Splunk SOAR Reviews & Ratings 2025

Overview

What is Splunk SOAR?

Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.

Awesome tool for Security Monitoring.

Rating: 9 out of 10

October 29, 2023

IncentivizedVetted ReviewVerified User

Splunk SOAR has helped us to monitor and manage the security alerts and notifications for our various applications. After setting up Splunk SOAR, investigation and resolution ...

Verified user

Engineer

1 year of experience

Splunk SOAR Robust and efficient.

Rating: 8 out of 10

September 12, 2023

IncentivizedVetted ReviewVerified User

We're using it for Automation to address different clients to help them reduce their working time on certain things, which helps them increase their efficiency and thereby hel...

Gaurav S

Consultant - Customer Service

Senior Security Specialist

Ernst and young

2 years of experience

Splunk SOAR Review

Rating: 9 out of 10

September 11, 2023

IncentivizedVetted ReviewVerified User

We are uing SOAR playbooks to automate the alerting mechanism for the Operations

Verified user

Employee

1 year of experience

A product that although has some qwirks, is one of the more flexible SOAR platforms to work with

Rating: 6 out of 10

September 4, 2023

IncentivizedVetted ReviewVerified User

As part of a security orchestration team, we build automations to help not only in our incident response capabilities, but we also utilize it for data movement and reporting p...

Verified user

Professional

1 year of experience

Exceptional threat reporting and efficient and robust algorithm based bug handling

Rating: 8 out of 10

May 31, 2023

IncentivizedVetted ReviewVerified User

We were largely depending on Splunk SOAR for active threat detection and alert monitoring .It has a good algorithm based signature handling which efficiently manages threats. ...

Ramu S R

Administrator - Information Technology

Junior Network Administrator

AMRITA VISHWA VIDYAPEETHAM

2 years of experience

Return to navigation

Pricing

View all pricing

Splunk SOAR

N/A

Unavailable

What is Splunk SOAR?

Entry-level set up fee?

No setup fee

For the latest information on pricing, visithttps://www.splunk.com/en_us/products/p…

Offerings

Free Trial
Free/Freemium Version
Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

75 people also want pricing

Alternatives Pricing

KnowBe4 PhishER/PhishER Plus

$0.75

per month (billed annually) per seat

What is KnowBe4 PhishER/PhishER Plus?

PhishER is presented as a lightweight Security Orchestration, Automation and Response (SOAR) platform to orchestrate threat response and manage the high volume of potentially malicious email messages reported by users. And, with automatic prioritization of emails, PhishER helps InfoSec and Security…

Trellix Helix

Free

What is Trellix Helix?

Trellix Helix (formerly FireEye Helix) is a SIEM solution providing a non-malware threat detection solution.

Return to navigation

Product Details

About
Competitors
Tech Details
FAQs

What is Splunk SOAR?

Splunk SOAR provides security orchestration, automation and response capabilities that allow security analysts to work smarter by automating repetitive tasks; respond to security incidents faster with automated detection, investigation, and response; increase productivity, efficiency and accuracy; and strengthen defenses by connecting and coordinating complex workflows across their team and tools. Splunk SOAR also supports a broad range of security operations center (SOC) functions including event and case management, integrated threat intelligence, collaboration tools and reporting.

Splunk SOAR Competitors

Splunk SOAR Technical Details

Operating Systems	Unspecified
Mobile Application	No

Frequently Asked Questions

Palo Alto Networks Cortex XSOAR and Google Security Operations are common alternatives for Splunk SOAR.

Reviewers rate Performance highest, with a score of 8.3.

The most common users of Splunk SOAR are from Enterprises (1,001+ employees).

Return to navigation

Comparisons

View all alternatives

Compare with

Reviews From Top Reviewers

View all reviews

(1-3 of 3)

Sort By *

Splunk SOAR Robust and efficient.

Rating: 8 out of 10

Incentivized

September 12, 2023

Gaurav S

Senior Security Specialist

Ernst and young (Security & Investigations, 10,001+ employees)

Vetted Review

Verified User

2 years of experience

View profile

Use Cases and Deployment Scope

We're using it for Automation to address different clients to help them reduce their working time on certain things, which helps them increase their efficiency and thereby help them meet the SLA. Splunk SOAR helps us with a lot of customization to include custom codes in the playbook, which is a deal breaker.

Pros

Playbook Design.
Robust and Speed.
Flexibility

Cons

Integration with On-Prem.
Access to more APIs in the apps section.
Improving API actions.

Likelihood to Recommend

If anyone is from a consulting background catering to multiple clients they can monitor all the clients by developing certain custom playbook which helps them to keep track of all these clients, thereby helping the team to monitor without putting in a lot of effort But Splunk SOAR has to develop cross-platform capabilities.

Return on Investment

Achieveing SLA.
Saving Analysts time.
Automation.

Performance

Splunk SOAR performance is really good, but the key thing over here is developing an efficient playbook design that saves a lot of computational cycles on the system, which helps the playbook function in an efficient manner for the user who'll be working on its needs to understand the product and come up with efficient playbooks.

Other Software Used

Splunk Enterprise Security (ES), Securonix Next-Generation SIEM, Palo Alto Networks Cortex XDR

Users and Roles

We all work on Splunk SOAR as consultants to cater to different clients by developing playbooks that help any organization save time for the operation teams in order to perform certain tedious tasks, thereby achieving the SLA as per the SOW and helping the client and the service providers to benefit.

Support Headcount Required

There are certain technical skills what the users need to have expertise in couple of main things are the users need to be good in python to develop certain custom playbooks and need to have good security knowledge inoder to address certain security concerns which the client mught have to be notified.

