Splunk SOAR vs Stellar Cyber Open XDR comparison

Splunk and Stellar Cyber are both solutions in the Security Orchestration Automation and Response (SOAR) category. Splunk is ranked #1 with an average rating of 8.3, while Stellar Cyber is ranked #24. Splunk holds a 7.1% mindshare in SOAR, compared to Stellar Cyber’s 1.9% mindshare. Additionally, 90% of Splunk users are willing to recommend the solution.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Splunk SOAR and Stellar Cyber Open XDR based on real PeerSpot user reviews.

Find out in this report how the two Security Orchestration Automation and Response (SOAR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Splunk SOAR vs. Stellar Cyber Open XDR Report (Updated: June 2026).

Buyer's Guide

Splunk SOAR vs. Stellar Cyber Open XDR

June 2026

Download the complete report

Helped 909,099 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Torq

Mindshare comparison

As of August 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 3.6%, down from 5.7% compared to the previous year. The mindshare of Splunk SOAR is 7.1%, down from 7.9% compared to the previous year. The mindshare of Stellar Cyber Open XDR is 1.9%, up from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Mindshare Distribution
Product	Mindshare (%)
Splunk SOAR	7.1%
Torq	3.6%
Stellar Cyber Open XDR	1.9%
Other	87.4%

Security Orchestration Automation and Response (SOAR)

Featured Reviews

AdityaDesai

Solutions Architect at ProArch

Automation has streamlined multi-tenant SOC workflows and improves alert handling efficiency

Although the reporting within Torq is not that great, we did ask for many features regarding reporting in Torq, but due to some platform constraints, they could not make the whole dataset available for us to be used in reporting. Except for that, we used some basic reporting. When I used Torq, it was indeed in the early stages of AI capabilities. Only a few customers were allowed to use it, and we were among them. It functioned well as long as we summarized the data properly. If you input garbage, you would get garbage out. Thus, we had to do significant fine-tuning regarding what data context we provided to the AI orchestrator to get meaningful results. In terms of Torq's unified platform approach to AI SOC automation and case management compared to managing multiple point solutions across my security stack, I find it case-centric. The unified view in case management is good since it provides clarity, although there are limitations regarding how many items in case management can be modified at once. Bulk operations are very limited, potentially due to their back-end database or data retrieval processes that can be improved. Regarding improvements for Torq, when we were onboarded, there were aspects we were uncertain about, such as the number of cases that could be generated, what data we could bring in, how many clients we could onboard, and similar concerns. Initially, we also lacked clarity about the number of playbooks or workflows we could build. Different triggers like system triggers, case-based triggers, and others can be employed without restrictions, but when it comes to on-demand and scheduled jobs, there is a limitation based on the subscription and pricing tier that notably caps the number of workflows we can create. No bulk editing across cases was one issue, along with limited filtering related to single grouping constraints. Additionally, the out-of-the-box case templates provided require substantial modifications before they become usable. There is also a feature in the cases for notes that cannot be searched. They are only visible through the UI, which is another area for improvement. The workflow and execution-based charges seem misleading as this was not discussed initially. I am not sure if new customers are made aware of this. It seems that workflows revolving around cases hinder functionality outside of case management, as we have many use cases needing on-demand triggers and schedules for functions like reporting or polling devices. Creating additional workflows to achieve basic functionalities raises costs significantly, which disadvantages customers. While they facilitate optimization and scaling, the support received tends to be very basic. Improvements can be made in that area as well.

