Splunk SOAR Reviews

Name: Splunk SOAR
Brand: Splunk
Rating: 4.0 (54 reviews)

Vendor: Splunk

4.0 out of 5

54 reviews
88% willing to recommend

Leave a review

What is Splunk SOAR?

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Get the Splunk SOAR Buyer's Guide and find out what your peers are saying about Splunk SOAR, Microsoft Sentinel, IBM Security QRadar and more!

Splunk SOAR is the #2 ranked solution in SOAR tools. PeerSpot users give Splunk SOAR an average rating of 8.0 out of 10. Splunk SOAR is most commonly compared to Microsoft Sentinel: Splunk SOAR vs Microsoft Sentinel. Splunk SOAR is popular among the large enterprise segment, accounting for 57% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 11% of all views.

Helped 883,824 peers since 2012

Featured Splunk SOAR reviews

Shiboo Suren

Manager cybersecurity at Hexion Inc.

From my perspective, the best thing that I perceive with Splunk SOAR is where it is able to consolidate the data from the different log sources, and that helps me to investigate any incident. I am ingesting from multiple log sources. If there is an incident that has been logged, I will have visibility about all the different data that are required to investigate that incident in the single pane. In the single dashboard, I should be able to visualize it. I am able to see what has happened with this incident and what action has to be taken. Automatic recommendations also come from Splunk SOAR. These are the few things that we value very much on a day-to-day basis. Splunk SOAR has improved our MTTD and MTTR both with the consolidation with a unified platform with Splunk. Mean Time to Detect and Mean Time to Resolve were trending high before Splunk SOAR. Once we finalized and fine-tuned Splunk SOAR platform, it started trending within the limit that is defined for our organization. That's the first thing. The second thing that we have started observing is that there used to be a quality issue when it comes to investigating the incident. If an analyst investigated by looking at and correlating the data from the different sources, they always tended to make some mistake where they were overlooking some of the aspects for the incident investigation. We have improved this a lot. Since we have Splunk SOAR, where things are being automated and we are able to visualize things, we have zero or maybe no chance of missing things. That is helping us to improve the incident investigation quality. These are a few things that I will call out that has helped and that are helping on a day-to-day basis.

Read full review

Jabez Daniel

Advance Data Engineer(Cyber Security) at Novo Nordisk

The best features of Splunk SOAR include its multiple capabilities. For example, if there is a malicious IP, such as from a phishing mail, we can find out the sender IP and take action based on the verdict by using multiple app connectors in Splunk SOAR. It sends an API call to check the IP reputation and informs us if it's malicious and what actions we should take, either blocking the IP address from the perimeter firewall or storing it for future threat hunting. It connects with multiple apps such as ServiceNow and reduces the burden on the analyst by automating processes that don't require much investigation, allowing us to generate monthly reports on tasks performed by Splunk SOAR.

Read full review

Hamada Elewa

System Engineer - Security Presales at Raya Integration

I would assess Splunk SOAR's ability to integrate with other systems and applications as very relevant in my environment. I view Splunk as a platform; I can definitely consider Splunk as a platform. It is not only a SIEM or a SOAR; it is a complete platform. They are increasing the modules integrated with it, so I can give them a rating between 80 to 90%. My experience with the pricing of Splunk has been that in the past, they were very expensive, but now they can compete with even FortiSOAR or FortiSIEM. The difference in pricing is very good right now. I would usually recommend Splunk SOAR for customers who do not have the knowledge or the maturity level required for acquiring a native SOAR. If companies are new to SOAR technology, they can use Splunk SOAR, but if they are at a very good maturity level, they can use something such as Palo Alto. I would rate this review at 7 out of 10.

Read full review

Splunk SOAR mindshare

As of March 2026, the mindshare of Splunk SOAR in the Security Orchestration Automation and Response (SOAR) category stands at 8.0%, up from 7.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Mindshare Distribution
Product	Mindshare (%)
Splunk SOAR	8.0%
Microsoft Sentinel	12.2%
Palo Alto Networks Cortex XSOAR	8.8%
Other	71.0%

Security Orchestration Automation and Response (SOAR)

PeerResearch reports based on Splunk SOAR reviews

Type	Title	Date
Category	Security Orchestration Automation and Response (SOAR)	Mar 10, 2026	Download
Product	Reviews, tips, and advice from real users	Mar 10, 2026	Download
Comparison	Splunk SOAR vs Microsoft Sentinel	Mar 10, 2026	Download
Comparison	Splunk SOAR vs Palo Alto Networks Cortex XSOAR	Mar 10, 2026	Download
Comparison	Splunk SOAR vs IBM Security QRadar	Mar 10, 2026	Download

Valuable Features

Splunk SOAR excels with its strong integration capabilities, versatile playbook creation, and powerful user interface. Users appreciate its ease of use and automation features, which streamline workflows and enhance efficiency. The platform's ability to connect with a wide range of systems and applications allows seamless integration and customization. It reduces time to detect and resolve incidents, improves security operations, and promotes business resilience. Customizability and end-to-end visibility are also key benefits.

