Splunk SOAR Reviews

The main use case that I have been using, and many customers are asking for, is automation, specifically automated alert triage and IOC enrichment for IPs, domains, and hashes.

I can cite a scenario where with Splunk SOAR and automated alerts and IOC enrichment, we maintain a dedicated database that has associations with other vulnerable databases, making IOCs very easy to obtain from the real-time environment and common databases, ensuring that our network is completely protected from these kinds of IOCs, whether that is a zero-day attack or a non-zero-day attack vulnerability.

Splunk SOAR automation helps with account takeover attempts and business email compromises.

The mean time to respond has improved for our internal team with reduced investigation time, where enrichment time can be reduced from fifteen to twenty minutes to just one or two minutes.

This is an average across the team that is not based on specific incidents, so considering our five team members, alert fatigue is also lessened with automated tiers, allowing us to filter out false positives and negatives directly from the portal.

Splunk SOAR helped us reduce the MTTR for incidents or alerts that previously required fifteen to twenty minutes for analysis down to less than one to two minutes, achieving a reduction of fifty to seventy percent.

Automation through playbooks allows analysts to allocate their time efficiently during investigations, simplifying the process with standardized procedures.

The main measurable business outcome from using Splunk SOAR is risk reduction.

The most valuable features include a visual playbook editor with a drag-and-drop workflow builder that makes it very easy to design playbooks without writing everything from scratch.

Onboarding is much easier, and the visual playbook editor helped me significantly in setting up the production environment, speeding up the deployment process.

The ability to integrate is noteworthy, as Splunk offers a wide variety of available integrations.

The steep learning curve for custom playbooks requires solid Python and API familiarity, and there are some issues seen in debugging and playbook execution logs that need to be improved, as well as requiring manual maintenance for third-party integrations.

Integrations need to be improved.

I chose an eight out of ten because while everything else, detection and alerts, is perfect, there is a need for some manual audit time, requiring the team to be in the portal for about an hour each week.

We face some challenges with accuracy, particularly with false negatives and positives; we need to perform manual verification on internal threats but find it acceptable for external IOCs.

I have been using Splunk SOAR for the last two years and have deployed it for a couple of customers as well.

Splunk SOAR is stable, working as expected without any downtimes or delays in receiving real-time alerts.

Splunk SOAR's scalability is beneficial as it handles enterprise ingestion volumes effectively when paired with custom worker nodes and RabbitMQ architecture.

Splunk SOAR is scalable enough for SMBs or enterprise companies, allowing easy scaling up or down as needed.

Customer support is good, providing excellent assistance. I would rate customer support an eight out of ten.

Security information and event management solutions were previously used, and we switched to Splunk SOAR to upgrade our security practices since it fits our needs better.

The return on investment is evident through the money saved by blocking various attacks with Splunk SOAR, reducing mean time to respond by fifty percent, and lessening the workload on workers so they can focus on more productive tasks.

I am from the technical part of the organization.

We do evaluate other solutions, but I am not ready to share that information.

I would give Splunk SOAR an eight out of ten rating. In recent times, AI has become influential in cybersecurity applications, although I need to have a thorough look into governance and security, but I am sure that governance and security are both significantly supported by AI capabilities. I advise others considering Splunk SOAR to start small and not attempt to automate full containment on the first day, beginning instead with alert enrichment and notification use cases.

Public Cloud

Amazon Web Services (AWS)

Our primary use case for Splunk SOAR is automation workflows, pairing with Splunk Enterprise Security. We use it extensively with Mission Control to enrich and take automated actions based on findings in the platform.

One of the prime examples of automation coming out of Splunk SOAR is an IP enrichment playbook. When findings are generated in Mission Control, we have an automation rule that kicks off the IP enrichment playbook. It looks for IP addresses in their SIM compliant fields within the finding, enriches them against apps we've set up in Splunk SOAR, such as MaxMind and AbuseIPDB, and then reports the information back to the finding in the form of a note for our SOC analysts to review.

