Skip to main content
TrustRadius
Splunk SOAR

Splunk SOAR
Formerly Phantom

Overview

What is Splunk SOAR?

Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.

Read more
Recent Reviews

TrustRadius Insights

Splunk SOAR has proven to be a valuable tool for organizations seeking to automate and manage their security operations. Users have …
Continue reading

General feedback

8 out of 10
July 20, 2023
Incentivized
We use Splunk SOAR to manage our security alerts for internal detections as well as external reports. Thanks to the automation our …
Continue reading
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing
N/A
Unavailable

What is Splunk SOAR?

Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.

Entry-level set up fee?

  • No setup fee
For the latest information on pricing, visithttps://www.splunk.com/en_us/products/p…

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

66 people also want pricing

Alternatives Pricing

What is KnowBe4 PhishER?

PhishER is presented as a lightweight Security Orchestration, Automation and Response (SOAR) platform to orchestrate threat response and manage the high volume of potentially malicious email messages reported by users. And, with automatic prioritization of emails, PhishER helps InfoSec and Security…

Return to navigation

Product Details

What is Splunk SOAR?

Splunk SOAR provides security orchestration, automation and response capabilities that allow security analysts to work smarter by automating repetitive tasks; respond to security incidents faster with automated detection, investigation, and response; increase productivity, efficiency and accuracy; and strengthen defenses by connecting and coordinating complex workflows across their team and tools. Splunk SOAR also supports a broad range of security operations center (SOC) functions including event and case management, integrated threat intelligence, collaboration tools and reporting.

Splunk SOAR Competitors

Splunk SOAR Technical Details

Operating SystemsUnspecified
Mobile ApplicationNo

Frequently Asked Questions

Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.

Palo Alto Networks Cortex XSOAR and Chronicle SOAR are common alternatives for Splunk SOAR.

Reviewers rate Performance highest, with a score of 8.9.

The most common users of Splunk SOAR are from Enterprises (1,001+ employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(85)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

Splunk SOAR has proven to be a valuable tool for organizations seeking to automate and manage their security operations. Users have reported improvements in overall security posture and efficiency, particularly in the areas of threat detection, incident response, and vulnerability management. The software offers automation capabilities that help achieve almost zero downtime, along with user-friendly dashboards that provide valuable insights for analysts and managers.

One of the key use cases of Splunk SOAR is its ability to create playbooks based on widely recognized frameworks such as MITRE and NIST. This feature allows users to streamline their security operations by automating repetitive tasks and responding to security incidents effectively. The software also supports case management and offers integrated threat intelligence, enabling users to make informed decisions.

Consultants who have implemented Splunk SOAR have found it particularly helpful when receiving alerts from SIEM systems and undergoing training. It has proven to be a reliable tool for active threat detection, alert monitoring, and managing threats efficiently with its algorithm-based signature handling.

The customization feature of Splunk SOAR is highly valued by users as it enables them to include custom codes in their playbooks. This flexibility allows organizations to tailor the software to their specific needs and enhance its functionality.

Managed IT service providers have been deploying and managing Splunk SOAR for mid-sized businesses with great success. By automating tasks, detecting threats, and fostering innovation, the software helps these providers deliver efficient and effective security services.

In cybersecurity research sectors, Splunk SOAR is frequently employed for threat monitoring, logging, security analysis, and addressing fixes. Its comprehensive capabilities support improved incident response capabilities, build robust log analytics, and strengthen defense through security orchestration and integration.

Overall, Splunk SOAR provides organizations with the tools they need to respond quickly to security issues, automate workflows, enhance collaboration among team members, and improve incident resolution processes. With its powerful automation features and user-friendly interface, the software streamlines threat investigation, enriches actions based on alerts, and facilitates the monitoring and management of security alerts and notifications for various applications.

Effective Automation and Optimization: Many users have found that the automation and optimization features of the security system have been effective in reducing the probability of security incidents.

Seamless Integration with Other Security Tools: Reviewers appreciate the seamless integration of the security system with other security tools and systems, which allows them to address their specific needs and requirements. This integration enhances overall efficiency and effectiveness in managing security operations.

