No more typing reviews! Try our Samantha, our new voice AI agent.
Splunk SOAR Logo

Splunk SOAR Reviews

Vendor: Splunk
4.1 out of 5
Badge Leader
Leave a review

What is Splunk SOAR?

Splunk SOAR focuses on automating security operations with seamless third-party integrations and customizable workflows, enhancing incident response and threat management.

Get the Splunk SOAR Buyer's Guide and find out what your peers are saying about Splunk SOAR, IBM Security QRadar, Microsoft Sentinel and more!
Splunk SOAR is the #2 ranked solution in SOAR tools. PeerSpot users give Splunk SOAR an average rating of 8.2 out of 10. Splunk SOAR is most commonly compared to IBM Security QRadar: Splunk SOAR vs IBM Security QRadar. Splunk SOAR is popular among the large enterprise segment, accounting for 53% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 12% of all views.
Buyer's Guide
Splunk SOAR
May 2026
Get the report
Helped 895,990 peers since 2012

Featured Splunk SOAR reviews

Read more reviews

Splunk SOAR mindshare

As of May 2026, the mindshare of Splunk SOAR in the Security Orchestration Automation and Response (SOAR) category stands at 7.4%, up from 7.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Mindshare Distribution
ProductMindshare (%)
Splunk SOAR7.4%
Microsoft Sentinel10.1%
Palo Alto Networks Cortex XSOAR8.8%
Other73.7%
Security Orchestration Automation and Response (SOAR)

PeerResearch reports based on Splunk SOAR reviews

TypeTitleDate
CategorySecurity Orchestration Automation and Response (SOAR)May 24, 2026Download
ProductReviews, tips, and advice from real usersMay 24, 2026Download
ComparisonSplunk SOAR vs Microsoft SentinelMay 24, 2026Download
ComparisonSplunk SOAR vs Palo Alto Networks Cortex XSOARMay 24, 2026Download
ComparisonSplunk SOAR vs TorqMay 24, 2026Download
Suggested products
TitleRatingMindshareRecommending
IBM Security QRadar4.05.9%90%217 interviewsAdd to research
Microsoft Sentinel4.110.1%93%109 interviewsAdd to research
 
 
Key learnings from peers
Last updated May 24, 2026

Valuable Features

Splunk SOAR excels in integrating with a wide range of third-party apps, enabling seamless automation and orchestration. Its playbooks significantly shorten response times, enhance efficiency, and reduce the manual workload. The platform's user-friendly interface empowers teams to create custom playbooks and automate processes using Python. Splunk SOAR's centralized visibility and threat intelligence features aid in managing security incidents effectively, saving time and improving mean time to detect and resolve issues.
  • "Manually, investigation may take thirty minutes to several hours, but with the Splunk SOAR playbook, the same process can often be completed in a few seconds to a few minutes, up to five to ten minutes, leading to a reduction of fifty to ninety percent in response time."
  • "Analysts save a lot of time with Splunk SOAR because all relevant details from phishing emails, including the email ID, IP address, sender information, and email content such as links or attachments, are automatically integrated into an incident and sent to ServiceNow, making troubleshooting easier and enabling them to start investigating directly or know what to do next."
  • "I have saved much time thanks to Splunk SOAR's impact, where earlier, without autonomous monitoring, users took almost one day or two days; now, a twenty-four hour job is done in almost thirty minutes."

Room for Improvement

Splunk SOAR requires improved Microsoft integration and enhanced playbooks with less need for customization. The interface and performance need optimization, with easier user rights management and debugging tools. It should offer more AI-driven features, better threat intelligence feeds, and a comprehensive learning curve. Enhanced API support, integration capabilities, and an expandable platform for threat intelligence would be beneficial. The pricing strategy could be more accommodating for scalability. Users suggest a more intuitive development environment and enhanced case management functionality.
  • "Real-time monitoring of alerts and incidents, centralized dashboards, case management, and correlation of data from SIEM, firewalls, EDR, and cloud tools could be improved."
  • "To make Splunk SOAR more usable, the tool needs to be simplified."
  • "From the improvement point of view regarding Splunk SOAR, I suggest including more types of LLM models such as autonomous AI models including Anthropic and Opus 4.6, as well as creating a playground for new users to work on these, which will significantly help solve complex problems and assist new companies in understanding how Splunk works easily."

ROI

Organizations experienced notable return and time efficiency improvements with Splunk SOAR, highlighting automation's role in reducing security task durations and costs, improving DevOps productivity, increasing attack containment, and enabling strategic focus. While some took time to realize benefits due to integration needs, others saw immediate reductions in personnel requirements and manual workload. Setup efforts were noted as essential, with mixed experiences in quantifying the direct impact on staffing levels. Challenges persisted around adjusting systems and metrics development.