"Since deploying Splunk SOAR, there has been a notable reduction in time spent on monotonous security tasks, which I estimate to be around 95%, enabling my team to focus on more strategic initiatives."
"Splunk SOAR allows us to connect to multiple platforms, whether they are networks, security, or observability."
"In terms of time savings in threat responses, as a team, we save more than 30%, estimated around 30-40%."

Room for Improvement

Challenges in Splunk SOAR include inadequate documentation and limited integration with certain IAM solutions. The cost is high compared to competitors. Users face a cumbersome playbook editor and lack simulation tools. The platform struggles with scalability and some find the initial setup complex. There are also difficulties with automation customization, API documentation, and role management. The UI requires refinement, and training materials are not comprehensive enough. Integration with third-party tools is suboptimal.

"While I appreciate Splunk SOAR, there are areas for improvement, notably regarding the CI/CD pipeline for playbook lifecycle management, as transitioning playbooks from development to production currently feels cumbersome and requires more manual effort than I would prefer."
"I think Splunk SOAR is a bit slow to catch up with the AI boom. Everyone is ingesting Copilots or some form of AI in their platforms, and Splunk SOAR doesn't have it yet."
"I'd rate Splunk's technical support around five because compared to IBM QRadar, their support is much better. I feel Splunk should enhance their support, as it appears lacking, especially considering the costs associated with higher licenses."

ROI

Users experienced varying ROI from Splunk SOAR. Some saw a notable reduction in manual tasks, saving time and resources. Automation increased efficiency, allowing focus on strategic initiatives. Several reported initial challenges, yet valued its potential, realizing benefits over time with effective playbook development. While not all quantified ROI precisely, many observed cost savings through reduced staffing needs and operational efficiencies. Enhanced response speed and reduced false positives contributed to improved organizational resilience.

Pricing

Splunk SOAR is often perceived as expensive with a subscription and consumption-based licensing model. Users find the solution's value aligns with its cost, particularly for medium to large enterprises. Pricing can be high compared to competitors, and there's potential for unanticipated increases. While some appreciate its comprehensive features and cost-effectiveness, others suggest improvements for smaller organizations. Discounts are available based on data volume processed. Pricing includes most costs, reducing unexpected expenses.

"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"I found the price of Splunk SOAR to be good."

Popular Use Cases

Splunk SOAR is mainly utilized for security automation, incident response, and threat management. Users automate phishing-related tasks, enrich alarms, and streamline processes. It supports cloud, on-premise, and hybrid deployments, catering to security operations centers and DevOps. Playbooks and integrations enable efficient incident handling and reduced manual effort. Organizations implement it for end-to-end security workflows, enhancing user behavior analytics, responding to alerts, and protecting against threats like phishing and malware.

Service and Support

Splunk SOAR's customer support is rated positively with quick responses for most issues. While some find value in direct interaction and appreciate the dedicated support team, others rely on its comprehensive documentation and active community. Certain users highlight slower responses for complex telecom and OT cases, suggesting room for improvement in niche areas. Generally, responsiveness and support are rated between seven to nine out of ten. Many appreciate having professional services for specific needs.

Deployment

Splunk SOAR's setup varies in complexity. Some found it straightforward, benefiting from clear documentation and customizable features, while others needed additional support or encountered difficulties, particularly with newer versions or clustering. Deployment times range from hours to months depending on use cases and infrastructure. The presence of skilled teams and collaboration with support services can aid the process. Existing familiarity with similar tools or solutions also facilitates easier implementation.

Scalability

Splunk SOAR is viewed positively for its scalability, with users highlighting its adaptability in both large and small environments. Some mention hardware limitations as a challenge, while others praise its ability to accommodate vast user bases. Though generally seen as capable, experiences vary based on deployment size and expertise. Overall feedback indicates Splunk SOAR effectively manages growth, tailoring capability to organization needs, though improvements in scalability processes are desired by some.

