation.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Automation_vs_Decision_Support_Executing_vs_Informing\"><\/span>Automation vs. Decision Support: Executing vs. Informing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The clearest way to separate the two is this:<\/p>\n<blockquote>\n<p><strong>Automation executes a decision that has already been made. Decision support informs a decision that a person is about to make.<\/strong><\/p>\n<\/blockquote>\n<p>A playbook that isolates an endpoint when a confirmed ransomware indicator appears is automation. Someone decided in advance that this condition warrants this action, and the playbook carries it out quickly and consistently.<\/p>\n<p>Decision support works earlier, in situations where the right response is not yet clear: the evidence is mixed, the asset is business-critical, or the pattern is unfamiliar. Here, <strong><a href=\"https:\/\/www.newevol.io\/solutions\/automated-response-orchestration.php\">SOAR decision support<\/a><\/strong> helps the analyst reach a decision that automation can then execute. One answers &#8220;What should we do?&#8221; The other answers &#8220;How do we do it reliably?&#8221;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_a_Decision-Support_Layer_Actually_Provides\"><\/span>What a Decision-Support Layer Actually Provides<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A useful decision-support layer makes four contributions. Each should be visible to the analyst, not hidden inside a single score.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"1_Assembled_context\"><\/span><span style=\"font-size: 70%;\">1. Assembled context<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Without support, gathering context means searching across the SIEM, identity provider, endpoint console, firewall logs, and threat intelligence feeds. Decision support brings that incident context together in one view:<\/p>\n<ul>\n<li>the triggering alert and related alerts<\/li>\n<li>identity data, such as user role, privileges, and recent sign-ins<\/li>\n<li>endpoint and network activity around the event<\/li>\n<li><strong><a href=\"https:\/\/www.newevol.io\/solutions\/insider-threat-user-behavior-analytics.php\">threat intelligence matches<\/a><\/strong><\/li>\n<li>notes and outcomes from previous investigations<\/li>\n<\/ul>\n<p>The key word is relevant. More data is not better context. A good layer selects what bears on this incident and shows where each item came from.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Similar_incident_history\"><\/span><span style=\"font-size: 70%;\">2. Similar incident history<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Incident history gives analysts reference points. If three similar alerts on the same server turned out to be a scheduled backup job, that is useful. If a similar pattern last quarter was credential theft, that is useful too.<\/p>\n<p>History is supporting evidence, not proof. Two incidents can look alike and still need different responses because the user, asset, or timing has changed. The system should show what made them similar and how each was resolved, then leave the comparison to the analyst.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Recommended_action_with_reasoning\"><\/span><span style=\"font-size: 70%;\">3. Recommended action with reasoning<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Decision support can suggest a next step: investigate further, collect more evidence, escalate the incident, or isolate an endpoint.<\/p>\n<p>A recommendation without reasoning is just an action button. Analysts need to see why it was generated: which evidence supports it, which rule or model produced it, and what would change it. That lets them accept, adjust, or reject it, and lets reviewers understand the decision later.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Stated_confidence_level\"><\/span><span style=\"font-size: 70%;\">4. Stated confidence level<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Confidence tells the analyst how much weight a recommendation deserves. It helps separate strong, consistent evidence from a thin or conflicting picture.<\/p>\n<p>Confidence is not certainty. A high-confidence recommendation can still be wrong. What matters is that uncertainty stays visible. When evidence is weak or contradictory, the system should say so plainly rather than present a confident-looking answer.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Why_Analyst_Accountability_Is_a_Design_Requirement\"><\/span>Why Analyst Accountability Is a Design Requirement<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Keeping the analyst accountable is not a limitation of decision support. It is a requirement.<\/p>\n<p>Security decisions often depend on factors a system cannot fully see:<\/p>\n<ul>\n<li>business impact, such as isolating a server during a payment run<\/li>\n<li>incomplete or conflicting evidence<\/li>\n<li>unusual but legitimate activity, such as an executive traveling abroad<\/li>\n<li>regulatory and contractual obligations<\/li>\n<li>organizational context, such as a change window or an acquisition<\/li>\n<\/ul>\n<p>The flow should look like this:<\/p>\n<p><strong>Data &rarr; Context &rarr; Recommendation &rarr; Analyst Decision &rarr; Action<\/strong><\/p>\n<p>Decision support covers the first three steps. The analyst owns the decision. Automation typically operates after that point, executing what the analyst approved or what the organization defined in advance. The aim is to strengthen analyst decision-making, not replace it.