Transform Risk
into Response
with STORM

  • SOAR Software macht Incident Management schneller & einfacher. Wir zeigen Ihnen wie STORM Cybersecurity- & SOC-Teams zu Höchstleistungen verhilft.

STORM SOAR software means better incident management.

STORM powered by OTRS is cybersecurity incident management software that quickly manages orchestration, automation and response of security incidents.

Plus, there’s a bonus — structured communication. Securely coordinate between IT, security, SOC, risk and management teams too.

Want to see STORM in action?

SOAR software benefits your analysts, SOC and overall organization through automated workflows and built-in intelligence.



STORM wins the Incident Management Infosec Award in the Cutting Edge category.


Read more

Infosec Winner Badge 2021

What is a security orchestration, automation and response tool?

SOAR software is a platform used by security operation centers, CSIRT, PSIRTS and other security teams to keep people, processes and tools safe. The incident management software uses automated incident response processes in order to ensure that security and operations teams quickly mitigate threats.

By using a SOAR, no time is wasted in prioritizing, assessing and resolving security incidents.

How Does a SOAR Platform Improve Incident Management?


By loading the video, you agree to YouTube’s privacy policy.
Learn more

Load video

Incident management workflows have five high-level steps – incident identification and logging; prioritization and categorization; diagnosis; incident response; and case resolution and closure. SOAR solutions use automation and intelligence to help cybersecurity teams and SOCs facilitate these steps, making incident response quicker.

From alerts to response, a SOAR platform uses automation to manage the orchestration of all the people, tools, and services needed to ensure speedy incident management and keep your business safer.

STORM has all four necessary SOAR components…and more. STORM features include:

Continuous encryption.
Communicate safely – internally and externally.

  • Encrypt and sign ticket notifications
  • Encrypt emails to multiple recipients
  • Automatically decrypt incoming encrypted email
  • Use Postmaster filters for inbound encrypted email
  • Sign and encrypt ticket notification content
  • Use public S/MIME certificates from the LDAP

Easy integrations.
Maximize existing security tools.

  • Numerous connectivity options via web services
  • Extensive scripting engine to implement your own scripts
  • SIEM data collection

Decision-making data.
Get added oversight and intelligence.

  • In-ticket IP address information, e.g. from WHOIS or other web services
  • In-ticket CVE or MS bulletin details
  • Select the displayed attributes of linked objects, such as tickets
  • Display the order of attributes of linked tickets in individual columns
  • Flexible creation of ticket watchlists to keep you up-to-date, day or night
  • Customized escalation times

The list of STORM features keeps going…

How is a SOAR different from a cybersecurity ticketing system?

A cybersecurity ticketing system is the same as a help desk or IT ticketing system. Like an IT ticketing system, a SOAR uses tickets to document and track incidents from start to finish. But that’s only a small part of how a SOAR like STORM helps SOCs, CERTs and other security teams keep businesses safe.

When security incidents strike, companies need software that delivers a coordinated response based on automated IT security processes – a SOAR.

How do I decide between ITSM software and a SOAR?

OTRS ITSM Solution STORM powered by OTRS
Process Automation ITIL and operations ­processes available. Easily define proven ­processes and playbooks.
Reporting Focused on SLAs. Focused on forensics ­and compliance.
Threat Intelligence None. Live data in ticket, e.g. IOCs.
Expertise Possible upon request. Consultants with ready-to-go security ­clearance work with your team ­for approximately 15 days.
Support Desk ­Staffing IT and OTRS product experts. Dedicated security experts.
Test Environment No test instance. Included test instance.

Not sure which is right for you?

Meet Today’s STORM Leaders

STORM was developed by internal OTRS Group security operations experts using the OTRS service management platform as its foundation. OTRS is a world-renowned service management solution that complies with all GDPR-defined processes. The platform has been used by service teams of all sizes, across all industries, since 2001.

Led by the security expertise of the STORM team, the service management solution was developed into a full-fledged SOAR known as STORM.

Director of Consulting,
STORM and Security
Support Desk,
Team Member

Jens Bothe

Rafael Prenzier dos Santos

Carlos Rodriguez

Mathias Roehl

Jens is an active leader in the cyberdefense community and has years of experience in security process design. He is also responsible for Security and Vulnerability Management within the OTRS Group.
He's been with OTRS Group for 15 years.

Rafael is a cybersecurity solutions engineer with 17 years of expertise in web development and software architecture. His focus is on critical projects that necessitate high performance and scalability.

Carlos has been the lead developer of the STORM solution since 2019. He has been with OTRS Group for more than 10 years, and he is currently responsible for handling all software-related security issues.

Leads STORM-specific support efforts.

Get Started with the STORM platform today.