Splunk SOAR Reviews

I use the solution for incident response and automation.

The product helps with workflow reduction. The manual efforts required have been reduced. It contributes to optimization. The extent of workflow reduction varies depending on the instance. Manual intervention is required for critical processes. If it is not critical, we can automate it.

The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection.

Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product.

I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours.

Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system.

The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%.

I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system.

It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare.

After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes.

Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.

The solution must provide more AIOps to improve predictability.

I have been using Splunk SOAR for three to four years.

The tool is stable because it is completely SaaS-based.

The SOC and engineering teams use the solution. The engineering team uses it to automate tasks. We have around 30 to 40 users. We were not using the tool completely initially. Once we started using it, we scaled it. We have also increased the number of product licenses. Our clients are enterprise-level businesses.

I've been using Splunk products for a long time. Overall, I am pretty satisfied with the quality of service of the support team.

Positive

Splunk SOAR is SaaS-based. The deployment takes a few months to stabilize. We have a Splunk team that manages the deployment. Two to three people are involved in the deployment.

Everything good comes with a price. The tool is not cheap. However, if we use it to its full potential, it will be beneficial.

Overall, I rate the product an eight out of ten.

We have a couple of different use cases. A lot of it started out in our security space, and we have use cases related to our legal and withhold process. We manage and handle our phishing and spam activity as well as our digital or any copyright act complaints.

We have a multi-cloud implementation, but most of our use cases that are currently implemented tend to not be specific to monitoring our cloud environments.

A lot of it comes down to the time and effort savings. For what we are doing with Splunk SOAR, a human would take a lot more time. Some things are very repetitive, and with Splunk SOAR, it might take a little bit of work to get that human work translated to the programming language or functions inside a playbook, but it allows us to take all that workload off that person and be able to do more with that one person.

For some of our actions, there has been about a 300% increase in productivity. For a lot of the use cases that we have implemented inside of Splunk SOAR, there is not as much to resolve. There are mostly actions where if something happens, it should go and do something, so it is automating that human process. It takes most of the work away from the person.

We have been able to benefit from a decreased workload on our limited staff. That same staff has been able to do more things because they are not having to do the work that this tool is doing.

Splunk SOAR has had no bearing on our resiliency.

The playbooks are valuable. They are the core component. Being able to implement and build a code process to work through and scale out what we want to do is valuable.

I have put a number of ideas on the ideas.splunk.com site for feature requests for the Splunk SOAR product. I posted one of them about three years ago, which finally got implemented in the latest release that just got announced, so the time to implement new features and things like that is a little bit concerning. I tend to post my ideas there so that other people in the community can see the features or ideas. They can then upvote them and make comments on them. I thought that is what the site is for.

We have been using Splunk SOAR for about three years.

Overall, the stability of the product in terms of day-to-day operations is great. It is 100%, but because of the inter-dynamic and connected nature of SOAR, it relies on other services. When those services have changes or issues, it impacts SOAR, but SOAR, unfortunately, does not always handle them very well. It might look like there is a problem in SOAR or in the playbook or process that happened, but it might be a third party that caused it. Unfortunately, it requires someone to go into SOAR and fix something and do rework because, ultimately, that is the interconnection point where it fails.

We have not designed our SOAR to scale. I am just going to grow it as big as it can until finally, I need to split it. We are not that large, so I do not know whether it will scale well or not.

Overall, it has been great. We have not had any major bugs or incidents that have required anything more than requesting copies of the code for apps to make the additional changes that we need. Overall, the organization has been very good with that. I would rate them a nine out of ten.

Positive

We had no other automation or orchestration technology prior to Splunk SOAR.