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_Decision_Support_Should_Never_Do_Silently\"><\/span>What Decision Support Should Never Do Silently<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some behaviors are acceptable only when the analyst can see them. A decision-support layer should never silently:<\/p>\n<ul>\n<li>change an incident&#8217;s severity without explaining why<\/li>\n<li>execute a containment action without authorization<\/li>\n<li>suppress or close an alert without a visible reason<\/li>\n<li>modify response workflows without informing the analyst<\/li>\n<li>hide evidence that contradicts its recommendation<\/li>\n<li>present an uncertain recommendation as a certain conclusion<\/li>\n<li>treat historical similarity as definitive proof<\/li>\n<li>make a material security decision without a human approval point<\/li>\n<\/ul>\n<p>The common thread is transparency. Every recommendation, change, and action should be traceable: what proposed it, on what evidence, and who approved it. That traceability supports post-incident review, audits, and the trust analysts need before they rely on any recommendation.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Practical_SOC_Examples\"><\/span>Practical SOC Examples<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The three scenarios below show where decision support ends and automation begins. In each one, the system informs the decision and automation executes it only after approval.<\/p>\n<table class=\"table table-bordered\">\n<colgroup>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">&nbsp;<\/th>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Suspicious login<\/p>\n<\/th>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Malware alert<\/p>\n<\/th>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Potential account compromise<\/p>\n<\/th>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>What the system knows<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Sign-in from a new country on an unrecognized device; MFA passed; user normally signs in from one office<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Endpoint tool flags a file on a finance workstation; hash matches a known malware family; four similar past incidents<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>New mailbox rule forwards mail externally, created after an unusual sign-in; user has payment system access<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>What it recommends<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Investigate further before any account action<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Isolate the endpoint and collect forensic evidence<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Escalate, temporarily restrict access, and collect mailbox audit logs<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>Why<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>New location and device are risk signals, but passed MFA and no follow-on activity weaken the case for compromise<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>File hash match, plus three of the four similar past incidents were confirmed malicious<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Forwarding rules after suspicious sign-ins match common takeover patterns; privileged access raises impact<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>Confidence<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Moderate: evidence is mixed<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>High: the one past false positive (a testing tool) is shown alongside<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Moderate to high: no confirmed data loss yet<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>What the analyst decides<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Contacts the user, confirms business travel, closes with a note<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Approves isolation after confirming no critical process runs on the device<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Escalates and approves the restriction; asks for more logs before a password reset<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p><strong>What automation executes after approval<\/strong><\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Records the outcome and updates the user&#8217;s known locations<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Isolates the device, collects artifacts, opens a ticket<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Removes the forwarding rule, revokes active sessions, gathers logs<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"why-security-analysts-need-decision-support\"><span class=\"ez-toc-section\" id=\"Why_Security_Analysts_Need_Decision_Support\"><\/span>Why Security Analysts Need Decision Support<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>SOC teams work under pressures that make good decisions harder:<\/p>\n<ul>\n<li><strong>Alert volume:<\/strong> more alerts than analysts can investigate in depth<\/li>\n<li><strong>Fragmented data:<\/strong> evidence spread across many consoles<\/li>\n<li><strong>Investigation time:<\/strong> time spent finding facts instead of weighing them<\/li>\n<li><strong>Inconsistent decisions:<\/strong> two analysts handling the same alert differently<\/li>\n<li><strong>High-severity pressure:<\/strong> critical incidents leave little time to think<\/li>\n<li><strong>Missing history:<\/strong> past investigations buried in closed tickets<\/li>\n<li><strong>Junior analysts:<\/strong> need structured guidance while they build experience<\/li>\n<li><strong>Experienced analysts:<\/strong> need faster access to the evidence that matters<\/li>\n<\/ul>\n<p>Speed is a benefit, but it is not the main goal. The larger goal is decisions that are better, more consistent, and easier to explain to a manager, an auditor, or a regulator.