Read full review

Vikash Kushwaha

Full Stack Software Engineer at mindpathtech

Automated playbooks have transformed incident response and now protect critical services

The biggest advantage I see from my personal experience as an integrator with Splunk SOAR is that it integrates with most of the security features among the Defenders, Microsoft Defender, firewalls, CloudWatch, and AWS security agents, as well as EC2 machines, firewalls, EDR, IAM, email security, and antivirus. It automates the security process over phishing emails and any other brute force attacks. It helps quite a lot because if 100 phishing emails were sent to a domain, a developer can only reach one, two, or five, but for hundreds of others, it actually supports better automated playbooks and provides major security. Splunk SOAR introduced some new and innovative capabilities or approaches that transformed the way my SOC operates. Splunk SOAR provides playbooks for automatic security features, such as for firewalls, phishing mails, and utilizing Defenders or virtual tools. A playbook maintains its algorithms or processes, so if any kind of security issue arises, the playbook automatically runs and handles actions such as IP blocking or resolving brute force attacks, notifying the admin about suspicious users. After implementing Splunk SOAR, the training process for my SOC team to use playbooks takes a long time during the whole integration part, as it retrieves all credentials from us, whether for an EC2 machine or any antivirus. It takes about one to two months for the team to fully sustain and know the processes of the playbooks and security, particularly for three or four individuals in the cyber security or DevOps team. Splunk SOAR significantly reduces the time spent on monotonous security tasks. In banking, insurance, or healthcare, automated services for addressing phishing emails and security threats are common. Having a manual workforce of two or three individuals can only handle five or ten security threats while Splunk SOAR automates the entire process across apps and machines, making it easier and notifying the admin about the threats. If someone tries to breach, Splunk SOAR immediately processes incoming requests, validating them and blocking any unsecured requests, which reduces a lot of time and effort. With the help of the playbook viewer, I assess the visibility provided by Splunk SOAR as very positive, especially for security purposes. If someone is attacked by 100 users, it blocks all the users, while individual developers such as myself can only handle two or three at a time. The automated process of Splunk SOAR handles all the processes concurrently, making it a game-changing solution. It helps reduce mean time to resolve (MTTR). It takes around 10 to 20 minutes to resolve one incident through the whole process and notify the admin of the issue. If there are multiple incidents, calculating the time taken for each, it generally requires around 40 to 50 minutes to resolve five incidents.

Read full review

Hrishiraj Bhattacharjee

Founder & CEO at Team Karimganj

Correlates incidents, allows for quicker identification and helps prioritize investigations

The only challenge is, and that’s where we come into play, it’s a pretty high-tech platform. So, it’s difficult for small and medium-sized organizations to manage it on their own. It’s a very complex system. It requires a lot of expertise. All my guys who work on it have gone through certification from Stellar itself. There are three different certifications that you need to complete. Only then are you certified by Stellar to work on it. It’s a very complex platform. Not everyone can use it. A simple IT engineer or system admin won’t be able to handle it because it’s quite complex. You need to have an understanding of the industry, the subject, and the tool. So, just purchasing this tool or license and then using it on your own would be very difficult to configure and manage on a day-to-day basis. The pricing model is not suitable for small and medium companies, particularly small companies. The minimum pricing model they have is suitable for companies with more than one thousand users. So, if someone has 50 to 100 users, like typical small companies, it’s difficult for them because the cost involved is high. Stellar would charge you for those thousand users, but you do not need all those users. So what are they going to do? I guess Stellar does not want to target small companies directly and maybe relies on resellers and MSPs like us to sell it. So, that is something I would recommend changing. Otherwise, it’s a great tool, but because of the pricing model, small companies are unable to leverage the advantage of this beautiful tool. So, the pricing model should be suitable for small and medium businesses. The product currently has vulnerability monitoring and everything. But if they could also do something about vulnerability management and maybe patch management, that would be nice.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We have seen fewer failures of automations from the time Torq came into the picture, we've had a more streamlined process of handling incidents, and at the same time, we've learned to embed the AI into our incident types, and that is how it has helped us in the automation."

"Once I started to use the system and I saw the potential, it changed all of our work in IT."

"Any request that comes in, regardless of how complex it is, I can accomplish it with Torq."

"Almost four or five hours of work is now completed in four or five minutes."

"Torq has helped a lot regarding SOC analyst efficiency."

"Torq offers the best feature through integration with AI."

"With Torq, I automate actions while achieving SLA compliance and streamline alert investigation processes much better."