It was complex. Several of our use cases required modifications to existing SOAR apps, meaning new features had to be coded or added to the SOAR app support we wanted to do. Additional custom bits of code had to be created. At the time, we first implemented a lot of the features that are there in the product now, but they were not there. If we had waited two years to do the initial implementation, we probably would have got a much faster time to value because a lot of the work went in early on to build out features, but then they came out with a whole new version of it. The sad part is that for upgrading to the latest version of Splunk SOAR, we had to migrate from Python 2 to Python 3, so the process by which those playbooks and other things get migrated is difficult and requires a lot of work and rework.

We did have a Splunk professional involved in our initial setup. I believe it was a direct Splunk employee. I do not believe it was a third-party person. They were good. 

We have a lot of Splunk knowledge. We have complex use cases. We have a high level of knowledge. We did not want someone who just came out of the training class. They had to send us someone who was going to be valuable to us, and they did.

It is hard to quantify whether we have seen a return on investment. The expectation is that we do, but we are so short on staffing that it is difficult to calculate whether it is giving us a full FTE worth of a person. We think we are getting it, but we do not have good numbers to say that we are.

It is also hard to say whether we have seen time to value because there are some use cases that take so long to implement. Because of the way that SOAR is structured and interconnected with so many systems, to get something going and then make sure it continues to work, the time to value starts to become a little bit back and forth. Some of the use cases are great. The services underneath them have not changed. There has not been a lot of transition, but with the other ones, such as an API update, an update is required on the SOAR side, so it is a little harder.

When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing.

We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity. If I have an event that happens 500 times a day, but it is relatively minor, I can still spend the effort to automate it. The previous model meant that we could only automate high-value items in Splunk SOAR, meaning they had a large cost of the human factor to automate them, whereas now, I can transition. I can do many different things with Splunk SOAR that we were intentionally limited on.

We had evaluated other options twice. We evaluated before the acquisition by Palo Alto and then during our latest renewal period, we went ahead and reevaluated Palo Alto's competing products just to make sure that we are doing our due diligence about technology and whether this was going to be better or worse for us.

Overall, I would rate Splunk SOAR a six out of ten.

Splunk SOAR, formerly Splunk Phantom, is a powerful automation platform with a high security focus, but it is also usable for any other general tasks such as putting a server off the network, restarting services, performing health checks, performing data enrichment by collecting information from different sources and combining, analyzing, and providing precise information about several topics. It has a variety of options, and what can stop you is just your creativity.

Splunk SOAR has a user-friendly interface that simplifies playbook creation. While some initial training is helpful, the drag-and-drop functionality and pre-built code generation features make it accessible even for those without extensive coding experience. This ease of use allows teams to quickly automate incident response tasks, reducing the business impact.

Splunk SOAR helps us improve our data collection and automate operational tasks. While it enriches data, some actions require approval or additional information. For application outages, immediate action is crucial to avoid business impact, and time to respond is key to be able to identify the root cause of issues. For example, if a database server goes down, if the analyst doesn't check the issue right after it occurs, they may end up losing precious logs, which would help them identify the issue and avoid reoccurrence. Additionally, manual database tasks like service restarts or log checks are time-consuming. Splunk SOAR automates these tasks, enriching our log collection, running health checks, and generating reports for the database team. This allows for faster issue identification and resolution, ultimately contributing to high system availability and minimal customer impact.

It provides a comprehensive solution for our environment's health. Splunk offers two key products: Splunk as an observability tool that detects critical issues, and Splunk SOAR, an automation platform that enriches data and even automates remediation actions.

SOAR offers easy integration with various tools. We can leverage pre-built apps for common integrations or create custom ones. While Splunk integrations are automatic, SOAR's API allows us to send data from any observability tool using the SOAR API. This API offers different options to manage the platform, and one of the options is to create a container in SOAR, which can trigger the appropriate playbook based on a label name, simplifying integration with new tools and accelerating proof-of-concept deployments.

