No more typing reviews! Try our Samantha, our new voice AI agent.

Splunk SOAR vs Stellar Cyber Open XDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Torq
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
4th
Average Rating
8.6
Reviews Sentiment
6.4
Number of Reviews
8
Ranking in other categories
AI-SOC (2nd), AI-Powered Security Automation (2nd)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
2nd
Average Rating
8.2
Reviews Sentiment
6.6
Number of Reviews
58
Ranking in other categories
No ranking in other categories
Stellar Cyber Open XDR
Ranking in Security Orchestration Automation and Response (SOAR)
24th
Average Rating
0.0
Reviews Sentiment
7.0
Number of Reviews
2
Ranking in other categories
Security Information and Event Management (SIEM) (47th), User Entity Behavior Analytics (UEBA) (27th), Endpoint Detection and Response (EDR) (56th), Network Traffic Analysis (NTA) (16th), Network Detection and Response (NDR) (20th), Extended Detection and Response (XDR) (38th), Identity Threat Detection and Response (ITDR) (17th)
 

Mindshare comparison

As of May 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 3.7%, down from 5.4% compared to the previous year. The mindshare of Splunk SOAR is 7.4%, up from 7.3% compared to the previous year. The mindshare of Stellar Cyber Open XDR is 1.9%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Mindshare Distribution
ProductMindshare (%)
Splunk SOAR7.4%
Torq3.7%
Stellar Cyber Open XDR1.9%
Other87.0%
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Nimrod Vardi - PeerSpot reviewer
Global IT Director at OpenWeb
Automation workflows have transformed our IT, enabling secure just-in-time access control
We work with them quite often, so we have a direct line regarding areas in Torq that have room for improvement. If we have a feature request, we can request it. I do not have anything in mind at the moment. We were a design partner for a short while, so we feel that they listen and that users of the system have an impact on the way the system is designed for the better. They have a new community, which is something that I personally suggested years ago. There are many people like me in different places and they might have already built the workflow that I need. Having the option to share workflows or to jump on a thread and say I have this need, did anyone ever build a workflow for it, is amazing. Someone would jump in and say yes, sure, here, take this workflow. I think this is an amazing thing and I really hope that the community will come alive because I think this is really powerful. This is something that I already suggested and it did happen eventually, and I am quite happy with it. I do not have any specific feature in mind that I have a need for at the moment.
SS
Manager cybersecurity at Hexion Inc.
Automates threat response and reduces investigation time but needs better threat intelligence integration
One thing that we would like to see with Splunk SOAR is the expandability to the threat intelligence feed. Currently, we have limited ingestion to the threat intelligence feed for the correlation purpose. We would like to see it being integrated, with license cost or without license cost, to leading threat intelligence sources such as Recorded Future, Feedly, or Flare. That is something we would appreciate having integrated. The second thing on the improvement side is about exposed credential-related information. If we start ingesting those data to Splunk SOAR or SIEM with some sort of integration with threat intelligence feed, that will also improve our detection and prediction method or help us with the investigation.
Hrishiraj Bhattacharjee - PeerSpot reviewer
Founder & CEO at Team Karimganj
Correlates incidents, allows for quicker identification and helps prioritize investigations
The only challenge is, and that’s where we come into play, it’s a pretty high-tech platform. So, it’s difficult for small and medium-sized organizations to manage it on their own. It’s a very complex system. It requires a lot of expertise. All my guys who work on it have gone through certification from Stellar itself. There are three different certifications that you need to complete. Only then are you certified by Stellar to work on it. It’s a very complex platform. Not everyone can use it. A simple IT engineer or system admin won’t be able to handle it because it’s quite complex. You need to have an understanding of the industry, the subject, and the tool. So, just purchasing this tool or license and then using it on your own would be very difficult to configure and manage on a day-to-day basis. The pricing model is not suitable for small and medium companies, particularly small companies. The minimum pricing model they have is suitable for companies with more than one thousand users. So, if someone has 50 to 100 users, like typical small companies, it’s difficult for them because the cost involved is high. Stellar would charge you for those thousand users, but you do not need all those users. So what are they going to do? I guess Stellar does not want to target small companies directly and maybe relies on resellers and MSPs like us to sell it. So, that is something I would recommend changing. Otherwise, it’s a great tool, but because of the pricing model, small companies are unable to leverage the advantage of this beautiful tool. So, the pricing model should be suitable for small and medium businesses. The product currently has vulnerability monitoring and everything. But if they could also do something about vulnerability management and maybe patch management, that would be nice.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What I appreciate most about Torq is that it is an essential part of our system."
"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."
"Once I started to use the system and I saw the potential, it changed all of our work in IT."
"Torq's unified platform approach to AI, SOAR, automation, and case management is superior compared to my experience managing multiple point solutions."
"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."
"Since we started working with Torq, I am handling much fewer alerts, it is becoming really easy for me to handle an alert, I have all the information that I need, I do not need to connect to different vendors to receive this information, and the main thing I got from Torq is time, which now helps me to build another automated system and learn."
"If I review about 100 vendors that I might work with, Torq is definitely in the top five that gave me personally investment back, just because every bit of effort I put into Torq eventually became a workflow that gave it back to me."
"Any request that comes in, regardless of how complex it is, I can accomplish it with Torq."
"Fortunately, the system helps to parse through these alerts and determine which ones are important and need further investigation."
"Splunk integrates with so many products. It provides us with good information for us to be able to do our jobs."
"I have found all the security automation platform features of Splunk SOAR to be good. The Automation playbook development is highly useful."
"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."
"It has definitely saved a decent amount of time for our analysts so they can focus on other tasks."
"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."
"The most valuable features are the Splunk SOAR apps and playbooks."
"I'm just a beginner on the solution and it's pretty easy for me to use."
"Stellar Cyber Open XDR offers these functionalities at a more affordable price, making it easier for me to position it with price-sensitive customers."
"It can integrate with almost any cybersecurity tool available in the market."
 

