General feedback

We use Splunk SOAR to manage our security alerts for internal detections as well as external reports. Thanks to the automation our analysts don’t have to spend as much time doing the basics of investigation and can spend more time resolving incidents. We also utilize Splunk SOAR to reduce alert fatigue grouping similar alerts and provide analyst tools to suppress some alerts.

Building automations has scaled to the difficulty you make it. If you want a simple drag and drop automation you can do that, if you want to dive into code and have more advanced automations you can do that too! Splunk SOAR has a variety of apps already built and maintained by the community that’ll help you get just about anything done.