The best feature that Splunk SOAR offers is the no-code/low-code functionality. The use of blocks makes playbook development exponentially easier and removes barriers that knowing Python would have otherwise introduced.

It has made it substantially easier to develop playbooks, both from the time to creation side as well as the overall flow of the playbook seems to work better by using the low/no-code preconfigured blocks. There are fewer errors, less overall troubleshooting, and fewer failures in operation.

The positive impacts of Splunk SOAR are really around time saved from automation workflows. Things that our analysts used to do manually are now being taken care of through automation. This has overall reduced our time to triage alerts, our time to respond to alerts, and our time to fully mitigate anything that comes out of Enterprise Security.

There seem to be some features in meshing with Enterprise Security that are lacking, which were easier to do when Splunk SOAR was the workplace for cases. An example of this is that we want to trigger Splunk SOAR playbooks when actions are taken on investigations. For example, if an investigation is started, we want a playbook to run, or if an investigation is closed, we want a different playbook to run. That functionality used to be somewhat easy to implement inside Splunk SOAR itself, but with the pairing with Enterprise Security, it has become much harder to do. I think some of the connectivity and ease of use between those two could be improved.

I was a user of Splunk SOAR for about a year and have been an administrator for around three to four months.

It has been fairly stable.

We have had no problems with the scalability.

Customer support has been good.

We have not used a different solution before.

We purchased Splunk SOAR through Splunk.

Those issues were handled by a different team. That decision came from above me, so I was not privy to any of the cost or licensing discussions.

I think we have gotten return on our investment, but there are no metrics at this time that we have collected to back up that assessment. It is more tribal knowledge that people are doing less than they used to with Splunk SOAR.

Those issues were handled by a different team. That decision came from above me, so I was not privy to any of the cost or licensing discussions.

We did not evaluate other options. I think Splunk SOAR was the de facto choice because we are a Splunk Enterprise Security customer.

I would advise them to ensure that their tools will integrate and connect with Splunk SOAR so that they can maximize their return on investment. I would rate this product a seven out of ten.

Public Cloud

Amazon Web Services (AWS)

My main use case for Splunk SOAR is automating security events and analyst work to make their job more efficient.

I have set up custom apps for false positive management, authentication exchanges, and integrations with tools such as VirusTotal enrichment and other decision engines I have integrated via apps. Response and containment actions including firewalls, blocks, and host quarantines are also part of this process.

The best features Splunk SOAR offers are ease of use, interoperability with other existing products, and Splunk support.

Splunk SOAR's interoperability helps my team in practice because it is such a significant player in the space that many custom apps get developed for it. Many vendors tend to develop apps for Splunk SOAR. Because of its large size, it offers wide support from other professionals in the security space, including other SIEM operators, CrowdStrike, and identity providers such as Okta. All of that comes built in, and I find Splunk support is quite good generally compared to a brand new product or SOAR that may have equivalent capability but is a relatively new SOAR product.

Splunk SOAR has positively impacted my organization by providing productivity gains and speeding up analyst investigations. Investigations tend to move faster through Splunk SOAR, especially when I can get past administrative hurdles that prevent containment or response actions.

I have suggestions on how Splunk SOAR can be improved. No agent can control Splunk SOAR. If I want to use my Claude agent to instruct Splunk SOAR's playbook builder agent to build a playbook or make modifications across ten to fifteen playbooks, I cannot. A user has to log in and use their human eyes to look at the VPE and then instruct an agent directly. Additionally, that agent does not necessarily have any style guides I can program, nor does it have any memory. If I reload the VPE, I get a brand new thing. It is effectively a small sandbox that requires a human to use, which would have been impressive last year but is not this year. There are also many security service offerings in Splunk SOAR Cloud that are not available on-premises, with the agent playbook builder being a great example of that.