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Decision_Support_vs_Automated_Response\"><\/span>Decision Support vs. Automated Response<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table class=\"table table-bordered\">\n<colgroup>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Area<\/p>\n<\/th>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Decision Support<\/p>\n<\/th>\n<th colspan=\"1\" rowspan=\"1\">\n<p>Automation<\/p>\n<\/th>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Primary purpose<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Helps inform a decision<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Executes a defined action<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Human role<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Analyst evaluates and decides<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Analyst may approve, or define the rule beforehand<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Context<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Provides relevant evidence and reasoning<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Uses predefined or triggered conditions<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Recommendation<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Yes<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Not necessarily<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Confidence<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Can communicate uncertainty<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Usually executes according to configured logic<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Accountability<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Analyst remains responsible for the decision<\/p>\n<\/td>\n<td colspan=\"1\" rowspan=\"1\">\n<p>Responsibility depends on workflow design<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Neither approach is inherently safer. Well-designed automated response is the right choice for repeatable, well-understood actions. Decision support is the right choice when judgment is needed. Mature security operations use both, with a clear handoff between them.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Where_Decision_Support_Fits_in_the_SOAR_Process\"><\/span>Where Decision Support Fits in the SOAR Process<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Detection &rarr; Investigation &rarr; Decision Support &rarr; Analyst Decision &rarr; Orchestration\/Automation &rarr; Response &rarr; Review<\/strong><\/p>\n<p>Decision support is the bridge between threat investigation and automated response. It turns investigation findings into a clear, explained choice, and the analyst&#8217;s decision then triggers orchestration.<\/p>\n<p>This matters for buyers. SOAR is often described only as a way to run playbooks. A mature <strong><a href=\"https:\/\/www.sattrix.com\/managed-services\/soc-as-a-service.php\">security operations setup<\/a><\/strong> also helps analysts decide which playbook fits before anything runs. The review stage then adds each outcome to incident history, giving future recommendations better reference points.<\/p>\n<h2 id=\"what-good-decision-support-looks-like\"><span class=\"ez-toc-section\" id=\"What_Good_Decision_Support_Looks_Like\"><\/span>What Good Decision Support Looks Like<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Use these principles as a checklist when you evaluate any decision support system SOAR vendors demonstrate:<\/p>\n<ul>\n<li><strong>Context before recommendation:<\/strong> the analyst sees the evidence first<\/li>\n<li><strong>Evidence before conclusion:<\/strong> every conclusion points to its sources<\/li>\n<li><strong>Reasoning alongside recommendations:<\/strong> no unexplained action buttons<\/li>\n<li><strong>Confidence instead of false certainty:<\/strong> weak evidence is labeled as weak<\/li>\n<li><strong>Human approval for consequential decisions:<\/strong> containment and closure need a named approver<\/li>\n<li><strong>Full visibility:<\/strong> the analyst can see everything the system recommended or changed<\/li>\n<li><strong>Traceability:<\/strong> decisions and actions can be reconstructed after the incident<\/li>\n<li><strong>Separation of recommendation and execution:<\/strong> suggesting an action never triggers it by default<\/li>\n<\/ul>\n<p>If a demo cannot show where a recommendation came from, treat it as automation with a friendlier label.<\/p>\n<h2 id=\"key-takeaways\"><span class=\"ez-toc-section\" id=\"Key_Takeaways\"><\/span>Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Decision support informs a decision; automation executes one.<\/li>\n<li>Its four core contributions are assembled context, similar incident history, a recommendation with reasoning, and a stated confidence level.<\/li>\n<li>Analyst accountability is a deliberate design requirement, not a gap to be engineered away.<\/li>\n<li>Nothing consequential should happen silently: severity changes, closures, and containment all need visible reasons.<\/li>\n<li>Decision support and automation work best together, with a clear handoff at the analyst&#8217;s decision.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Final_Thought\"><\/span>Final Thought<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Decision support is the layer between security evidence and responsible action. It does not decide for the analyst. It makes sure that when the analyst decides, the context, history, reasoning, and uncertainty are all in plain view.