TrustRadius Insights
Splunk SOAR has proven to be a valuable tool for organizations seeking to automate and manage their security operations. Users have …
Splunk SOARFormerly Phantom
Overview
What is Splunk SOAR?
Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Reviewer Pros & Cons
Pricing
N/A
Unavailable
What is Splunk SOAR?
Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.
Entry-level set up fee?
- No setup fee
For the latest information on pricing, visithttps://www.splunk.com/en_us/products/p…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Would you like us to let the vendor know that you want pricing?
67 people also want pricing
Alternatives Pricing
What is KnowBe4 PhishER/PhishER Plus?
PhishER is presented as a lightweight Security Orchestration, Automation and Response (SOAR) platform to orchestrate threat response and manage the high volume of potentially malicious email messages reported by users. And, with automatic prioritization of emails, PhishER helps InfoSec and Security…
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Splunk SOAR?
Splunk SOAR provides security orchestration, automation and response capabilities that allow security analysts to work smarter by automating repetitive tasks; respond to security incidents faster with automated detection, investigation, and response; increase productivity, efficiency and accuracy; and strengthen defenses by connecting and coordinating complex workflows across their team and tools. Splunk SOAR also supports a broad range of security operations center (SOC) functions including event and case management, integrated threat intelligence, collaboration tools and reporting.
Splunk SOAR Competitors
- Palo Alto Networks Cortex XSOAR
- Google Security Operations
- IBM QRadar SOAR
Splunk SOAR Technical Details
| Operating Systems | Unspecified |
|---|---|
| Mobile Application | No |
Frequently Asked Questions
Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.
Palo Alto Networks Cortex XSOAR and Google Security Operations are common alternatives for Splunk SOAR.
Reviewers rate Performance highest, with a score of 8.9.
The most common users of Splunk SOAR are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(85)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Business Problems Solved
- Pros
- Cons
Splunk SOAR has proven to be a valuable tool for organizations seeking to automate and manage their security operations. Users have reported improvements in overall security posture and efficiency, particularly in the areas of threat detection, incident response, and vulnerability management. The software offers automation capabilities that help achieve almost zero downtime, along with user-friendly dashboards that provide valuable insights for analysts and managers.
One of the key use cases of Splunk SOAR is its ability to create playbooks based on widely recognized frameworks such as MITRE and NIST. This feature allows users to streamline their security operations by automating repetitive tasks and responding to security incidents effectively. The software also supports case management and offers integrated threat intelligence, enabling users to make informed decisions.
Consultants who have implemented Splunk SOAR have found it particularly helpful when receiving alerts from SIEM systems and undergoing training. It has proven to be a reliable tool for active threat detection, alert monitoring, and managing threats efficiently with its algorithm-based signature handling.
The customization feature of Splunk SOAR is highly valued by users as it enables them to include custom codes in their playbooks. This flexibility allows organizations to tailor the software to their specific needs and enhance its functionality.
Managed IT service providers have been deploying and managing Splunk SOAR for mid-sized businesses with great success. By automating tasks, detecting threats, and fostering innovation, the software helps these providers deliver efficient and effective security services.
In cybersecurity research sectors, Splunk SOAR is frequently employed for threat monitoring, logging, security analysis, and addressing fixes. Its comprehensive capabilities support improved incident response capabilities, build robust log analytics, and strengthen defense through security orchestration and integration.
Overall, Splunk SOAR provides organizations with the tools they need to respond quickly to security issues, automate workflows, enhance collaboration among team members, and improve incident resolution processes. With its powerful automation features and user-friendly interface, the software streamlines threat investigation, enriches actions based on alerts, and facilitates the monitoring and management of security alerts and notifications for various applications.
Effective Automation and Optimization: Many users have found that the automation and optimization features of the security system have been effective in reducing the probability of security incidents.
Seamless Integration with Other Security Tools: Reviewers appreciate the seamless integration of the security system with other security tools and systems, which allows them to address their specific needs and requirements. This integration enhances overall efficiency and effectiveness in managing security operations.
Centralized Platform for Managing Security Operations: The centralized platform for managing and coordinating security operations is considered a valuable feature by many users. It provides a unified interface to monitor, manage, and respond to security issues, streamlining workflows and enhancing productivity.
Confusing and complex user interface: Several users have found the user interface of the product to be confusing and complex, requiring extensive training to understand its functionality. Some users have described it as overwhelming and in need of improvement, especially for beginners.
High cost: The cost of purchasing and implementing the product is considered high by some customers, making it difficult for them to afford. Additionally, some users have mentioned that the advanced features of the software do not necessarily provide enough value for the price.
Lack of integration with other tools: Many users have encountered challenges when trying to integrate the product with other tools outside the Splunk environment. They have expressed limitations in integration with other products and a need for better documentation on the API.
Attribute Ratings
Reviews
(1-25 of 40)Companies can't remove reviews or game the system. Here's why
October 29, 2023
Awesome tool for Security Monitoring.
- Incident reporting and management.
- Orchestration
- Security Monitoring.
- Documentation can be improved.
- Room for improvement in UI. (Can be confusing for beginners).
September 12, 2023
Splunk SOAR Robust and efficient.
- Playbook Design.
- Robust and Speed.
- Flexibility
- Integration with On-Prem.
- Access to more APIs in the apps section.
- Improving API actions.
