Splunk SOAR
By Splunk
Splunk's orchestration and automation product, acquired as Phantom in 2018 and most commonly deployed as the response arm alongside Splunk Enterprise Security. Playbooks can be built in a visual editor or written directly in Python for teams that prefer code.
Verified Source: 1
- Product type
- Software
- Deployment
- SaaSOn-prem
- Organization size
- Mid-marketEnterprise
- Pricing tier
- $$
Capability checklist
SOARHow Splunk SOAR measures up against the full Security Orchestration, Automation & Response taxonomy.
- Playbook / workflow automation — supported
- Runs automated multi-step response actions triggered by an alert.
- Case management — supported
- Tracks an incident from alert to closure with notes, evidence, and assignments.
- Integration & connector library — supported
- Connects to SIEM, EDR, ticketing, and other tools to take action across the stack.
- Alert triage & enrichment — supported
- Automatically gathers context on an alert before an analyst sees it.
- No-code / low-code playbook builder — supported
- Lets analysts build automation without writing custom scripts.
- Metrics & SLA reporting — not supported
- Reports response times and automation impact against team SLAs.
Alternatives
Other Security Orchestration, Automation & Response tools with overlapping capabilities, sized for similar teams.