Splunk SOAR Reviews

Name: Splunk SOAR
Brand: Splunk
Rating: 4.0 (45 reviews)

Vendor: Splunk

4.0 out of 5

45 reviews
86% willing to recommend

491 followers

Start review

What is Splunk SOAR?

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Get the Splunk SOAR Buyer's Guide and find out what your peers are saying about Splunk SOAR, Microsoft Sentinel, IBM Security QRadar and more!

Splunk SOAR is the #3 ranked solution in SOAR tools. PeerSpot users give Splunk SOAR an average rating of 8.0 out of 10. Splunk SOAR is most commonly compared to Microsoft Sentinel: Splunk SOAR vs Microsoft Sentinel. Splunk SOAR is popular among the large enterprise segment, accounting for 65% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 14% of all views.

Helped 849,686 peers since 2012

Featured Splunk SOAR reviews

Shubham Sinha.

Senior Principal Information Security Analyst at Veritas Technologies LLC

One of the features I like most is playbook creation, and custom functions are another. When you design a playbook, you can integrate multiple log sources and define rules. That used to be done by the analysts by going to the respective tools and doing tasks manually. Now, with playbook design, writing down those rules is a one-time activity that a SOAR admin has to do. After that, the platform automatically compiles all these activities and, based on the results, the analyst only has to indicate whether the result is a true or false positive. That reduces the time and effort involved. Our KPIs have greatly improved. An incident that used to take 15 to 20 minutes, was reduced to five minutes. This helped us speed up our response to any alert, whether it was a true positive or false positive. Another of the best parts of the SOAR platform is its ability to integrate with other systems and applications. It provides API integrations and, through them, I can limit the rights for the tool, which is good. If I want to integrate any of the applications with CrowdStrike, but only for incident-review policies or just to review the work automation, I can grant rights only for those purposes. That is one of the best features available in SOAR. It is very easy to implement and very user-friendly.

Read full review

Hamada Elewa

System Engineer - Security Presales at Raya Integration

We work with Splunk SOAR from a security perspective, focusing on User Behavior Analytics (UBA) and Security Orchestration, Automation, and Response (SOAR) The customization of the playbook in Splunk SOAR is very beneficial. After building the playbook, it operates professionally. There is an AI…

Read full review

SAURABHYADAV4

Consultant at HCL Technologies

The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection. Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product. I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours. Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system. The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%. I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system. It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare. After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes. Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.

Read full review

Splunk SOAR mindshare

As of May 2025, the mindshare of Splunk SOAR in the Security Orchestration Automation and Response (SOAR) category stands at 7.3%, down from 8.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

PeerResearch reports based on Splunk SOAR reviews

Type	Title	Date
Category	Security Orchestration Automation and Response (SOAR)	May 1, 2025	Download
Product	Reviews, tips, and advice from real users	May 1, 2025	Download
Comparison	Splunk SOAR vs Microsoft Sentinel	May 1, 2025	Download
Comparison	Splunk SOAR vs Palo Alto Networks Cortex XSOAR	May 1, 2025	Download
Comparison	Splunk SOAR vs IBM Security QRadar	May 1, 2025	Download

Title	Rating	Mindshare	Recommending
Microsoft Sentinel	4.1	18.8%	93%	92 interviews Add to research
IBM Security QRadar	4.0	7.8%	91%	208 interviews Add to research

Valuable Features

Splunk SOAR offers valuable features like playbook automation, flexible integration with third-party systems, and robust API connectivity. Users appreciate its intuitive interface, ease of use, and efficient incident response capabilities. Customizable playbooks and Python scripting enhance automation. It significantly reduces manual actions and improves response times. Splunk SOAR's seamless integration with security tools like SIEM, firewalls, and cloud platforms streamlines workflows, providing comprehensive visibility and facilitating effective threat management. Its versatility and scalability make it a top choice.

"Splunk SOAR has made a huge impact across security operations and the business overall."
"The best feature in Splunk SOAR is the visual Playbook Editor. The drag-and-drop interfaces make visualizations and understanding workflows easy."
"The customization of the playbook in Splunk SOAR is very beneficial."