September 11, 2023
Splunk SOAR Review
- Prioritize alerts
- Improve operational efficiency and productivity
- Automate response and remediation actions
- It's specifically geared for SOC and not broader automation
- The artifact filtering that's forced on everything inside the platform is pretty awful
- the documentation and support could be improved
September 08, 2023
Great tool, wish for more documentation
- Easy to use
- Nice visual
- Missing documentation
- view is hard to see in one
September 04, 2023
A product that although has some qwirks, is one of the more flexible SOAR platforms to work with
- REST API calls to other products for orchestration
- Incident Response (if utilized correctly)
- Monitoring and Logging efforts
- Incident Response capabilities and features
- Apps and streamlining the build process
- real time syntax linting
- Available Documentation and online Learnings
July 20, 2023
General feedback
- Automate detail collection for incidents
- Provide the tools to quickly resolve incidents
- User prompts aren’t fully featured
- The ui can be a bit overwhelming to use at first
- effective threat monitoring
- Score based threat level detection for handling attacks that require priority.
- highly effective reporting templates for vulnerability testing
- Advanced features are not cost effective.
- Live monitoring and threats require more clarity
- Require professional and sound knowledge on networking to operate.
- workflows orchestration
- security threat detections
- security threat alerts
- SPL Intelligence
- Support
March 29, 2023
Splunk SOAR: A great orchestration and automation tool
- Excellent UI
- Easy to make playbooks
- Very good collaboration tools
- Lots of integrations
- Price
- Splunk SOAR has lots of integration, still needs more
- Should be easy to scale
- Automated analyzes that eliminate manual work.
- Order of priority in the analysis, determining greater efficiency in the detection of threats.
- Great time savings and easy code writing, without being experts we achieve good cases of alerts.
- We found no major flaws with Splunk SOAR, but it is slightly disadvantaged by the acquisition price, as it is high and some companies may think twice before buying it.
December 20, 2022
"SOAR" your return on investments.
- Automation and optimization of security systems which help to reduce the probability of security incidents.
- It seamlessly integrates with other security tools and systems to help us address our specific needs and requirements.
- Centralized platform for managing and coordinating our security operations.
- Due to its complex nature, it is quite difficult to learn and master.
- The cost of purchasing and implementing it is quite high.
December 18, 2022
Splunk SOAR - The CIA of Software Security
- Advanced capabilities for inspection of data for safety issues.
- Capability to performing automatic response actions.
- The guided product tour manual does not enclose all usability aspects.
- Splunk SOAR is not instant in conception, I had to heed on several sessions to understand how it works.
November 26, 2022
This is a review from a consultant not from a final user
- Ingestion and analysis of data for security issues
- possibility to perform automaticincident response actions
- itpermits to SOC analysts to investigate and intervene on systems
- The interface isn't immediate in comprehension, I had to follow a training to understand how it works
- it's expensive: not all the customers can buy it!
- It needs PostgreSQL as DB, I'd like to have all inside Splunk also data.
- Automation
- War room.
- Dashboarding
- Playbook management.
- TI procedures.
- more playbooks for small SOC teams.
- You'd probably need to create more custom playbooks and automation, so these most used actions should be created by Splunk.
October 11, 2022
Top Performing Splunk SOAR with top-tier automation.
- From a full-stack developer's perspective, Splunk SOAR's ability to utilize playbooks while also pulling data from OSINT tools is gold.
- Supports on-premises, on-cloud and hybrid implementations with equal measure.
- It has always been a great challenge integrating Splunk SOAR with other tools outside the Splunk environment.
- Automation of repetitive tasks and workflows which has really helped with faster response to threats.
- playbooks customization.
- Integration with other third party solutions
- Consolidation of security events into a cases for easier investigations.
- Some solutions are lacking in the documentation so we had to contact the support for information.
September 21, 2022
Splunk SOAR best for Security Orchestration
- Automatic Response
- Playbooks
- Security
- Ease of use
September 19, 2022
SOAR it
- Python easy usage
- Intuitive editor
- Expandable Eco system
- Better Documentation
September 19, 2022
Splunk SOAR Review
- Extensible
- Rich with custom applications
- Flexible
- Based on python
- Better support for apps
- Performance
- Improved code editor
August 16, 2022
Soar Up Your Security Automation with Splunk SOAR.
- Streamlined direction to other security tools for action
- The amalgamation of all security issues at a central place
- Faster app development process allows for the creation, testing and editing of apps from a single place
- Customization
- Limited integration with other products and documentation on the API
- Disaster recovery is still manual
July 28, 2022
SPLUNK SOAR REVIEW.
- Utilization simplicity and compatibility with the Windows environment.
- Automation capabilities.
- Playbooks are simple to use, integrate, and build.
- A lack of instruction It can be difficult to contact the support staff. Limited experience from current users.
- It takes some effort to set up and learn new technology at first. More assistance is required from the support staff. The product's price needs to go down.
- Cost of the larger version.
- precise handling of vulnerabilities with efficient algorithms
- excellent alerting system with in-detail solutions
- quality templates of reporting specific security events.
- Require more advancement in real time threat monitoring
- dashboards are less user-friendly, not fit for end users with basic networking knowledge.
- Advanced features come with a high price, when compared to its competitors
- In depth layer based network logging.
- Accurate automation of threat handling.
- Penetration testing with overall vulnerability management.
- Missing a utility dashboard.
- Automation features are not scalable.
- Requires advanced knowledge on networking to operate.
July 06, 2022
Highly powerful SIEM tool with Endless Capabitlies
- Security Orchestraction
- Custom Playbooks
- Integration to Cloud Applications
- Access Control Issues
- On-Prem Hosting Capabilities
- All incident investigations can be automated
- Generates reports easily and quickly after submitting the file to a malware sandbox
- Provides detailed analysis of suspicious activity.
- Some inaccuracies from their predictive models.