Try our new research platform with insights from 80,000+ expert users

Secureworks Red Cloak Threat Detection and Response [EOL] vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Secureworks Red Cloak Threa...
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
Splunk SOAR
Average Rating
8.2
Reviews Sentiment
6.6
Number of Reviews
50
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (3rd)
 

Featured Reviews

reviewer1646754 - PeerSpot reviewer
Simple deployment with good reports and dashboard
In terms of what could be improved, there are a lot of things identified and there is a lot of continuous improvement. A lot of the things are of a short time frame and a lot are way out. There was a tuning process but nothing specifically to call out. As for what could be included in the next release, we are working on the basic feature set. There are probably some things that, as we move through it, we'll come across that are deficient but right now we are not that far along to know. I don't want to say that they could not do certain advancement. For example, there are some automated network response portions that we want to turn up, but we're not ready for that. I don't even know what the capabilities are there, but that's something that, probably in the next 24 months, we will move forward on.
Hamada Elewa - PeerSpot reviewer
Creating automation workflows has reduced detection time but integration and visibility challenges remain
The visibility of Splunk SOAR's playbook viewer is rather unclear to me; I wonder what the visibility is for. There are indeed some problems with integrating Splunk SOAR with other Splunk products or other vendors in my system, and it took a while after implementing Splunk SOAR to train my SOC team on how to use the playbooks. Splunk SOAR does not help me reduce my security event volume; in fact, it makes them massive. Splunk SOAR does not help me free up resources to work on other projects; they are not good in this regard. I have not seen time to value with Splunk SOAR; I am curious about what time to value means. I believe Splunk SOAR can be improved by adding more integrations and out-of-the-box integrations, and by increasing the number of admins that can access the solution simultaneously. I see the need to inject more AI in creating the playbooks. I think they can inject more threat intelligence into the solution.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The features that I have found most valuable are that the search capabilities are easy to use. The dashboards are good. The reports are good. It is just simple from a deployment standpoint - that was easy."
"Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack."
"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."
"Very flexible integration with other tools"
"The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools."
"The most valuable feature of Splunk SOAR that stands out is it has a great SOAR. The automation and orchestration module is highly mature. A lot of use cases are on user entity and behavioral analytics (UEBA), which is artificial intelligence and machine learning-based (AIML)."
"In Splunk SOAR, I find the playbooks valuable. We get to create multiple playbooks, and within each playbook, there is a different type of investigation attached to it, which helps out an analyst or new analysts coming on board."
"The most valuable feature of Splunk SOAR is the automated playbooks, which saves analysts time."
"The customizable playbook is the most valuable aspect of the solution."
 

Cons

"There are some automated network response portions that we want to turn up."
"We've had trouble implementing the solution with Microsoft products. There seems to be an integration gap."
"In my opinion, the focus should be on improving its simplicity, specifically the interface, and configuration."
"The tool's response is slower because it has to search through a huge dataset, which can be improved for latency."
"They should integrate Splunk Enterprise Security better into Splunk Cloud."
"It would be nice if we could put it on other search heads, not just Enterprise Security."
"Splunk's support for integration is subpar and has room for improvement."
"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."
"There is a lot of room for improvement with the UI."
 

Pricing and Cost Advice

Information not available
"The licensing cost is reasonable."
"I found the price of Splunk SOAR to be good."
"The tool is not cheap."
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"I don't know the exact price, but for my region, it is very expensive."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."
report
Use our free recommendation engine to learn which Security Incident Response solutions are best for your needs.
872,922 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
No data available
Financial Services Firm
12%
Computer Software Company
11%
Manufacturing Company
9%
University
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise7
Large Enterprise30
 

Questions from the Community

Ask a question
Earn 20 points
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
I don't have experience with costs; management handles that aspect.
What needs improvement with Splunk Phantom?
I'm not an expert on Splunk SOAR, but I'm sure our team members know what areas could be improved. I haven't spoken to them specifically about what could be improved or what they would want Splunk ...
 

Comparisons

No data available
 

Also Known As

Red Cloak Threat Detection and Response, Red Cloak TDR
Phantom
 

Overview

 

Sample Customers

Ricoh
Recorded Future, Blackstone
Find out what your peers are saying about ServiceNow, Proofpoint, IBM and others in Security Incident Response. Updated: November 2025.
872,922 professionals have used our research since 2012.