  Organizations use diverse types of security solutions to prevent
cyberattacks. Multiple vendors provide security solutions developed using
heterogeneous technologies and paradigms. Hence, it is a challenging rather
impossible to easily make security solutions to work an integrated fashion.
Security orchestration aims at smoothly integrating multivendor security tools
that can effectively and efficiently interoperate to support security staff of
a Security Operation Centre (SOC). Given the increasing role and importance of
security orchestration, there has been an increasing amount of literature on
different aspects of security orchestration solutions. However, there has been
no effort to systematically review and analyze the reported solutions. We
report a Multivocal Literature Review that has systematically selected and
reviewed both academic and grey (blogs, web pages, white papers) literature on
different aspects of security orchestration published from January 2007 until
July 2017. The review has enabled us to provide a working definition of
security orchestration and classify the main functionalities of security
orchestration into three main areas: unification, orchestration, and
automation. We have also identified the core components of a security
orchestration platform and categorized the drivers of security orchestration
based on technical and socio-technical aspects. We also provide a taxonomy of
security orchestration based on the execution environment, automation strategy,
deployment type, mode of task and resource type. This review has helped us to
reveal several areas of further research and development in security
orchestration.