I have identified some limitations and features I wish Splunk SOAR had. Historically, the filter matching has been quite buggy. When looking at matching values that are empty, it is unpredictable whether that counts when the value is not present in a field at all in the artifact I call or if it is present and is a null value. Splunk needs to focus on making sure that is correct.

I wish Splunk would pay more attention to on-premises Splunk SOAR and Splunk SOAR in general.

Splunk SOAR needs to work more on-premises with more features. Cloud-only features feel disappointing to the community, and this is a very regular occurrence with Splunk SOAR. It almost seems Splunk SOAR is on the track to be deprecated for on-premises, with features only being developed or provided for the cloud. For customers at the petabyte level, that really is not feasible. The second level would be that I obviously need Splunk SOAR agents that manage and can be managed by the administrator, giving operating instructions based on roles that the agents interact with. Currently, if an analyst asks for a playbook with a particular appearance, and if finance asks to see something, certain views must be presented in the proper way. Their agents should be capable of doing that, but right now, Splunk SOAR really does not have any agentic compatibility. The only AI it possesses is the VPE editor for playbooks, so there needs to be connectivity, as well as agents that can control different features and software sets. These agents need to be able to communicate with other agents such as Claude or Codex.

I have been using Splunk SOAR since 2018.

My rating for customer service is four out of ten.

False positive management is something Splunk SOAR does very well, assuming I have an experienced operator who knows what they are doing. It is quite good at assigning severities, and many organizations will have custom functions or playbooks that modify severity to better reflect something that is informational or critical. It is pretty robust there.

Splunk SOAR's automation playbooks affect the way my analysts allocate their time during a typical security investigation because they typically are able to spend more time on critical events versus informational or low ones. A good Splunk SOAR deployment eliminates as many obstacles as possible to the analyst decision-making process such that they only really spend their time focusing on key details or key events. Extraneous events are procedurally closed or escalated, and I only pass it to a human when I do not know what to do.

I have realized measurable business outcomes from using Splunk SOAR, including risk reduction, though I have never done metrics on the amount of risk reduced. I suppose I could, based on filtering certain events. Splunk SOAR allowed my relatively small SOC of about eight analysts to punch at the weight of about fifty to sixty-person SOC by way of automation and false positive tuning, achieving eighteen months in thirty days.

My experience connecting existing security tools with Splunk SOAR, including other products in my Splunk or Cisco ecosystem, is positive. Splunk SOAR uses Python to connect to these external apps, and I use the App Wizard to build these integrations. It is mostly trivial to do that, especially in this day of AI.

I would say this is a strength of Splunk SOAR; they do this very effectively.

My advice to others looking into using Splunk SOAR is to take your time, take small steps, and automate use cases you know. Make sure that when you return action results, you save those to individual artifacts with regularly named artifact names and labels so that other playbooks can retrieve these results. If you are a manager, I would say hire an experienced SOC engineer or SOAR engineer to help you walk through those processes. It usually is not reasonable to expect an analyst to use this out of the box; it can be a great way to spend a lot of money for negligible effect. My overall rating for this product is seven out of ten.

I can state this as a Mastercard employee, but not beyond that. Splunk SOAR is used for standard Security Operation Center use cases. We build automations for the Security Operation Center and our scope extends beyond that as well, but primarily SOC is our stakeholder. The Security Operation Center performs certain tasks manually, and we help them automate or optimize their processes by using Splunk SOAR.

Everything comes down to automation. There are two ways to approach it depending on how you use Splunk SOAR as a tool. First, the Security Operation Center performs certain tasks manually, and we build automations for them on Splunk SOAR so that they don't have to do it manually. Second, Splunk SOAR has the ability to run actions where SOC analysts can execute certain actions within Splunk SOAR itself without going to other platforms.

These are the best examples of how Splunk SOAR helps the SOC. It improves accuracy with no errors in work, which a human can do but a rule-based engine cannot. It also saves time.