Centralized Platform for Managing Security Operations: The centralized platform for managing and coordinating security operations is considered a valuable feature by many users. It provides a unified interface to monitor, manage, and respond to security issues, streamlining workflows and enhancing productivity.

Confusing and complex user interface: Several users have found the user interface of the product to be confusing and complex, requiring extensive training to understand its functionality. Some users have described it as overwhelming and in need of improvement, especially for beginners.

High cost: The cost of purchasing and implementing the product is considered high by some customers, making it difficult for them to afford. Additionally, some users have mentioned that the advanced features of the software do not necessarily provide enough value for the price.

Lack of integration with other tools: Many users have encountered challenges when trying to integrate the product with other tools outside the Splunk environment. They have expressed limitations in integration with other products and a need for better documentation on the API.

Attribute Ratings

Reviews

(1-1 of 1)
Companies can't remove reviews or game the system. Here's why
Giuseppe Cusello | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
ResellerIncentivized
I'm a consultant in Splunk and SOAR implementing for our customers and I'm not a final user. The scope of my Use cases is intervened after an alert from SIEM. I tried to use Phantom, but it was difficult so I did the training about Phantom and now it's more clear.
  • Ingestion and analysis of data for security issues
  • possibility to perform automaticincident response actions
  • itpermits to SOC analysts to investigate and intervene on systems
  • The interface isn't immediate in comprehension, I had to follow a training to understand how it works
  • it's expensive: not all the customers can buy it!
  • It needs PostgreSQL as DB, I'd like to have all inside Splunk also data.
As I said, it's complicated to initially understand, but when a user understands its features and starts to use it, it's a fantastic platform for security incident response. I configured it for a customer that migrated its SOC from RSA to Splunk Enterprise Security. Now we're trying to propose it to another of our customer's SOC.
  • Satisfy customers
  • Have an integrated solution for our proposal
  • Avoid the presence (as much as possible) of external products in security management
As I already said, when opportunity trained, it's very easy to use the Phantom interface in Playbook creation. In addition, it's useful to securely access every kind of system and automate all the automatable activities. At the same time, permits a straight control on both manual and automated operations. The number of events and systems to manage isn't so relevant: it's relevant only the number of automatable activities and/or the number of operators.
We are a Splunk Partner and I know Splunk Phantom, for this reason we usually propose it, but I don't deeply know other competitor products.
1
I'm the only one involved in Phantom Consultancies activities
1
I'm a Splunk Architect, an expert in Enterprise Security and a CISA
  • Support SIEM in data analysis
  • intervenes on systems after a security incident
  • Automate as many as possibile activities
  • Complete Splunk ES offering
  • Complete Splunk ES offerings
It's a fantastic product, even if a little expensive.
No
  • Product Features
  • Product Reputation
We're a Splunk Partners and we have a large knowledge about it in our organization, so we preferred to use a fully integrated SOAR product in out projects, the only limitation we encountered in the integrated offer is the high cost of it.
I don't change it!
Im satisfied by this product, We'd propose much more it with a lower price.
  • Implemented in-house
Yes
Analysis and requirements definition
Design,
Installation,
Configuration
Tuning
Change management was a minor issue with the implementation
It need a well done role definition to maintain a complete control on all the activities (manual and automated).
  • No relevant issues
I already said that the main key insight is the knowledge of Phantom, so a detailed training for all the people involeved.
  • Online training
I never followed an in-person training, I gave my evaluation based on the online training
I followed training for Phantom admins and it opened a world for me
Having a training it's well configurable
Always have a development environment to use for testing.
No - we have not done any customization to the interface
No - we have not done any custom code
No additional configurations or customizations
Splunk Support is always great! In addition the Community is very efficient and active.
No never, it's expensive!
No
No they didn't
Not immediate: it always requires a training.
  • Playbooks at first
  • External Systems access
  • Atomated activies configuration
  • All without training, non with training
  • Maybe installation
me and the customers I encountered found it flexible and scalable
Return to navigation