Item: Splunk SOAR
Rating: 10
Author: Verified User

Overall Satisfaction with Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom

Use Cases and Deployment Scope

Using it for demonstrations and showing how to investigate based on Splunk alerts and threat intel. Playbooks either query Splunk to show that malicious IP's did not successfully log in, or how to search third party sites for information

Pros and Cons

Pros

All Python based
new app editor
Speed and stability

Cons

Ease of use for new users
war room
update the UI to make it easier to view containers in the analyst queue

Return on Investment

takes out the repetitive work

Performance

Performance is phenomenal.

Key Insights

Do you think Splunk SOAR delivers good value for the price?

Yes

Are you happy with Splunk SOAR's feature set?

Yes

Did Splunk SOAR live up to sales and marketing promises?

Yes

Did implementation of Splunk SOAR go as expected?

Yes

Would you buy Splunk SOAR again?

Yes

Other Software Used

Splunk Enterprise, VirusTotal, Palo Alto Networks Next-Generation Firewalls - PA Series

Likelihood to Recommend

Really being able to automate anything. It just depends on how much you can do with the visualizer

Comments

Please log in to join the conversation

SOAR Review