I'm a first-time user of any kind of SOAR platform, so I cannot compare it to others. What I appreciate about Splunk SOAR is the custom apps feature, which are basically connectors that we can either develop ourselves or find available on Splunkbase or from the Splunk community. With these apps, we can communicate with external systems by calling APIs. Instead of calling an API directly, there is a packaged version of it called an app, which we can use to interact with that external application. The way they integrate is good.

Splunk SOAR does help consolidate networking, security, and IT observability tools for us. This depends on use case basis, but Splunk SOAR has the ability to connect to observability tools like Splunk ES and networking tools like Palo Alto. Even if Splunk doesn't have a pre-built custom app for any new external application, we have the ability to create those apps and connect with external applications. Splunk SOAR allows us to connect to multiple platforms, whether they are networks, security, or observability.

Splunk SOAR has saved us time in threat response, particularly on the SOC side. For example, if they have analyzed something and determined that certain indicators of compromise or IOCs need to be blocked or contained, our tool helps them do it without going into individual platforms. If we decide that we have to block a malicious domain, for instance, they currently have to go into three or four different platforms like Defender tools at the network level or firewall level. With Splunk SOAR, they don't have to do this. We have that configured in Splunk SOAR and it does the job. There are other use cases as well where it saves threat response time.

I feel Splunk SOAR lacks the IntelliSense feature that code editors like VS Code have. This is the feature where when you type a certain variable name, it automatically pops up suggesting what you might want to type, and when you enter a dot, it gives you all the attributes. When we code in Splunk SOAR, we don't have any assistance. We just have to code, execute it, and then we will only know if there were any errors in the code. In code editors, if you have variables written and you refer to that variable again, it gives you the list of attributes it has. If I have defined a variable name as Splunk and I try to type SPL, it will suggest me that variable name so that I don't have to type everything. I can just hit tab and use that variable. This is not available in Splunk SOAR. I'm not sure if it is available in any other platform, and maybe that's the limitation of having a web-based tool, but I think that's important from a developer's standpoint. I develop every day in Splunk SOAR and I know that this feature would save a lot of time for us if it was added.

Beyond that, I haven't seen much of the SOAR world, and Splunk SOAR is the only tool that I use. The development part that I just explained is the thing I think will help us if that feature is added, but beyond that, I don't think there is much else at this point in time.

I have been using this product for two years, two months, or three months.

Splunk SOAR is stable enough. The platform is stable only if you go with their most recommended minimum technical specifications. Although there are certain minimum specifications that they have outlined, if we go for that, we come across some issues. Otherwise, Splunk SOAR is stable enough. However, it depends on how the platform is set up and it will differ organization to organization.

I think Splunk SOAR is a bit slow to catch up with the AI boom. Everyone is ingesting Copilots or some form of AI in their platforms, and Splunk SOAR doesn't have it yet. It should, but it doesn't.

I have had a very nice experience with Splunk's technical support and customer service teams. They're fast to respond depending on the severity of the ticket or issue. If there's any niche issue, then it takes quite some time to troubleshoot. General issues are resolved on the spot and they also have on-demand services available to assist us.

On a scale of one to ten, where ten is the best, I would rate the technical support at eight at least.

Positive

This was the first time Splunk SOAR was implemented in my organization.

From a development standpoint, I needed to have cybersecurity knowledge which I didn't have initially, but beyond that, Splunk SOAR was straightforward to use. It has its own things, but the learning curve is not that high.

I was not involved in the deployment of Splunk SOAR during the initial implementation. It was done about a year before I joined, so I wouldn't know the details.

I would give the advice to make the most use of Splunk SOAR. It is not limited to the Security Operation Center. There are way too many use cases outside SOC which Splunk SOAR can cater to, and it makes life easier. Standard normal automations it can do, and that use case doesn't even need to be related to cybersecurity. If you have bandwidth or resources available on the Splunk SOAR side, you should think of other use cases. To sum it up, know what you need out of the product and understand what it can do beyond your current scope as to why you're looking for that product, and utilize it to the fullest. My overall rating for this product is seven out of ten.