Business Processes Supported

API based alert enrichemnt.
Monitoring engagements.
Custom Playbooks.

Innovative Uses

Custom playbook.
Custom API
Custom API Actions.

Future Planned Uses

Scaling to a lot of clients.
Developing a custom playbook.
Developing custom API.

Likelihood to Renew

As we already have a lot of clients being catered with Splunk SOAR and because Splunk SOAR is robust and efficient, we are already using it, and we have understood the product to a certain extent, I feel we are personally more enticed to use and scale it to a lot of business.

We fuel our growth by having great protection in our system with automatic alerts.

Rating: 10 out of 10

Incentivized

March 20, 2023

Bernadette Johnsen

Senior Account Manager

Arrow Electronics (Information Technology & Services, 10,001+ employees)

Vetted Review

Verified User

2 years of experience

View profile

Use Cases and Deployment Scope

This software is very fast to protect our system, we require the services of Splunk SOAR to implement improvements in our internal system, since our network has always been a constant victim of the threats that abound on the web, in the installation process we had problems, but we loved having technical support, the implementation was completed in a short time, it is a complete system to automate alerts in advance, it has very good scans to neutralize threats and protect our information. We reduce manual analysis, and we are more effective because Spunk SOAR has an automated system to eliminate any threat that even tries to appear in our company.

Pros

Automated analyzes that eliminate manual work.
Order of priority in the analysis, determining greater efficiency in the detection of threats.
Great time savings and easy code writing, without being experts we achieve good cases of alerts.

Cons

We found no major flaws with Splunk SOAR, but it is slightly disadvantaged by the acquisition price, as it is high and some companies may think twice before buying it.

Likelihood to Recommend

To all the community that is still hesitating to buy Splunk SOAR, I must say that this is the most scalable system on the market to prevent threats from penetrating the enterprise system. I rate them with 10 points because it is a very dynamic software, it generates productivity and a lot of confidence among employees, it is not slow, the alerts detected prevent future inconveniences, and you do not have to know much about writing code, because it is structured in Python, which generates a quick configuration.

Return on Investment

Decrease in manual errors, since the entire analysis process is automated.
It has priority on threats, which ensures that there are no false positives.
Good quality of automated responses.

Performance

I give them the highest grade (10 points) because the whole configuration process is very fast, I don't need to know much, just what is necessary to be able to configure the alert processes, the playbooks allow us to be more effective in automation, without manual analysis, all alerts are automated, the detection and restriction of threats have increased.

Other Software Used

AccessPay, Book Systems, Acodis – Intelligent Document Processing (IDP)

Users and Roles

Support Headcount Required

Business Processes Supported

Effective responses to problems and incidents that arise.

Innovative Uses

Splunk SOAR is a high quality system that we constantly use to prevent problems in our system, detection is immediate and ensures benefits.

Future Planned Uses

With Splunk SOAR we will have a better vision of our IT infrastructure and with the rapid response of this software we will maintain security with a good quality of automation.

Likelihood to Renew

It is a really efficient system that has good artificial intelligence for incident prevention, it is not complicated to use and can be quickly customized, it is software that we like to use.

This is a review from a consultant not from a final user

Rating: 10 out of 10

Incentivized

November 26, 2022

Giuseppe Cusello

GRC Director

Cyber Partners S.p.A. (Information Technology & Services, 11-50 employees)

Vetted Review

Reseller

1 year of experience

View profile

Use Cases and Deployment Scope

I'm a consultant in Splunk and SOAR implementing for our customers and I'm not a final user. The scope of my Use cases is intervened after an alert from SIEM. I tried to use Phantom, but it was difficult so I did the training about Phantom and now it's more clear.

Pros

Ingestion and analysis of data for security issues
possibility to perform automaticincident response actions
itpermits to SOC analysts to investigate and intervene on systems

Cons

The interface isn't immediate in comprehension, I had to follow a training to understand how it works
it's expensive: not all the customers can buy it!
It needs PostgreSQL as DB, I'd like to have all inside Splunk also data.

Likelihood to Recommend

As I said, it's complicated to initially understand, but when a user understands its features and starts to use it, it's a fantastic platform for security incident response. I configured it for a customer that migrated its SOC from RSA to Splunk Enterprise Security. Now we're trying to propose it to another of our customer's SOC.

Return on Investment

Satisfy customers
Have an integrated solution for our proposal
Avoid the presence (as much as possible) of external products in security management

Performance

As I already said, when opportunity trained, it's very easy to use the Phantom interface in Playbook creation. In addition, it's useful to securely access every kind of system and automate all the automatable activities. At the same time, permits a straight control on both manual and automated operations. The number of events and systems to manage isn't so relevant: it's relevant only the number of automatable activities and/or the number of operators.

Alternatives Considered

We are a Splunk Partner and I know Splunk Phantom, for this reason we usually propose it, but I don't deeply know other competitor products.

Other Software Used

Splunk Enterprise, Splunk Enterprise Security (ES)

Users and Roles

I'm the only one involved in Phantom Consultancies activities

Support Headcount Required

I'm a Splunk Architect, an expert in Enterprise Security and a CISA

Business Processes Supported

Support SIEM in data analysis
intervenes on systems after a security incident
Automate as many as possibile activities

Innovative Uses

Complete Splunk ES offering

Future Planned Uses

Complete Splunk ES offerings

Likelihood to Renew

It's a fantastic product, even if a little expensive.

Products Replaced

Key Differentiators

Product Features
Product Reputation

We're a Splunk Partners and we have a large knowledge about it in our organization, so we preferred to use a fully integrated SOAR product in out projects, the only limitation we encountered in the integrated offer is the high cost of it.