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1_What_is_decision_support_in_SOAR\"><\/span><span style=\"font-size: 70%;\">1. What is decision support in SOAR?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It is the capability that helps an analyst evaluate an incident and choose a response. It does this by assembling evidence, referencing similar incidents, recommending a next step with reasoning, and stating confidence. It informs action rather than taking it.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_How_is_decision_support_different_from_automation\"><\/span><span style=\"font-size: 70%;\">2. How is decision support different from automation?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Automation carries out a choice that was already made, either by a person or by a predefined rule. Decision support helps a person make that choice. Many workflows use decision support first and automation second.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Why_do_SOC_analysts_need_decision_support\"><\/span><span style=\"font-size: 70%;\">3. Why do SOC analysts need decision support?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It cuts the time spent collecting evidence across tools and gives every analyst the same starting point. That leads to more consistent decisions, especially during high-pressure incidents.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_What_information_should_SOAR_decision_support_provide\"><\/span><span style=\"font-size: 70%;\">4. What information should SOAR decision support provide?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>At minimum: relevant incident context with sources, similar past incidents and how they ended, a recommended action, the reasoning behind it, and a confidence level. Contradictory evidence should be shown as well.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Should_decision-support_systems_automatically_execute_security_actions\"><\/span><span style=\"font-size: 70%;\">5. Should decision-support systems automatically execute security actions?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Not on their own authority for consequential actions. An organization can choose to pre-approve low-risk, well-understood actions as automation, but that should be a documented policy decision that can be reviewed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Why_is_confidence_important_in_security_recommendations\"><\/span><span style=\"font-size: 70%;\">6. Why is confidence important in security recommendations?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It tells analysts how far to rely on a recommendation and when to dig deeper. Without it, a weak suggestion and a well-supported one look identical.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Can_decision_support_and_automated_response_work_together\"><\/span><span style=\"font-size: 70%;\">7. Can decision support and automated response work together?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. Decision support helps the analyst decide, and automation then executes approved steps quickly and consistently. Outcomes from both feed back into incident history for future investigations.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;Decision support&#8221; comes up in almost every SOAR demonstration. A recommended action appears on screen, a risk score sits beside it, and the presenter calls it decision support. Yet buyers, analysts, and vendors rarely mean the same thing by the term. That gap matters. If a team cannot define decision support, it cannot test it,&hellip; <a class=\"more-link\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\">Continue reading <span class=\"screen-reader-text\">Decision Support Systems in SOAR: What They Do and Why Analysts Need Them<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":2654,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,16],"tags":[],"class_list":["post-2653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-orchastration-response","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol\" \/>\n<meta property=\"og:description\" content=\"&#8220;Decision support&#8221; comes up in almost every SOAR demonstration. A recommended action appears on screen, a risk score sits beside it, and the presenter calls it decision support. Yet buyers, analysts, and vendors rarely mean the same thing by the term. That gap matters. If a team cannot define decision support, it cannot test it,&hellip; Continue reading Decision Support Systems in SOAR: What They Do and Why Analysts Need Them\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\" \/>\n<meta property=\"og:site_name\" content=\"NewEvol\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NewEvolPlatform\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-06T06:18:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-06T06:19:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Krunal Medapara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@krunalpatel17\" \/>\n<meta name=\"twitter:site\" content=\"@NewEvolPlatform\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Krunal Medapara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\",\"url\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\",\"name\":\"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol\",\"isPartOf\":{\"@id\":\"https:\/\/www.newevol.io\/resources\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg\",\"datePublished\":\"2026-10-06T06:18:58+00:00\",\"dateModified\":\"2026-10-06T06:19:00+00:00\",\"author\":{\"@id\":\"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/7929a2b0ea108d69f18541bb94a98680\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage\",\"url\":\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg\",\"contentUrl\":\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg\",\"width\":1920,\"height\":900,\"caption\":\"SOAR