Implementing a SOAR platform significantly improved our IT operations. Previously, frequent application downtime overwhelmed our busy operations team, forcing them to prioritize and leave some issues unresolved. SOAR automation relieved this pressure by allowing us to create playbooks that automatically detect and fix recurring problems. While the initial setup required developing playbooks and standards, the resulting reduction in alerts and faster issue resolution freed up the operations team's time and had a major positive impact on our overall IT environment.

Our mean time to detect is within seconds. Before SOAR, manually detecting and resolving server issues was slow and unreliable. It could take hours for an overloaded team to identify a problem, and even longer to fix it, potentially impacting customers. SOAR automates this process, triggering immediate responses that take seconds, minimizing downtime, and ensuring a smooth customer experience.

Our mean time to resolution is improved. SOAR helps resolve issues quickly by automating tasks through playbooks. When an issue is detected, SOAR can run a playbook to fix it or provide more information to analysts, expediting resolution.

SOAR has significantly improved our efficiency by automating manual tasks. This frees our IT staff to focus on resolving issues faster and tackling more complex projects.

SOAR allows custom code to be written and integrates with various technologies through pre-built apps like Windows Remote Management or custom apps we can build ourselves like a secret retrieval app from our vault. Playbooks, built with drag-and-drop and custom functions, provide further flexibility for developers to tailor the solution to their specific needs.

While there have been improvements to the investigation process, particularly with the playbook data, the current log review method is cumbersome. Scrolling through massive, unsearchable logs is inefficient. Ideally, the system would offer search functionality or even AI-powered analysis to pinpoint issues quickly, saving time spent sifting through text.

SOAR's development efficiency can be enhanced by incorporating AI to assist in writing custom code, eliminating the need to start from scratch. This AI-powered approach would significantly reduce the time required to develop playbooks.

I have been using Splunk SOAR for over five years.

SOAR is stable. In the last three years, we only had it go down twice, which was related to a server issue.  

SOAR is designed to grow with our needs by allowing us to add more hardware to handle increased workloads. This makes it a good fit since scalability was a major factor in our evaluation. On top of that, SOAR's customizable platform ensures it can be tailored to our specific requirements.

During playbook development, we encountered technical issues with the playbook feature itself, requiring vendor assistance. Their expertise was invaluable. Not only did they resolve the immediate problems, but they also proactively suggested improvements to our SOAR platform coding for better speed and overall performance.

Positive

Having experience with various automation tools, including Microsoft Orchestrator, Ansible, Rundek, I find SOAR to be the most user-friendly. In fact, after exploring most market offerings, Splunk SOAR stands out for its comprehensive feature set, surpassing any other platforms we've previously used.

The deployment required one member from our team and one from the SOAR team.

Implementing Splunk SOAR was made significantly easier with the support and expertise of the vendor's team. Their deep knowledge of the platform and extensive deployment experience proved invaluable, allowing for a smoother and more efficient implementation process overall.

While the exact pricing for Splunk SOAR is not known to me, I've heard from some colleagues that it may be on the more expensive side compared to other automation tools. However, the general consensus seems to be that the investment in Splunk SOAR pays off once you start utilizing its capabilities and automating your workflows. By automating tasks and freeing up resources, Splunk SOAR can provide a strong return on investment in the long run, despite the potentially higher upfront cost.

I have evaluated different automation platforms, such as Microsoft Orchestrator, Ansible and Rundeck.

I would rate Splunk SOAR nine out of ten. I am deducting one point because it is tedious to go through the logs manually.

SOAR allows for cloud and on-premise deployment, and I favor the on-premise option for enhanced security. Since some automation has extensive access to our internal systems, any internet communication during operation raises the potential for breaches.

One of our use cases is to automate any kind of process after investigation. When going into an investigation, we want to make sure that we have the right tools to use. Instead of having multiple tools, we can bring them all into one platform, such as Splunk SOAR, to provide us with that information.

Splunk SOAR has not benefited us yet because we are currently in the development process, but I believe that in the future, it will help us streamline our process and our RTR to respond and detect. It is going to help us in the future, but it has not brought us any benefit yet because we are currently building it up.