Cons

"Even now, we have workflows that are in production that use AI steps and I get different results, making it unusable to some degree."
"We have MCP that we are working with our cloud security platform, and we wanted to connect this MCP to the case management."
"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."
"The initial deployment of Torq was not easy."
"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."
"Additionally, the documentation for Torq is not very clear. Most of the information is presented in videos, which are not ideal for reading; there are mostly paragraphs and other text-based content."
"The initial deployment of Torq was not easy."
"Regarding the pricing of Torq, I would say it is expensive."
"Splunk SOAR has room to improve its offering for small-sized customers. The price is not fair for smaller-sized customers."
"We've run into a few minor issues. Some of the playbook writing is a bit complicated. We've had a few hiccups with the source control. We'd really like to use GitHub deployment keys for a dedicated account. We haven't been able to do that. I think those are some of the major ones."
"Creating playbooks using the solution’s playbook editor, for me, is very cumbersome. There have been instances where I have said to myself that I just don't want to use this editor. I might just use a code block and write my own code within it... The functionality in the playbook editor is 80 percent there, but that 20 percent is still lacking. They could make it more efficient."
"I would rate Splunk Phantom a seven out of 10."
"While support is available, the resources around Splunk SOAR are more homegrown by other users, and discovering different troubleshooting methods is harder to do with Splunk SOAR than with Enterprise Security or other Splunk services."
"And most of the challenges that I have faced with the solution can be found in the documentation itself."
"I haven't used it fully, but based on my usage, I could not find simulation tools and features. It currently lacks simulation features, which are important for me for creating a playbook. It is also very expensive for my region."
"I haven't had any issues with the solution so far."
"Support is an issue because they have a limited number of resources."
"I would rate the stability at about five to six. The platform requires some fine-tuning, especially when integrating data sources and creating connectors."
 

Pricing and Cost Advice

Information not available
"The licensing cost is reasonable."
"I don't know the exact price, but for my region, it is very expensive."
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"Splunk SOAR is an expensive solution for an organization of our size."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"The tool is not cheap."
"Splunk SOAR is more expensive compared to other options for SOAR."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."
"It’s a single license platform."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
893,311 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Comms Service Provider
10%
Construction Company
10%
Manufacturing Company
9%
Financial Services Firm
12%
Manufacturing Company
10%
Computer Software Company
7%
University
6%
Manufacturing Company
13%
Comms Service Provider
10%
Computer Software Company
9%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business1
Midsize Enterprise3
Large Enterprise4
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise7
Large Enterprise38
No data available
 

Questions from the Community

What needs improvement with Torq?
This is exactly what we discussed two days ago with the Torq team. We told them where we want to see improvements. Fo...
What is your primary use case for Torq?
I use Torq as my case management and alert system. Working as a SOC analyst, the first thing I do every morning is ge...
What advice do you have for others considering Torq?
I would definitely recommend Torq. I have no doubt, really. When we looked for another vendor, Torq really answered a...
What is your experience regarding pricing and costs for Splunk Phantom?
My experience with pricing, setup cost, and licensing is that it is perfectly acceptable, helping us significantly wi...
What needs improvement with Splunk Phantom?
From the improvement point of view regarding Splunk SOAR, I suggest including more types of LLM models such as autono...
What is your primary use case for Splunk Phantom?
The use cases that I work with mostly in Splunk SOAR include phishing email responses automation, where Splunk detect...
What is your experience regarding pricing and costs for Stellar Cyber Open XDR?
Pricing is a major benefit of Stellar Cyber Open XDR. I rate it between three and four on the cost scale. It offers f...
What needs improvement with Stellar Cyber Open XDR?
I am currently evaluating Stellar Cyber Open XDR in terms of their support. I do not see any major areas for improvem...
What is your primary use case for Stellar Cyber Open XDR?
I use Stellar Cyber Open XDR ( /products/stellar-cyber-open-xdr-reviews ) as a 24/7 security monitoring tool, especia...
 

Also Known As

No data available
Phantom
No data available
 

Overview

 

Sample Customers

Information Not Available
Recorded Future, Blackstone
Sumitomo Chemical USA, PlastiPak Packaging, University of Denver, Large California State Agency, Large Midwestern American City
Find out what your peers are saying about Splunk SOAR vs. Stellar Cyber Open XDR and other solutions. Updated: April 2026.
893,311 professionals have used our research since 2012.