Pricing

Enterprise buyers report that Splunk SOAR's pricing is generally viewed as high, especially for smaller organizations. The cost is often tied to the number of users and data processed, with additional fees for setup and support. Despite its higher price compared to competitors, many users find the value justifiable due to its robust capabilities, integration features, and potential return on investment through enhanced automation and workflow efficiency. However, some express dissatisfaction with price increases and lack of negotiation flexibility.
  • "Splunk SOAR is moderately priced, neither cheap nor overly expensive."
  • "Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
  • "I found the price of Splunk SOAR to be good."

Popular Use Cases

Security teams primarily utilize Splunk SOAR for automating incident response processes, boosting efficiency, and minimizing manual labor in Security Operations Centers. Integrating third-party applications, it streamlines threat investigations, security workflows, and automates responses to incidents like phishing, ransomware, and brute force attacks. Users emphasize its ability to enrich alerts, automate email security, and integrate with essential tools, ultimately reducing response times and enhancing security measures.

Service and Support

Splunk SOAR's customer service and technical support are generally considered good, responsive, and knowledgeable. They prioritize tickets by criticality and offer helpful documentation. Some users prefer community solutions for quicker results. Feedback highlighted positive professional service experiences and support for various integrations. While some users desire faster response times and improved support for specific industry cases, many are satisfied with their interactions, often rating support between seven and nine out of ten.

Deployment

Many found Splunk SOAR setup moderately challenging initially but uncomplicated once familiarized. Deployment times varied, averaging a few hours to several weeks, depending on infrastructure complexity and customization needs. Some reported seamless experiences with little difficulty, while others faced integration challenges requiring additional support. Playbook creation was praised for its user-friendly interface, eliminating the need for extensive coding knowledge. Multiple team members typically participated in deployment, with training and maintenance periods also varying greatly.

Scalability

Splunk SOAR is highly scalable. It supports both large and small organizations, handling increased security alerts and automated workflows. Users report it scales to handle enterprise-level environments though some experience slowdowns with larger clusters or specific configurations. Ratings generally indicate strong scalability, though room for improvement is noted. The scalability handles various organizational sizes and volumes effectively, enabling expansion with additional users and playbooks while maintaining performance.

Stability

Users report that Splunk SOAR is generally stable, with consistent performance and minimal downtime. Some emphasize the stability of the SAAS model and note specific configurations are vital for optimal results. Stability issues, when present, typically relate to external factors or resource limitations rather than inherent platform defects. High-availability features support its resilience. While some minor issues are mentioned, most accounts confirm reliability, with many giving it ratings of eight out of ten for stability.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Splunk SOAR Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business14
Midsize Enterprise7
Large Enterprise32
By reviewers
By visitors reading reviews
Company SizeCount
Small Business177
Midsize Enterprise129
Large Enterprise352
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
12%
Manufacturing Company
9%
Computer Software Company
7%
University
6%
Comms Service Provider
6%
Construction Company
6%
Outsourcing Company
6%
Healthcare Company
5%
Media Company
4%
Educational Organization
4%
Insurance Company
3%
Energy/Utilities Company
3%
Retailer
3%
Government
3%
Performing Arts
3%
Marketing Services Firm
3%
Transportation Company
2%
Aerospace/Defense Firm
2%
Real Estate/Law Firm
1%
Hospitality Company
1%
Legal Firm
1%
Non Profit
1%
Consumer Goods Company
1%
Pharma/Biotech Company
1%
Recreational Facilities/Services Company
1%
Wholesaler/Distributor
1%
Local Government
1%

Compare Splunk SOAR with alternative products

Go!

Learn more about Splunk SOAR

Splunk SOAR offers robust playbook automation and powerful API connectivity, allowing organizations to streamline workflows and integrate extensively with tools like Salesforce and ServiceNow. With its capabilities in real-time data visualization and automated threat responses, it significantly enhances security and reduces manual efforts. Users appreciate the ease of creating playbooks, which reduces mean time to detect and resolve. However, attention to its integration challenges with Microsoft products, the need for more playbooks, and improved customization tools is necessary. Enhancements in the development process, visibility, scalability, and case management options are also beneficial. Improving documentation and training resources would add more depth and accessibility.

What are the top features of Splunk SOAR?
  • Third-party integrations: Supports extensive integration with tools like Salesforce and ServiceNow.
  • Playbook automation: Facilitates easy creation and management of automated workflows.
  • Customizable workflows: Offers Python-based customization for tailored security operations.
  • API connectivity: Powerful API support for seamless tool consolidation and streamlined workflows.
  • Data visualization: Provides real-time data visualization for enhanced situational awareness.
What benefits or ROI users should consider?
  • Operational efficiency: Reduces mean time to detect and resolve incidents through automation.
  • Manual effort reduction: Automates threat responses, minimizing manual workload in security operations.
  • Enhanced security: Offers end-to-end visibility and automated threat mitigation processes.
  • Time savings: Optimizes processes and improves response efficiency in cybersecurity operations.

Organizations implement Splunk SOAR in industries to automate tasks in Security Operation Centers, addressing incidents such as phishing, brute force, and ransomware. It integrates with third-party applications for threat intelligence enrichment, commonly deployed both on-premise and cloud, enhancing cybersecurity efforts.