It is very important that Splunk SOAR has end-to-end visibility into our cloud-native environment. If there is no visibility, then there is no ability for us to detect on time and respond in time. It knocks out a lot of that time discrepancy.

Splunk SOAR has not yet helped reduce our mean time to resolve. It will be helping us in the future due to its playbooks and its compatibility with Mission Control and other Splunk integrations.

It has helped us with our business continuity and our ability to respond to different threats that might be out there.

Splunk SOAR has not saved us time in alert triage. We are still in the early stages of getting Splunk SOAR onboarded and developed, but I believe that it will significantly reduce our time to triage. Similarly, Splunk SOAR has not saved us time in threat response, but it will do so in the future.

Splunk's unified platform has helped consolidate networking, security, and IT observability tools. Splunk's unified platform has been great for every organization. Every analyst has been able to use one unified area.

In Splunk SOAR, I find the playbooks valuable. We get to create multiple playbooks, and within each playbook, there is a different type of investigation attached to it, which helps out an analyst or new analysts coming on board. When they get an incident, they do not need to find out where to start. All they have to do is to go to a particular playbook. It will give them end-to-end specifics on what to do and how to process it.

They can improve what they are currently doing. They can provide more playbooks or at least template playbooks that are in their repository. That is one area.

Another area would probably be related to onboarding different playbooks or different tool sets that new engineers have. Eventually, they will get there to ingest more tools and datasets into their SOAR. 

In terms of additional features, it is hard to say. There can be more integration with other data ingestion platforms out there, not just Splunk.

We have been using it for about one month.

We have not played with it too much yet. Once we are able to play with it more and get more details from it, we can respond to that.

It can be very scalable just because of the number of different apps that the community pushes to it. Right now, it is not there yet, but I believe in the near future, it is going to be the best growing platform out there.

Splunk's customer service is great and impeccable. I believe that they have been a very valuable resource to our organization and our team.

I would rate their support an eight out of ten just because I believe that no one really gets a ten. It is an eight just because the answers that they cannot answer for us, they are able to get from the community. The community really helps out, but they are always there to help, and they are always responsive.

We are using Splunk Cloud, the public cloud, but we also have on-prem. We use AWS.

As the initial start of the Splunk SOAR, we are getting started with developing the playbooks and getting the configurations set up with our users and toolsets. It has been pretty easy so far. I have not had any hiccups, but we will see where that takes us as we finish our development.

We did not use any integrator or reseller.

We have just started getting our metrics developed, ingesting into Splunk, and showing that to the executives.

I would rate Splunk SOAR a nine out of ten just because it does hit all points for the use cases as an analyst, engineer, or developer. It allows us to automate and orchestrate all of our detections and respond to them very quickly.

I use Splunk SOAR to create automation for our SOC team. These automations integrate with third-party applications, which is a key requirement for our SOC.

Splunk makes creating playbooks simple with its GUI. We can build playbooks by dragging and dropping different elements, eliminating the need for complex coding.

The visibility of the playbook viewer is good. We can add custom code while developing the playbook if required.

Splunk SOAR provides end-to-end visibility into our environment.

Troubleshooting our cloud-native environment with Splunk SOAR is a breeze thanks to its intuitive graphical interface. Unlike traditional tools requiring command lines, Splunk SOAR lets us manage integrations and cloud access entirely within the user-friendly GUI, streamlining the process.

Splunk SOAR has significantly reduced our manual workload by automating many previously time-consuming processes. We only began to see the full benefits after about five months.

Splunk simplifies security investigations by offering pre-built processes and leveraging the rich functionality embedded within Phantom's alerts. This combination provides a powerful toolkit for investigators.

Splunk SOAR has significantly improved our security alert resolution efficiency. While the specific time saved depends on the individual case, we've seen a general reduction in resolution time from around 20 minutes to five minutes thanks to the variety of use cases it supports.