"If I review about 100 vendors that I might work with, Torq is definitely in the top five that gave me personally investment back, just because every bit of effort I put into Torq eventually became a workflow that gave it back to me."

More Torq pros

"The most valuable feature of the solution is the playbook automation just because it allows us to reduce the manual actions that SOC has to handle."

"My understanding is the initial setup isn't too hard."

"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."

"So far, the interface is very easy to use."

"Its ability to integrate with other systems and applications in our environment is pretty easy. Sometimes if we see any complexity we try to involve a consultant to help us. Everything is through the built-in app. Splunk can connect to any assets through the built-in app. It could be in a platform, firewalls, or endpoints. It's easy if it's an app integration."

"I'm just a beginner on the solution and it's pretty easy for me to use."

"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."

"Scalability is the best feature of the solution."

More Splunk SOAR pros

"Stellar Cyber Open XDR offers these functionalities at a more affordable price, making it easier for me to position it with price-sensitive customers."

"It can integrate with almost any cybersecurity tool available in the market."

Cons

"Torq does extensive marketing saying that SOAR is dead and markets itself as an all-in-one solution, but this is not actually true."

"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."

"However, we did encounter some problems with custom steps, which definitely affected our progress, and the speed of bug fixes is also a bit slower than expected."

"Torq can probably use more ML and look at what can be closed and what cannot be closed in terms of data classification."

"The workflow and execution-based charges seem misleading as this was not discussed initially, and creating additional workflows to achieve basic functionalities raises costs significantly, which disadvantages customers."

"Additionally, the documentation for Torq is not very clear. Most of the information is presented in videos, which are not ideal for reading; there are mostly paragraphs and other text-based content."

"If Torq could enhance its AI features, it would benefit customers significantly by making the platform even more user-friendly."

"The initial deployment of Torq was not easy."

More Torq cons

"Splunk SOAR follows very flat pricing and most of the time it's very high when compared to the other competitors."

"While I appreciate Splunk SOAR, there are areas for improvement, notably regarding the CI/CD pipeline for playbook lifecycle management, as transitioning playbooks from development to production currently feels cumbersome and requires more manual effort than I would prefer."

"They should integrate Splunk Enterprise Security better into Splunk Cloud."

"The UI can be more customizable for the clients."

"Splunk's support for integration is subpar and has room for improvement."

"Creating playbooks using the solution’s playbook editor, for me, is very cumbersome. There have been instances where I have said to myself that I just don't want to use this editor. I might just use a code block and write my own code within it... The functionality in the playbook editor is 80 percent there, but that 20 percent is still lacking. They could make it more efficient."

"It would be nice if we could put it on other search heads, not just Enterprise Security."

"The number of playbooks on offer should be increased."

More Splunk SOAR cons

"I would rate the stability at about five to six. The platform requires some fine-tuning, especially when integrating data sources and creating connectors."

"Support is an issue because they have a limited number of resources."

Pricing and Cost Advice

Information not available

"Splunk SOAR is moderately priced, neither cheap nor overly expensive."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"I don't know the exact price, but for my region, it is very expensive."

"Splunk SOAR is an expensive solution for an organization of our size."

"The licensing cost is reasonable."

More Splunk SOAR pricing and cost advice

"It’s a single license platform."

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

909,099 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Construction Company

10%

Outsourcing Company

10%

Comms Service Provider

Financial Services Firm

12%

Manufacturing Company

Construction Company

Outsourcing Company

Manufacturing Company

13%

Comms Service Provider

Computer Software Company

Outsourcing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	5
Large Enterprise	10

By reviewers
Company Size	Count
Small Business	18
Midsize Enterprise	10
Large Enterprise	45

No data available

Questions from the Community

What needs improvement with Torq?

The only thing is more out-of-the-box integrations. Torq already has a lot of supported integrations and adding new o...

See all answers

What is your primary use case for Torq?

