Splunk SOAR

Name: Splunk SOAR
Brand: Splunk
Rating: 4.3 (167 reviews)

Leader

The cybersecurity and observability leader

Est 2003|Valuation $26.4B|Raised $1.7B|113 Ref Customers

LinkedIn 799K|Website|Web traffic 1.0M|FTEs 9,231|HQ San Francisco, California, US

MarketsSecurity Information and Event Management (SIEM)Security Orchestration, Automation, and Response (SOAR)

Where Splunk SOAR tends to be chosen: - In environments where Splunk ES or Splunk Cloud is already in use, SOAR can align closely with existing detection-to-response workflows. - Organizations that require a hybrid skills model (visual editor plus scripting) report that the platform supports both less-technical analysts and advanced users. - FedRAMP Moderate authorization and GovCloud hosting are relevant factors for public-sector or regulated workloads. Where competitors tend to be chosen: - For speed-to-value and simplicity, cloud-native tools that emphasize API-first automation can be preferred, especially where SOAR program needs are limited or focused on rapid deployment. - Tooling alignment with an existing vendor ecosystem (for example, Palo Alto Networks deployments) can favor other SOAR or automation options. Customer commentary suggests the platform can be highly capable for complex orchestration needs but may be disproportionate for minor or one-off automations.

01Competitive Landscape

Narrative analysis

Where Splunk SOAR tends to be chosen:

In environments where Splunk ES or Splunk Cloud is already in use, SOAR can align closely with existing detection-to-response workflows.
Organizations that require a hybrid skills model (visual editor plus scripting) report that the platform supports both less-technical analysts and advanced users.
FedRAMP Moderate authorization and GovCloud hosting are relevant factors for public-sector or regulated workloads.

Where competitors tend to be chosen:

For speed-to-value and simplicity, cloud-native tools that emphasize API-first automation can be preferred, especially where SOAR program needs are limited or focused on rapid deployment.
Tooling alignment with an existing vendor ecosystem (for example, Palo Alto Networks deployments) can favor other SOAR or automation options.

Customer commentary suggests the platform can be highly capable for complex orchestration needs but may be disproportionate for minor or one-off automations.

	Splunk SOAR	Palo Alto Cortex XSOAR	Tines
Starting Price	Not publicly listed; quote-based; seat pricing metric	Context-specific public-sector listings exist	Public pricing varies; typically quote-based for enterprise
Most suitable for	Splunk-centric SecOps; enterprise SOCs; complex IR with many integrations	Palo Alto-centric environments and larger IR programs	Teams seeking cloud-native, API-first automation with faster time-to-value
Key Strength	Integration with Splunk ES workflows; playbooks and case management	Mature SOAR capabilities and content ecosystem	Rapid deployment and simpler cloud-native automation workflows
Key Weakness	Learning curve; maintainability of large playbooks; ongoing maintenance needs	Can be complex and costly for some teams	May lack depth in case management for very large SOAR programs