Splunk has reduced our mean time to detection by 15 minutes.

Our mean time to resolution is now down to five minutes.

Splunk SOAR streamlined our security operations by consolidating multiple tools. We've successfully integrated and replaced approximately 15 individual applications into a more unified environment.

The most valuable features are the third-party integrations and the playbook development that can be done using Python.

Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack. This includes tools like Salesforce, Microsoft Outlook, and abuseIP, empowering our organization's SOC and security teams to leverage these familiar applications within SOAR's automation and orchestration capabilities.

Playbooks offer significant room for improvement, as custom code is often required during development. Various aspects of the playbook development process itself can be optimized.

I have been using Splunk SOAR for one and a half years.

Splunk SOAR is extremely stable.

Splunk SOAR is scalable to our needs.

The technical support is good.

Positive

I would rate Splunk SOAR five out of ten.

Early on, we encountered some issues automating tasks with playbooks. However, a recent Splunk version upgrade resolved those problems.

We have 50 users spread across different regions.

The resilience of Splunk SOAR is great.

A thorough evaluation of the SOAR landscape is recommended to identify the best fit for your needs. If Splunk aligns with your requirements after this assessment, it can be a strong option.

We utilize Splunk SOAR to automate our incident response process. I am the sole engineer in my current organization, responsible for working on Splunk to automate the incident response process followed by our team. This involves investigating various incident response procedures established within our security operations center.

The main problem we want to solve is the time it takes to invoice tickets and remediate incidents. Therefore, we aim to reduce that time. If our analysts manually handle and investigate each incident, it will take longer compared to using this solution, which automates most of the processes. Whenever an incident occurs, the playbook and Splunk automatically initiate the necessary actions to gather the required data, enabling the analyst to make informed decisions and address the incident promptly.

Creating a playbook using the Solutions Playbook Editor, is relatively easy if we possess some knowledge of Python code and the ability to write various types of flow diagrams.

The visibility of the solution's playbook viewer is excellent. There is adequate documentation that assists individuals in learning how to utilize the playbook to construct solutions.

Splunk SOAR's ability to integrate with other systems and applications in our environment is straightforward. It has numerous capabilities to integrate with various security tools, as it supports open APIs. If the solution supports the API, we only need to write the corresponding APIs in the pipeline code and utilize those API tools to construct the integration, enabling us to take action accordingly.

The most significant improvement I have observed is time-saving in the Security Operations Center incidents. We receive approximately a thousand to eleven hundred incidents per day, and if we were to manually investigate these incidents, we would require a team of ten to twelve people. However, by utilizing Splunk SOAR, we are able to handle the investigation of these thousand alerts with just six or seven people.

Splunk SOAR is not difficult to use in an investigation; it depends on the use case. I haven't encountered any issues with the implementation of the case solution, and there don't seem to be any limitations in that regard.

Splunk SOAR assists us in reducing the volume of security events. Whenever an incident occurs, the playbook initiates actions simultaneously with its generation in our security operations center. These incidents are automatically handled by the playbook, while incidents requiring manual intervention are assigned to our analysts. All other incidents are handled automatically through Splunk SOAR playbooks. Splunk SOAR has reduced the security event volume by forty-five percent.

Our mean time to detect has been drastically reduced. Before Splunk SOAR our security operation center, analysts worked on a queue. Whenever an alert was received, it was placed in a queue, and the incidents were investigated one by one. However, with the implementation of Splunk SOAR, we now have instant knowledge and analysts can start investigating more effectively. The required data is already gathered by the playbook itself, aiding analysts in making more accurate decisions in less time. This has resulted in a reduction of our mean time to detection by at least eighty percent. Previously, without Splunk SOAR, we experienced significant mean time to detect because analysts had to focus on one incident at a time, leaving other incidents waiting. Now, there is no need for incidents to wait for an analyst to take over. The playbook automatically gathers the data, allowing the analyst to have all the necessary information as soon as they start, enabling them to make prompt decisions.

