Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSOAR vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 9, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortinet FortiSOAR
Ranking in Security Orchestration Automation and Response (SOAR)
11th
Average Rating
7.6
Reviews Sentiment
6.8
Number of Reviews
16
Ranking in other categories
No ranking in other categories
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
45
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Fortinet FortiSOAR is 4.3%, up from 3.1% compared to the previous year. The mindshare of Splunk SOAR is 7.3%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Augustine Onewo - PeerSpot reviewer
Inexpensive while enhancing security operations with intuitive automation tools
Usually, FortiSOAR is used for some of our security operation tasks where it is necessary to ascertain the integrity of threat vectors and then take action against them. In addition, we automate other processes within our security operations procedure through FortiSOAR FortiSOAR is really…
Shubham Sinha. - PeerSpot reviewer
Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work
The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The reputation of the brand is very good."
"The product can be automated for network security purposes. The solution offers a great security automation response."
"The solution is easy to implement and includes 450 built-in connectors."
"The initial setup is straightforward."
"Fortinet FortiSOAR is a very interactive and user-friendly solution."
"Generally, the tool helps just automating a lot of manual load or repetitive tasks."
"The playbook and the dashboard of FortiSOAR are really informative."
"We use the product for security."
"It's pretty easy when it comes to setting up assets. If you want to fetch emails or call a REST API, you can set up an asset and grab that information."
"We are not a 24/7 SOC, so the most valuable feature of Splunk SOAR is the auto-response to threats when we are not in the office and the notifications that it sends to the on-call engineer."
"The customization of the playbook in Splunk SOAR is very beneficial."
"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."
"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."
"So far, the interface is very easy to use."
"Technical support is helpful."
"The solution’s dashboard is really good and customizable. It also has a good UI."
 

Cons

"Fortinet FortiSOAR's dashboard is not easy to understand."
"The solution lacks proper documentation, so we have to test and trial each playbook and integration."
"The tool's user interface is an area of concern where improvements are needed."
"The ease of playbook creation on FortiSOAR needs improvement."
"Fortinet's tech support overall is not great when they are at their best."
"Technical support could be improved."
"I have found that Fortinet FortiSOAR needs a lot of improvement. The Orchestration needs to be improved."
"The UI design of the solution needs to be changed since it can get difficult for a newbie to operate."
"They can improve on what they are currently doing. They can provide more playbooks or at least template playbooks that are in their repository."
"Portability is one thing that is currently lacking. The open-source product that I evaluated had portability. It would require a lot of development effort, but it will save the cost of rewriting all the playbooks."
"The application does not work properly and does not pass the log-based configuration. I feel that some kind of review should happen in the application. This review should validate things so that we can get the right information. Splunk does not tell us where the IP address is associated with."
"The tool's response is slower because it has to search through a huge dataset, which can be improved for latency."
"We've had trouble implementing the solution with Microsoft products. There seems to be an integration gap."
"The number of playbooks on offer should be increased."
"We want to see improvements made to the APIs such that we can connect to many different systems and data sources."
"Splunk SOAR has room to improve its offering for small-sized customers. The price is not fair for smaller-sized customers."
 

Pricing and Cost Advice

"Fortinet FortiSOAR is an expensive solution."
"Pricing is fine compared to other solutions."
"Considering all the features of Fortinet FortiSOAR, I think it has a good price."
"Since Africa is struggling with foreign exchange, the solution is pretty expensive there."
"Fortinet FortiSOAR is expensive."
"If you compare Fortinet FortiSOAR's price with the prices of the market leader, Palo Alto, then it can be considered a cheaper product."
"The price of the product should be lower. The brand value that Fortinet has, it has the reputation of being a reasonably priced product, and they have an enormous customer base in India. Most of the SME market is covered by FortiGate firewalls. It becomes an easy way for consultants, such as us, or even system integrators, to open the door with the Fortinet product lines."
"The solution offers both licensing and subscription models that are similar in price to other products."
"I don't know the exact price, but for my region, it is very expensive."
"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"The cost is high and the licensing is on an annual basis."
"Splunk SOAR is more expensive compared to other options for SOAR."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"I found the price of Splunk SOAR to be good."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
851,604 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
11%
University
7%
Healthcare Company
7%
Computer Software Company
14%
Financial Services Firm
13%
Manufacturing Company
12%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Fortinet FortiSOAR?
Fortinet FortiSOAR is a very interactive and user-friendly solution.
What is your experience regarding pricing and costs for Fortinet FortiSOAR?
FortiSOAR is considered costly, and I would rate its pricing at three out of ten, where one is high and ten is low.
What needs improvement with Fortinet FortiSOAR?
FortiSOAR needs to improve the response time for executing playbooks. Compared to IBM Resilient, the execution time for playbooks is slower. Additionally, FortiSOAR should include more ready-to-use...
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
Splunk SOAR is moderately priced, neither cheap nor overly expensive.
What needs improvement with Splunk Phantom?
There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced life...
 

Also Known As

CyberSponse, FortiSOAR
Phantom
 

Overview

 

Sample Customers

Information Not Available
Recorded Future, Blackstone
Find out what your peers are saying about Fortinet FortiSOAR vs. Splunk SOAR and other solutions. Updated: April 2025.
851,604 professionals have used our research since 2012.