For Torq, first of all, it's a hyperautomation and AI assistant usage. Our EDR SentinelOne is integrated in Torq and ...

See all answers

What advice do you have for others considering Torq?

I think I have told everything about Torq that I can share at this stage, but I am still in the process of learning t...

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

For pricing, I would rate Splunk SOAR a seven where one is high price and ten is low price.

See all answers

What needs improvement with Splunk Phantom?

When it comes to Splunk SOAR, in terms of improvement, I feel there should be some pre-deployed solutions available. ...

See all answers

What is your primary use case for Splunk Phantom?

I started working with Splunk SOAR four years ago. I provide Splunk SOAR solutions to our customers as an MSSP. We wo...

See all answers

What is your experience regarding pricing and costs for Stellar Cyber Open XDR?

Pricing is a major benefit of Stellar Cyber Open XDR. I rate it between three and four on the cost scale. It offers f...

See all answers

What needs improvement with Stellar Cyber Open XDR?

I am currently evaluating Stellar Cyber Open XDR in terms of their support. I do not see any major areas for improvem...

See all answers

What is your primary use case for Stellar Cyber Open XDR?

I use Stellar Cyber Open XDR ( /products/stellar-cyber-open-xdr-reviews ) as a 24/7 security monitoring tool, especia...

See all answers

Comparisons

Tines vs Torq

Compared 25% of the time

Blink Ops vs Torq

Compared 13% of the time

Palo Alto Networks Cortex XSOAR vs Torq

Compared 10% of the time

Swimlane vs Torq

Compared 7% of the time

Dropzone AI vs Torq

Compared 7% of the time

More Torq Competitors

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 11% of the time

Tines vs Splunk SOAR

Compared 8% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 8% of the time

Google Security Operations vs Splunk SOAR

Compared 7% of the time

ServiceNow Security Operations vs Splunk SOAR

Compared 7% of the time

More Splunk SOAR Competitors

Wazuh vs Stellar Cyber Open XDR

Compared 7% of the time

SentinelOne Singularity Endpoint vs Stellar Cyber Open XDR

Compared 6% of the time

Microsoft Sentinel vs Stellar Cyber Open XDR

Compared 5% of the time

Lumu vs Stellar Cyber Open XDR

Compared 4% of the time

CrowdStrike Falcon vs Stellar Cyber Open XDR

Compared 4% of the time

More Stellar Cyber Open XDR Competitors

Product Reports

Buyer's Guide

Torq

July 2026

Download Torq product report

Buyer's Guide

Splunk SOAR

July 2026

Download Splunk SOAR product report

Buyer's Guide

Extended Detection and Response (XDR)

July 2026

Download Stellar Cyber Open XDR product report

Also Known As

No data available

Phantom

No data available

Overview

Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation to handle critical threats efficiently. It manages threat lifecycles, swiftly moving from triage to response, ensuring effective risk management.

Torq is designed to streamline security operations by aggregating telemetry across your security stack. It investigates significant risks and manages threats from triage to containment and remediation. This AI-driven tool enhances the capabilities of your SecOps team, allowing them to achieve more impactful results without introducing complicated processes.

What are the key features of Torq?

Adaptive Agentic Insights: Provides real-time threat intelligence tailored to specific security challenges.
Automation: Automates responses to security incidents, minimizing manual intervention requirements.
Threat Lifecycle Management: Comprehensive handling of threats from detection to remediation.
Telemetry Aggregation: Integrates data across platforms for a unified security overview.

Why consider Torq based on reviews?

Efficiency: Users notice significant reductions in time spent managing threats.
Risk Reduction: Enhanced ability to identify and address critical threats promptly.
Resource Optimization: Allows teams to allocate effort to other critical tasks by reducing manual security operations.
Scalability: Adaptable to meet the demands of growing or changing infrastructures.

In industries like finance and healthcare, Torq shows effectiveness by adapting to specific risk scenarios often encountered in these fields. Its integration with existing infrastructures makes it a valuable asset for maintaining stringent security standards, essential for protecting critical data and operations in diverse high-stakes environments.