Splunk SOAR has helped reduce our mean time to resolve. The resolution of incidents sometimes depends on different teams that need to investigate and send notifications for action. However, the notification of those incidents has been significantly reduced, and we can confidently say that we have achieved a fifty percent reduction in our mean time to resolve.

Fifty percent of our IT staff's time is saved through using Splunk SOAR, and we can utilize that time to work on the other project we have.

Splunk SOAR has saved our organization forty-five percent of our time.

The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools. Additionally, we can write our own Python code, which can be used and embedded in a Splunk SOAR playbook, enabling us to utilize that code directly within the solution itself.

There is a lot of room for improvement with the UI. 

I would like to have more integrations with cloud technologies and functionalities such as AI within Splunk SOAR.

I have been using Splunk SOAR for five years.

Splunk SOAR is stable.

Splunk SOAR is a hundred percent scalable.

The initial setup was straightforward and took approximately three hours. Four individuals from our network team and one individual from the Splunk personal service team were required for the deployment as we needed to configure the server.

We have observed approximately a forty-five percent return on investment with Splunk SOAR.

Splunk SOAR is more expensive compared to other options for SOAR.

We assessed various open-source options prior to choosing Splunk SOAR, such as Securonix SOAR and Shuffle.

I would rate Splunk SOAR a seven out of ten. The solution necessitates expertise in Python coding, which is challenging to find in individuals. Additionally, Splunk SOAR lacks sufficient AI integration.

Before using Splunk SOAR, it took us approximately six hours to block certain IPs on our firewalls. However, after implementing Splunk SOAR, we were able to accomplish the same task within just five minutes.

We deployed Splunk SOAR on a single server.

We have around nine people that use Splunk SOAR in our organization.

Maintenance is sometimes required based on the incident volume we receive. If we experience a higher volume, we need to maintain the RAM and other components in our server. Therefore, it is important for us to exercise caution in this regard.

I highly recommend Splunk SOAR for individuals seeking to automate the incident response process in their security operation centers.

I primarily use the solution for incident investigations. 

We can make custom playbooks and use the Playbook Editor to do so. The Playbook is my favorite feature, it's quite useful. There are a lot of automation capabilities.

Its visibility is good. It's end-to-end. We can see incidents across our environment. We've been satisfied with the level of visibility so far. 

The automation helps save us time. We've saved a lot of time researching incidents. If we do resolutions manually, it can take up to 15 minutes. With Splunk's automation and Playbook, we can resolve issues within two to three minutes. 

We have Splunk integrated with other tools and systems. Some are using, for example, Carbon Black EDR. It's very flexible. It works with various third-party tools. Which we use depends on the customer. 

The solution provides good business resilience. It helps with real-time detection and resolutions. With automation, our real-time alerting is quite good. 

Splunk integrates with many products. It provides us with good information for us to be able to do our jobs.

We have been able to reduce the use of other tools. When we use Splunk, we tend to just focus on Splunk's findings, only. We do a lot of investigations using Splunk. It makes the process easier. 

We've noticed a reduction in security event volume. It's helped us to reduce a lot. We've been able to reduce the mean time to detect by 30% to 40%. It's also helped us reduce the mean time to resolve by almost 50% to 60%. We have a lot of customers and a lot of alerts typically, so we've always had a lot to deal with. 

I haven't had any issues with the solution so far. 

I've used the solution for three months.

The solution is really scalable. We are using it across multiple customers and handle multiple alerts. 

We are able to connect with support if we have issues. 

Positive

Right now, we also have IBM. However, mostly, we use Splunk. Our customers prefer Splunk over IBM thanks to the playbooks on offer. The appearance of Splunk is also better. Splunk has a strong reputation in the space. It makes investigations easier.

The deployment process is straightforward. Our deployment team will deploy it for customers. It will take two to three days, depending on our customer's servers. 

