Try our new research platform with insights from 80,000+ expert users

D3 Security vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

D3 Security
Ranking in Security Orchestration Automation and Response (SOAR)
17th
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Security Incident Response (8th), AI-Powered Security Automation (4th)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
45
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of D3 Security is 0.5%, up from 0.4% compared to the previous year. The mindshare of Splunk SOAR is 7.6%, down from 8.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Muhammad Aamir Riaz - PeerSpot reviewer
Offers open API for integrating any available tools without any recurring costs
Before committing, I recommend a Proof of Concept (POC) or demo first. This way, you can see if the product aligns with your specific use cases and security needs. Knowledge transfer is key, and D3 Security's team excels in this area. During the POC, your analysts gain valuable product knowledge, putting them ahead of the curve for deployment. In our case, the learning curve was steep initially, but by the end of the POC, my team was already building playbooks independently. D3 Security also schedules dedicated knowledge transfer sessions during the POC, making it a win-win for both parties. Since technology transfer is crucial for government entities like ours, this approach eliminates the need for additional learning after deployment, unlike with certain competitors like the Fortinet FortiSOAR case. While Fortinet FortiSOAR achieved the desired tasks, its knowledge transfer process was lacking, leaving us with a shaky foundation. D3 Security's approach solidifies the learning and empowers our team. Overall, I would rate the solution an eight out of ten.
SAURABHYADAV4 - PeerSpot reviewer
Enables optimization by reducing manual intervention and increasing automation in the workflow
The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection. Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product. I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours. Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system. The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%. I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system. It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare. After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes. Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution's valuable feature is its GUI. It has more than 450 connectors, which are excellent for connecting devices and automating integration. The solution has all the features we need. We deployed it in our environment, and it's fully integrated. Thanks to their open APIs, the seamless integration makes everything work well together."
"It is an out-of-the-box automated integration with our 20 departments. We perform L1 LiveOps automatically through the portal."
"My understanding is the initial setup isn't too hard."
"Our customers find it easy to conduct searches and consider it an excellent content management system."
"Workflow management is most valuable. It is easily customizable"
"Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack."
"The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools."
"Splunk has many features that make work easier, and it's simple to implement in a large production environment. Splunk collects a massive amount of data from cloud servers and handles it perfectly."
"The ability to automate Splunk SOAR and customize the playbook use cases is the most valuable feature and is very exciting for me."
"I like the integration capabilities of Phantom. It has a lot of integrations with other products. Its searching methodologies are also good. It is also easy to understand and easy to create playbooks."
 

Cons

"Reporting needs improvement. MTTR and MTTD metrics aren't directly available in playbooks and require manual effort to achieve."
"The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hosted on Linux."
"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."
"The scalability could be better."
"The Splunk SOAR platform was not designed specifically for case management which is why this area needs improvement."
"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."
"have put a number of ideas on the ideas.splunk.com site for feature requests for the Splunk SOAR product. I posted one of them about three years ago, which finally got implemented in the latest release that just got announced, so the time to implement new features and things like that is a little bit concerning."
"Splunk's support for integration is subpar and has room for improvement."
"We've had trouble implementing the solution with Microsoft products. There seems to be an integration gap."
"It could be easier to implement."
 

Pricing and Cost Advice

Information not available
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"Splunk SOAR is more expensive compared to other options for SOAR."
"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."
"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"The cost is high and the licensing is on an annual basis."
"The licensing cost is reasonable."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
861,390 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
26%
Comms Service Provider
13%
Financial Services Firm
11%
Outsourcing Company
7%
Computer Software Company
13%
Financial Services Firm
13%
Manufacturing Company
11%
University
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about D3 Security?
It is an out-of-the-box automated integration with our 20 departments. We perform L1 LiveOps automatically through the portal.
What is your experience regarding pricing and costs for D3 Security?
We follow a different procurement process. For example, Fortinet qualified technically but lost out in the financial stage due to a two-stage bidding process. So, pricing can be subjective and depe...
What needs improvement with D3 Security?
The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hosted on Linux.
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
Splunk SOAR is moderately priced, neither cheap nor overly expensive.
What needs improvement with Splunk Phantom?
There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced life...
 

Also Known As

No data available
Phantom
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

S&P Global, Scotiabank, Cybereason, Cummins
Recorded Future, Blackstone
Find out what your peers are saying about D3 Security vs. Splunk SOAR and other solutions. Updated: June 2025.
861,390 professionals have used our research since 2012.