Torq

Splunk SOAR focuses on automating security operations with seamless third-party integrations and customizable workflows, enhancing incident response and threat management.

Splunk SOAR offers robust playbook automation and powerful API connectivity, allowing organizations to streamline workflows and integrate extensively with tools like Salesforce and ServiceNow. With its capabilities in real-time data visualization and automated threat responses, it significantly enhances security and reduces manual efforts. Users appreciate the ease of creating playbooks, which reduces mean time to detect and resolve. However, attention to its integration challenges with Microsoft products, the need for more playbooks, and improved customization tools is necessary. Enhancements in the development process, visibility, scalability, and case management options are also beneficial. Improving documentation and training resources would add more depth and accessibility.

What are the top features of Splunk SOAR?

Third-party integrations: Supports extensive integration with tools like Salesforce and ServiceNow.
Playbook automation: Facilitates easy creation and management of automated workflows.
Customizable workflows: Offers Python-based customization for tailored security operations.
API connectivity: Powerful API support for seamless tool consolidation and streamlined workflows.
Data visualization: Provides real-time data visualization for enhanced situational awareness.

What benefits or ROI users should consider?

Operational efficiency: Reduces mean time to detect and resolve incidents through automation.
Manual effort reduction: Automates threat responses, minimizing manual workload in security operations.
Enhanced security: Offers end-to-end visibility and automated threat mitigation processes.
Time savings: Optimizes processes and improves response efficiency in cybersecurity operations.

Organizations implement Splunk SOAR in industries to automate tasks in Security Operation Centers, addressing incidents such as phishing, brute force, and ransomware. It integrates with third-party applications for threat intelligence enrichment, commonly deployed both on-premise and cloud, enhancing cybersecurity efforts.

Splunk

Stellar Cyber Open XDR delivers an advanced, unified security solution designed for real-time threat detection and intelligent response, reducing complexity by integrating multiple tools into a single interface.

Stellar Cyber Open XDR aggregates security data from many sources to provide comprehensive threat detection and response capabilities. It offers a streamlined, user-friendly experience, allowing teams to efficiently manage incidents. By automating routine security tasks, it enhances operational efficiency and increases visibility across the entire network infrastructure.

What are the key features of Stellar Cyber Open XDR?

Open Integration: Connects with existing security tools for seamless data aggregation and correlation.
AI-Powered Analytics: Uses artificial intelligence to predict, detect, and respond to threats with high accuracy.
Automated Incident Response: Accelerates the fighting-back process through intelligent automation.
Comprehensive Dashboards: Offers clear visibility into security metrics through customizable dashboards.

What benefits or ROI should users expect?

Improved Threat Detection: Recognizes threats faster, allowing quick response to reduce potential damage.
Increased Efficiency: Reduces manual work by automating repetitive tasks, saving time for IT teams.
Cost Reduction: Consolidates security tools, decreasing overall expenditure on multiple solutions.
Enhanced Collaboration: Allows diverse security teams to work together more effectively with shared insights.

Stellar Cyber Open XDR is implemented across various industries, including finance, healthcare, and retail, offering tailored security strategies suited to industry-specific challenges. Organizations can take advantage of this integrated approach to align security operations with industry regulations efficiently.

Stellar Cyber

Sample Customers

Information Not Available

Recorded Future, Blackstone

Sumitomo Chemical USA, PlastiPak Packaging, University of Denver, Large California State Agency, Large Midwestern American City

Buyer's Guide

Splunk SOAR vs. Stellar Cyber Open XDR

June 2026

Free Report: Splunk SOAR vs. Stellar Cyber Open XDR

Find out what your peers are saying about Splunk SOAR vs. Stellar Cyber Open XDR and other solutions. Updated: June 2026.

DOWNLOAD NOW

909,099 professionals have used our research since 2012.

See our Splunk SOAR vs. Stellar Cyber Open XDR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.