We can train employees on how to use Playbooks within two months. 

We help our clients deploy Splunk. 

The cost is as expected. It can be a bit high, however, we get a better rate between us and our third party. We provide services to clients if they purchase Splunk SOAR which gives them good value. 

I'd rate the solution nine out of ten. 

My company operates as an MSSP that takes care of the detection and response for our customers. Splunk SOAR is where our company does the alert processing, and it is also where our SOC does its work. I work on developing the playbooks and apps that we use.

The product has improved the working of our company since it has removed a lot of the tedious work that we had to do previously. Even some of the easy stuff gets automated. Our company's analysts can really focus their hours on work that requires critical thinking, creative skills, and other similar areas.

The most valuable feature of the solution is the playbook automation just because it allows us to reduce the manual actions that SOC has to handle. When it comes to some of the workbook functionality where the analyst has to take some manual action, we can guide that process through templates and other things.

I think some of the case management functionality could be improved. Improving the integration ecosystem can raise the quality of the bottom tier of the integrations so that they can work better out of the box. In general, our company is pretty happy with the tool.

I have been using Splunk SOAR for four years.

The tool's stability is fairly good.

When it comes to the scalability, I think we have seen some issues there, such as running into some hardware bottlenecks sometimes, but I am detached from that part of the deployment, so I can't go into details on the things I have seen, but I know there are some pain points for our company. As we scale up the tool in our company, we are not really sure how to scale up in a better manner.

The customer service and technical support have been great. We had some professional support come out when we set it up, and they were super helpful in helping us with the use cases and getting us stood up quickly. When our company reached out to the support team with some technical issues, I didn't hear any complaints about the responses from their end, so I think it was good.

I have not used any other solutions in the past.

I have done the deployment personally in my lab but not in a production environment.

My company evaluated Siemplify, which is known as Chronicle SOAR. My company has also evaluated Demisto and Cortex XSOAR. Our company is heavily invested in Splunk's ecosystem, and I think that was the biggest draw, especially since we use Splunk Enterprise Security and similar tools, so adding another Splunk tool made sense for our company. I think the product felt mature, and the plug-in ecosystem was where we needed it to be, along with the ability for the community to submit and create their own integrations and apps, which was interesting for us.

When it comes to Splunk SOAR's ability to provide end-to-end visibility into our company's cloud-native environment, I would say that we are not using the cloud portions of it. I don't know if that's super relevant to what we are doing in our organization.

I am 100 percent sure that Splunk SOAR helped reduce your mean time to resolve, but I don't have any metrics on hand but I know it has dramatically decreased.

The tool has helped with the business resilience part. I think having it as a platform has been a solid portion of the product that we offer to people.

Spunk SOAR has definitely saved my time in alert triage. When some of the tedious enrichment and lookup stuff happens, the analyst doesn't have to deal with such areas, and they can just jump in and see relevant data all in one pane of glass, which has been super helpful for speeding things up.

The unified platform helps consolidate networking, security, and IT observability tools. The consolidation of tools impacts our organization as it just helps focus the SOC analyst on a single unified place to find information. It helps keep things streamlined and regular so they know where to look for certain stuff they want. It really helps people with training. It is a really easy tool to onboard people into because everything is right there in the product itself.

The product is really great. I would love to see more SOAR innovation going into the tool, especially the on-premises version since it is what we use in our company. I feel the tool needs to encourage continuous improvements, but as a product itself, my company is really happy with the solution.

I rate the tool an eight out of ten.

The primary use case is for our Security Operation Center. We use it for automation and responding to some of our cybersecurity alerts. It is being used for performance enrichment and automation on those events.

We do not use Splunk SOAR to predict things or try to predict things that can happen in the future. We are mainly using it to respond to things. It is more for responding to events that have happened.