decision support\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.newevol.io\/resources\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.newevol.io\/resources\/#website\",\"url\":\"https:\/\/www.newevol.io\/resources\/\",\"name\":\"NewEvol\",\"description\":\"Innovation in Motion\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.newevol.io\/resources\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/7929a2b0ea108d69f18541bb94a98680\",\"name\":\"Krunal Medapara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2022\/03\/krunal-mendapara-1-scaled.jpg\",\"contentUrl\":\"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2022\/03\/krunal-mendapara-1-scaled.jpg\",\"caption\":\"Krunal Medapara\"},\"description\":\"Krunal Mendapara is the Chief Technology Officer, responsible for creating product roadmaps from conception to launch, driving the product vision, defining go-to-market strategy, and leading design discussions.\",\"sameAs\":[\"https:\/\/www.newevol.io\/\",\"https:\/\/x.com\/krunalpatel17\"],\"url\":\"https:\/\/www.newevol.io\/resources\/author\/krunal-medapara\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/","og_locale":"en_US","og_type":"article","og_title":"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol","og_description":"&#8220;Decision support&#8221; comes up in almost every SOAR demonstration. A recommended action appears on screen, a risk score sits beside it, and the presenter calls it decision support. Yet buyers, analysts, and vendors rarely mean the same thing by the term. That gap matters. If a team cannot define decision support, it cannot test it,&hellip; Continue reading Decision Support Systems in SOAR: What They Do and Why Analysts Need Them","og_url":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/","og_site_name":"NewEvol","article_publisher":"https:\/\/www.facebook.com\/NewEvolPlatform\/","article_published_time":"2026-10-06T06:18:58+00:00","article_modified_time":"2026-10-06T06:19:00+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg","type":"image\/jpeg"}],"author":"Krunal Medapara","twitter_card":"summary_large_image","twitter_creator":"@krunalpatel17","twitter_site":"@NewEvolPlatform","twitter_misc":{"Written by":"Krunal Medapara","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/","url":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/","name":"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them - NewEvol","isPartOf":{"@id":"https:\/\/www.newevol.io\/resources\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage"},"image":{"@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage"},"thumbnailUrl":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg","datePublished":"2026-10-06T06:18:58+00:00","dateModified":"2026-10-06T06:19:00+00:00","author":{"@id":"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/7929a2b0ea108d69f18541bb94a98680"},"breadcrumb":{"@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#primaryimage","url":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg","contentUrl":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/scasc1.jpg","width":1920,"height":900,"caption":"SOAR decision support"},{"@type":"BreadcrumbList","@id":"https:\/\/www.newevol.io\/resources\/blog\/decision-support-system-soar-analysts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.newevol.io\/resources\/"},{"@type":"ListItem","position":2,"name":"Decision Support Systems in SOAR: What They Do and Why Analysts Need Them"}]},{"@type":"WebSite","@id":"https:\/\/www.newevol.io\/resources\/#website","url":"https:\/\/www.newevol.io\/resources\/","name":"NewEvol","description":"Innovation in Motion","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.newevol.io\/resources\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/7929a2b0ea108d69f18541bb94a98680","name":"Krunal Medapara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.newevol.io\/resources\/#\/schema\/person\/image\/","url":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2022\/03\/krunal-mendapara-1-scaled.jpg","contentUrl":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2022\/03\/krunal-mendapara-1-scaled.jpg","caption":"Krunal Medapara"},"description":"Krunal Mendapara is the Chief Technology Officer, responsible for creating product roadmaps from conception to launch, driving the product vision, defining go-to-market strategy, and leading design discussions.","sameAs":["https:\/\/www.newevol.io\/","https:\/\/x.com\/krunalpatel17"],"url":"https:\/\/www.newevol.io\/resources\/author\/krunal-medapara\/"}]}},"_links":{"self":[{"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/posts\/2653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/comments?post=2653"}],"version-history":[{"count":1,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/posts\/2653\/revisions"}],"predecessor-version":[{"id":2655,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/posts\/2653\/revisions\/2655"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/media\/2654"}],"wp:attachment":[{"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/media?parent=2653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/categories?post=2653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newevol.io\/resources\/wp-json\/wp\/v2\/tags?post=2653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}