Stability

Users consistently find Splunk SOAR to be stable. It doesn't crash or freeze and handles operations efficiently. While some face occasional latency or resource-related issues, these are usually external factors. It is reliable with minimal downtime and bugs. The stability rating from users generally ranges from seven to nine out of ten, indicating high satisfaction. Some challenges with upgrades or configurations exist, but stability remains excellent when setup is optimal.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Splunk SOAR Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company Size	Count
Small Business	12
Midsize Enterprise	7
Large Enterprise	29

By reviewers

By visitors reading reviews
Company Size	Count
Small Business	181
Midsize Enterprise	108
Large Enterprise	382

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

11%

Manufacturing Company

11%

Computer Software Company

University

Comms Service Provider

Outsourcing Company

Educational Organization

Construction Company

Government

Healthcare Company

Insurance Company

Retailer

Energy/Utilities Company

Performing Arts

Marketing Services Firm

Real Estate/Law Firm

Media Company

Aerospace/Defense Firm

Transportation Company

Recreational Facilities/Services Company

Hospitality Company

Non Profit

Legal Firm

Consumer Goods Company

Pharma/Biotech Company

Local Government

Compare Splunk SOAR with alternative products

Learn more about Splunk SOAR

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk SOAR was previously known as Phantom.

Splunk SOAR customers

Recorded Future, Blackstone

Product Categories

Security Orchestration Automation and Response (SOAR)

Popular Comparisons

Microsoft Sentinel vs Splunk SOAR

IBM Security QRadar vs Splunk SOAR

Elastic Security vs Splunk SOAR

AWS Security Hub vs Splunk SOAR

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Exabeam vs Splunk SOAR

Stellar Cyber Open XDR vs Splunk SOAR

Torq vs Splunk SOAR

Sumo Logic Security vs Splunk SOAR

Tines vs Splunk SOAR

Google Security Operations vs Splunk SOAR

Logpoint vs Splunk SOAR

ThreatConnect Threat Intelligence Platform (TIP) vs Splunk SOAR

ServiceNow Security Operations vs Splunk SOAR

Fortinet FortiSOAR vs Splunk SOAR

See all alternatives

Splunk SOAR Reviews Summary
Author info	Rating	Review Summary
Manager cybersecurity at Hexion Inc.	3.5	I've used Splunk SOAR for three years to automate incident response, improve detection and investigation, and reduce costs, though better threat intelligence integration would help; overall, it's stable, scalable, and effective for our hybrid AWS environment.
Advance Data Engineer(Cyber Security) at Novo Nordisk	3.5	I use Splunk SOAR mainly for automation in our SOC, which has saved us 30–40% in response time. It's stable and scalable, though support and customization could improve. Deployment was easy, but integration still needs refinement.
System Engineer - Security Presales at Raya Integration	3.5	I've found Splunk SOAR's playbook creation easy and it significantly reduced detection and resolution times, but integration issues, unclear features, and limited resource optimization are drawbacks. It's solid for beginners, though better options exist for mature environments.
Specialist Solutions at a university with 10,001+ employees	4.0	I use Splunk SOAR to automate identity threat detection for 5,000 users, cutting alert fatigue and audit prep time. Visual playbooks, apps, orchestration, and debugging helped handle MFA fatigue quickly. CI/CD and UI for complex flows need work. I rate it 8/10.
Cyber Security Network Security Engineer at Cirrus Logic	4.5	I've used Splunk SOAR for a year to automate security responses, especially phishing detection, and it's been reliable, seamless to deploy, and time-saving, with strong integrations, though on-prem integration and support resources could improve.
Splunk/SOAR Engineer	4.0	My focus with Splunk SOAR is on data deployment, configuration, and integration with various platforms. The visual Playbook Editor is a standout feature. Improvements could include better debugging tools and collaboration features. It's more flexible than other SOAR solutions I've used.
Senior Information Security Engineer at a tech company with 10,001+ employees	3.5	I've found Splunk SOAR useful for automating SOC tasks, saving time and improving accuracy, though coding lacks IntelliSense. It's stable, integrates well, and has responsive support, but AI features and developer tools could be better.
Information System Security Officer at a manufacturing company with 10,001+ employees	4.0	I don't use Splunk SOAR directly, but it supports our SOC by organizing massive alert volumes, enabling automation, and improving visibility, helping us investigate issues efficiently and enhancing our organization's security monitoring and overall resilience.

Title	Rating	Mindshare	Recommending
Microsoft Sentinel	4.1	12.2%	94%	104 interviews Add to research
IBM Security QRadar	4.0	6.0%	90%	217 interviews Add to research

Splunk SOAR Reviews

What is Splunk SOAR?

Featured Splunk SOAR reviews

Splunk SOAR mindshare

PeerResearch reports based on Splunk SOAR reviews

Valuable Features

Room for Improvement

ROI

Pricing

Popular Use Cases

Service and Support

Deployment

Scalability

Stability

Review data by company size

Top industries

Compare Splunk SOAR with alternative products

Learn more about Splunk SOAR

Go from overwhelmed to in-control

Force multiply your team

From 30 minutes to 30 seconds

End-to-end security operations made easy

Splunk SOAR customers

Related questions

Product Categories

Popular Comparisons