We implemented Splunk SOAR because we had a lot of repetitive tasks that our analysts do. In our area, it was hard, and it still is hard, to find cybersecurity graduates and analysts, so any time that we can save for our analysts can be better spent.

There has been a lot of time-saving which equals to dollars-savings for the company. We have a lot of automation of repetitive tasks and things like that. We do not have to do things manually, so it saves a lot of time for our analysts. It is hard to measure the time savings because we are always developing or trying to develop new things. We are not that far along. We have been using it for three years but we have used it in production for maybe a year and a half. There is a big learning curve, so I am still learning. 

Our cloud endeavors are still in their infancy phase. We have not even started to look at that part yet. For our on-prem environment, there is definitely an advantage. There are a lot of features and capabilities not only from a security perspective. We have real-time alerting based on the system downtime and certain logs that are collected and things like that. I am sure we can apply it to the cloud infrastructure in the future as well.

We have definitely saved a lot of time with the things that we have automated. We have probably saved the amount of one analyst in a year.

In terms of Splunk SOAR's impact on our organization’s business resilience, it is on the way to getting there. This year and next year, we will definitely set that stage. We have some initiatives that are just starting that would definitely put us into that area. We have not crossed that bridge yet.

Splunk's unified platform has helped consolidate networking, security, and IT observability tools. A simple example is the ability to use SOAR integrations and API integrations in all the different tool sets that we have. Our analysts can use those tools from Splunk instead of having to log in to each one of those tool sets to do things. It is saving a lot of time as well for our analysts.

Surprisingly, the mobile app is valuable because it is very convenient for our on-call analysts to respond and get alerted to security alerts and events wherever they are. We are able to harness the power of Splunk SOAR and everything that we are doing, and we are also able to alert our on-call analysts 24/7. From their mobile phone, they can respond to those alerts. They do not necessarily have to have a laptop with them. That is one of the most convenient features or parts of Splunk SOAR that we use. This type of integration with the mobile app is not very common.

Unfortunately, not all of our analysts are iPhone users or iOS users. The mobile app is only supported on iOS. Our analysts who have Android do not have that benefit. That would be a nice thing to have so that we can have it across the board and not just for iOS.

I have been using Splunk SOAR for three years.

It is very stable. It is pretty rare that it goes down. It crashed just once last week.

This is an aspect that we have not yet explored. We have a single instance on-prem.

From my experience, Splunk support has always been top-notch. I would rate them a nine out of ten. One point that is missing is because of the bad experience that we had while starting out with Phantom. It was hard for the support to assist us. There were definitely some breakdowns in communication that resulted in delays.

Before SOAR, it was called Phantom. It was the same thing, and then they changed the name of it. We did not use any other solution previously.

It was a pretty rocky start. That was when it was Phantom, and there were a lot of problems. I had a lot of problems with Phantom. A lot of that was why we had hesitation with renewing Splunk SOAR. A lot of the problems were related to bad code and poor instructions and guidance. Some of it was things that we may not have done right, but a lot of it was related to code. It definitely got off to a rocky start. It was not as smooth as we anticipated the whole thing to be. 

Our environment is on-prem. We have some things in AWS, but I am not privy to the cloud aspect.

We deployed Phantom ourselves.

We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock.

Instead of a gradual increase from time to time, it was just a big sticker shock increase. The price is never going to decrease again. I am not saying it was justifiable or not, but the message that was relayed to us and the unwillingness to negotiate at least to a more reasonable number were surprising.

The only one that we pursued was a product called Siemplify which has been bought out by Google since then. Our primary reason for going with Splunk SOAR was that we were already a Splunk customer. It made sense to wrap Splunk SOAR into that as well. We use Splunk ES. With Siemplify, the integration piece was lacking just because it was not a Splunk product.

I would rate Splunk SOAR a ten out of ten, especially as compared to other options out there, such as XSOAR and Siemplify. A lot of my decision is based on the fact that we were already a Splunk customer, so the integration was beneficial.