Splunk SOAR was previously known as Phantom.

Splunk SOAR customers

Recorded Future, Blackstone

Related questions

  • 48
Which Do You Recommend, Phantom or Demisto?
  • 269
What are the Top 5 cybersecurity trends in 2022?
  • 210
What is the difference between SIEM and SOAR platforms?
  • 102
What is an incident response playbook and how is it used in SOAR?
  • 78
What are the latest trends in Security Operations Center (SOC)?
  • 182
What tools and solutions do you use for automated incident response in an enterprise in 2022?
  • 81
How to evaluate SIEM detection rules?
  • 72
Why a Security Operations Center (SOC) is important?
  • 106
What types of Security Operations Center (SOC) deployment models do exist?
  • 180
Why is Security Orchestration Automation and Response (SOAR) important for companies?

Product Categories

Product Categories
Security Orchestration Automation and Response (SOAR)

Popular Comparisons

Popular Comparisons
IBM Security QRadar vs Splunk SOAR Logo
IBM Security QRadar vs Splunk SOAR
Microsoft Sentinel vs Splunk SOAR Logo
Microsoft Sentinel vs Splunk SOAR
Elastic Security vs Splunk SOAR Logo
Elastic Security vs Splunk SOAR
AWS Security Hub vs Splunk SOAR Logo
AWS Security Hub vs Splunk SOAR
Palo Alto Networks Cortex XSOAR vs Splunk SOAR Logo
Palo Alto Networks Cortex XSOAR vs Splunk SOAR
Torq vs Splunk SOAR Logo
Torq vs Splunk SOAR
Exabeam vs Splunk SOAR Logo
Exabeam vs Splunk SOAR
Stellar Cyber Open XDR vs Splunk SOAR Logo
Stellar Cyber Open XDR vs Splunk SOAR
Sumo Logic Security vs Splunk SOAR Logo
Sumo Logic Security vs Splunk SOAR
Logpoint vs Splunk SOAR Logo
Logpoint vs Splunk SOAR
Tines vs Splunk SOAR Logo
Tines vs Splunk SOAR
Google Security Operations vs Splunk SOAR Logo
Google Security Operations vs Splunk SOAR
ThreatConnect Threat Intelligence Platform (TIP) vs Splunk SOAR Logo
ThreatConnect Threat Intelligence Platform (TIP) vs Splunk SOAR
ServiceNow Security Operations vs Splunk SOAR Logo
ServiceNow Security Operations vs Splunk SOAR
Fortinet FortiSOAR vs Splunk SOAR Logo
Fortinet FortiSOAR vs Splunk SOAR
See all alternatives
 
Splunk SOAR Reviews Summary
Author infoRatingReview Summary
Manager cybersecurity at Hexion Inc.3.5Splunk SOAR significantly improved our incident response, automating resolutions and consolidating data to cut MTTD/MTTR, saving 300+ hours monthly. I value its improved investigation quality, but desire better threat intelligence integration.
Advance Data Engineer(Cyber Security) at Novo Nordisk3.5I use Splunk SOAR for SOC orchestration, automating tasks like notifications and saving 30-40% time. It's stable and scalable, yet needs more code customization, AI integration, faster app integration, and better customer support.
Identity and Access Management Specialist at a university with 10,001+ employees4.0I rely on Splunk SOAR for ITDR automation, drastically reducing manual security tasks by 95% and efficiently handling incidents like MFA attacks. Its visual editor and orchestration are valuable, though CI/CD for playbooks needs improvement.
Cyber Security Network Security Engineer at Cirrus Logic4.5I value Splunk SOAR for automating security response like phishing, praising its seamless deployment, integrations, and real-time capabilities that deliver strong ROI. While reliable, I'd appreciate better on-prem integration and more accessible official support beyond community resources.
Senior Information Technology Security Consultant at Mideast Data Systems4.0I use Splunk SOAR for security automation, valuing its Python flexibility and immediate alerts for reducing manual work. While stable, it's costly at scale, has a complex UI, and requires learning. I prefer alternatives like Torq for ease of use.
System Engineer - Security Presales at Raya Integration3.5I find Splunk SOAR's easy playbook creation drastically cuts my MTTR/MTTD by 70%. However, I face integration problems, increased event volume, and an unclear playbook viewer. It needs more out-of-the-box integrations, AI, and threat intelligence, despite its seamless setup and good support.
Global Head Of Security Architecture Digital & Technology at Aramex4.5I value Splunk SOAR for automating security tasks, like phishing response and malware detection, significantly saving time and boosting resilience. It's stable with good support, though I suggest more advanced LLM integration and alert cost optimization.
Soc Anaylst at Softcell Technologies Limited5.0I find Splunk SOAR excellent for automating security tasks, significantly reducing incident response times by up to 90%, and improving centralized visibility. Its playbooks are effective, though enhancements are needed in real-time monitoring and dashboards. Overall, it's a strong, enterprise-grade solution for my environment.