SOAR (Security Orchestration, Automation, and Response) reduces the amount of human intervention required, which is an advantage over SIEM (Security Information and Event Management). SIEM is a tool that collects, analyzes, and correlates data from various sources, such as logs, alerts, and events, to provide security monitoring and incident detection. SIEM can help security teams identify and prioritize potential threats, but it still requires manual intervention to investigate and respond to incidents2. SOAR is a tool that builds on SIEM by automating and orchestrating various security tasks and workflows, such as incident response, threat hunting, and threat intelligence. SOAR can help security teams reduce manual effort, improve efficiency, and accelerate incident resolution3.

The first step the analyst should take to prevent further spread of the mining operation is to quarantine all the impacted hosts for forensic analysis. Quarantining the hosts can help isolate them from the network, and prevent them from communicating with other devices or servers that may be part of the mining operation. Forensic analysis can help identify the source and scope of the infection, and provide clues for remediation and recovery.

Explanation/Reference:

Explanation
Bin /Bash in this log. looks like reverse shell and definately remote command exacution and downloading something.