Item: Splunk SOAR
Rating: 10
Author: Giuseppe Cusello

Overall Satisfaction with Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom

Use Cases and Deployment Scope

I'm a consultant in Splunk and SOAR implementing for our customers and I'm not a final user. The scope of my Use cases is intervened after an alert from SIEM. I tried to use Phantom, but it was difficult so I did the training about Phantom and now it's more clear.

Pros and Cons

Pros

Ingestion and analysis of data for security issues
possibility to perform automaticincident response actions
itpermits to SOC analysts to investigate and intervene on systems

Cons

The interface isn't immediate in comprehension, I had to follow a training to understand how it works
it's expensive: not all the customers can buy it!
It needs PostgreSQL as DB, I'd like to have all inside Splunk also data.

Return on Investment

Satisfy customers
Have an integrated solution for our proposal
Avoid the presence (as much as possible) of external products in security management

Performance

As I already said, when opportunity trained, it's very easy to use the Phantom interface in Playbook creation. In addition, it's useful to securely access every kind of system and automate all the automatable activities. At the same time, permits a straight control on both manual and automated operations. The number of events and systems to manage isn't so relevant: it's relevant only the number of automatable activities and/or the number of operators.

Alternatives Considered

We are a Splunk Partner and I know Splunk Phantom, for this reason we usually propose it, but I don't deeply know other competitor products.

Key Insights

Do you think Splunk SOAR delivers good value for the price?

Not sure

Are you happy with Splunk SOAR's feature set?

Yes

Did Splunk SOAR live up to sales and marketing promises?

Yes

Did implementation of Splunk SOAR go as expected?

Yes

Would you buy Splunk SOAR again?

Yes

Other Software Used

Splunk Enterprise, Splunk Enterprise Security (ES)

Likelihood to Recommend

As I said, it's complicated to initially understand, but when a user understands its features and starts to use it, it's a fantastic platform for security incident response. I configured it for a customer that migrated its SOC from RSA to Splunk Enterprise Security. Now we're trying to propose it to another of our customer's SOC.

Using Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom

Users and Roles

1 - I'm the only one involved in Phantom Consultancies activities

Support Headcount Required

1 - I'm a Splunk Architect, an expert in Enterprise Security and a CISA

Business Processes Supported

Support SIEM in data analysis
intervenes on systems after a security incident
Automate as many as possibile activities

Innovative Uses

Complete Splunk ES offering

Future Planned Uses

Complete Splunk ES offerings

Likelihood to Renew

It's a fantastic product, even if a little expensive.

Evaluating Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom and Competitors

Products Replaced

Key Differentiators

Product Features
Product Reputation

We're a Splunk Partners and we have a large knowledge about it in our organization, so we preferred to use a fully integrated SOAR product in out projects, the only limitation we encountered in the integrated offer is the high cost of it.

Evaluation Lessons Learned

I don't change it!
Im satisfied by this product, We'd propose much more it with a lower price.

Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom Implementation

Implementation Rating

I already said that the main key insight is the knowledge of Phantom, so a detailed training for all the people involeved.

Implementation Details / Implementation Partner

Implemented in-house

No relevant issues

Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom Training

Training Types Used

Online training

In-Person Training

I never followed an in-person training, I gave my evaluation based on the online training

Online Training

I followed training for Phantom admins and it opened a world for me

Configuring Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom

Splunk SOAR (Security Orchestration, Automation and Response), formerly Phantom Support

Support Rating

Splunk Support is always great! In addition the Community is very efficient and active.

Splunk SOAR Customer Support Pros and Cons

Pros	Cons
Quick Resolution Good followup Knowledgeable team Problems get solved Kept well informed No escalation required Immediate help available Support understands my problem Support cares about my success Quick Initial Response	None