Room for Improvement

Splunk SOAR users highlight integration challenges with Microsoft and IAM solutions. There is a need for enhanced automation, user interface improvements, and expanded playbook functionality. They desire better documentation and support, along with improved API access for enhanced connectivity. Reporting capabilities require enhancement, as does pricing and scalability to accommodate varied organizational needs. Users also express concerns about ease of implementation, playbook editing tools, and the need for support for additional platforms like Android.

"There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced lifecycle management."
"To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced lifecycle management."
"The creation of playbooks is complex in Splunk SOAR, and the number of integrations needs enhancement. Although it enhances alert handling, it still has a journey to compete with Palo Alto SOAR and FortiSOAR."

ROI

Organizations report varying degrees of return from Splunk SOAR. Some find it provides significant value, streamlining tasks and freeing resources, while others face challenges measuring return due to implementation complexities. Familiar users quickly see benefits, though some require months for full integration. Several companies note improved efficiency and resource optimization. Deployment across systems often shows better results, although integration time varies. Efforts in developing robust playbooks and automation are key to maximizing benefits.

Pricing

Splunk SOAR utilizes a subscription-based, consumption-focused licensing model that can accumulate substantial costs, notably higher than competitors. Price varies based on data usage, user count, and additional modules or services like professional setup, potentially ranging from $100,000 to $1 million. While some users find it expensive, they acknowledge its value through enhanced automation and resource efficiency. Opinions diverge on its affordability, emphasizing that it’s perceived as benefiting medium to large enterprises rather than smaller ventures.

"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"I found the price of Splunk SOAR to be good."

Popular Use Cases

Splunk SOAR is predominantly utilized for threat analysis, incident response automation, and integration across various endpoints. Organizations deploy it for security monitoring, phishing response, malware investigation, and user behavior analytics. It enhances threat detection, enriches alerts, and supports processes like phishing email management. Many also use it for automating routine tasks, developing playbooks, and integrating third-party applications, while facilitating seamless incident management and reducing manual efforts in security operations.

Service and Support

Customer service and support for Splunk SOAR are mostly positive, with many finding it responsive and knowledgeable. Documentation is highly regarded, reducing the need for direct support interaction. There are mixed experiences regarding flexibility in handling diverse use cases, particularly OT and IoT. Some users appreciate the quick response times and professional services, while others rely on the robust community for faster solutions. Overall satisfaction rates from six to nine out of ten.

Deployment

Splunk SOAR's initial setup varies in complexity. Some users find it straightforward and quick, while others face challenges requiring special expertise or technical support. Deployment time ranges from a few hours to several months, influenced by architecture and customization needs. Although many appreciate the available documentation, difficulties with integration and clustering arise for some, especially when handling complex environments or specific use case modifications. Deployments often involve cooperation among multiple team members or external experts.

Scalability

Splunk SOAR is highly scalable with flexibility and strong administration capabilities, allowing operation in large environments. Users note ease of expansion and high scalability, though some mention occasional issues related to hardware bottlenecks and node management. Many report success in handling thousands of users and assets. The system supports a vast number of apps, enabling a wide range of automation tasks. Users rate scalability favorably, highlighting the software's ability to grow with organizational needs.

Stability

Splunk SOAR is generally stable with occasional issues related to traffic overloads or backend incompatibilities. Users mostly find it free from bugs or crashes, rating its stability between seven and nine out of ten. Some mention potential challenges with upgrades and integrating third-party services. Though known to crash under specific circumstances, it performs reliably in typical scenarios, with most issues attributed to external factors rather than inherent faults.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Splunk SOAR Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

14%

Financial Services Firm

13%

Manufacturing Company

11%

Government

University

Comms Service Provider

Educational Organization

Retailer

Construction Company

Energy/Utilities Company

Healthcare Company

Real Estate/Law Firm

Insurance Company

Media Company

Outsourcing Company

Aerospace/Defense Firm

Hospitality Company

Non Profit

Legal Firm

Transportation Company

Recreational Facilities/Services Company

Wholesaler/Distributor

Consumer Goods Company

Performing Arts

International Affairs Institute

Pharma/Biotech Company

Compare Splunk SOAR with alternative products

Learn more about Splunk SOAR

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk SOAR was previously known as Phantom.