I use Splunk SOAR mainly for automating SOC operations and incident response workflow, and I integrate it with Splunk and Splunk ES. I have EDR tools, firewall logs, and Microsoft email, so I use it for email security. I have integrated it with my ticketing management service, ServiceNow, and most of my use cases are related to phishing investigation, brute force attacks, malware alerts, threat activity, suspicious login activity, and vulnerabilities from recently released software. Whenever an alert is triggered from Splunk or ES, Splunk SOAR automatically starts the playbook I have configured and gathers the logs to check against the threshold limit I have defined or enriches data with external services using Splunk SOAR playbooks. I then create incidents or take remediation actions according to the scenario or incident. This reduces the manual work of my SOC team.

In threat response, Splunk SOAR saves time. For example, with email phishing, it does save time, and for other situations like when I receive simultaneous IP hits from DDoS attacks, it will automatically detect that and send a message on Slack that this IP is hitting this machine at this rate based on the second or minute. I just need to confirm whether I want to block it or not. If I send yes, then it would directly block it into my firewall rules so that this IP should be blocked for this minute or something similar. Splunk SOAR is really saving my time. I can identify directly where this IP came from and whether it is from China or any part of the country. I detect or enrich the data using a playbook, and it saves a lot of time for SOC where actual SOC investigation is not needed. It plays a really good role.

In Splunk SOAR, playbooks provide a very key role in automation. I can enrich my IP, domain, and hashes or integrate it with other third-party tools like Slack or ServiceNow. I can send an email to the user or block a particular IP into my current firewalls and automate that using a playbook. The most valuable feature for me is playbook automations. There are pre-built playbooks, and I can build my own custom playbooks that speed up my incident response. Most of the time I am getting phishing mail, and then it is not necessary that I am already blocking that phishing mail since I do get newly phishing mails every day. I have written playbooks that will automatically define a rule at my email security that this phishing email I got is blocked. It is something I like most.

Apart from this, app integration and case management are valuable. The custom functions features that Splunk SOAR provides, such as Python custom functions, are also valuable. Engineers can easily write their rules or define their logic. Splunk SOAR saves time in threat response. As I have given the example about email phishing, it does save time there, and for other situations like when I receive simultaneously IP hitting from DDoS attacks, it will automatically detect that and send a message on Slack that this IP is hitting this machine at this rate based on the second or minute. I just need to confirm whether I want to block it or not. If I send yes, then it would directly block it into my firewall rules so that this IP should be blocked for this minute or something similar. Splunk SOAR is really saving my time. I can identify directly where this IP came from and whether it is from China or any part of the country. I detect or enrich the data using a playbook, and it saves a lot of time for SOC where actual SOC investigation is not needed. It plays a really good role.

I do not think there is anything currently, but as I grow, I can answer better on that. I can just expect some more integration from Splunk. There are vast possibilities to integrate with tools, or I can build my own custom solutions. I will be looking for more supported integrations from Splunk rather than depending on third-party solutions.

I started with a smaller environment and then I scaled up to the state that I am currently in.

In my environment, Splunk SOAR is pretty much stable. I have not faced any major issues. However, I have other services running on the same system that are causing Splunk SOAR issues. I am doing that to separate it out on a different machine.

I was analyzing what tools were available, but I have not found any other tools that were better for me because I was using other Splunk products. It would be great to have a Splunk product, and I went with Splunk SOAR.

As of now I am good with the overall guessing or remediation.

I was analyzing what tools were available, but I have not found any other tools that were better for me because I was using other Splunk products. It would be great to have a Splunk product, and I went with Splunk SOAR.

Deploying Splunk is very straightforward for me because at the time I was implementing it, my environment was small and I was just integrating two or three modules. It was very straightforward for me and the documentation helped me a lot to configure it. I have not faced such a high issue due to the Splunk community, which has a very active community, and I was able to find my answers there.

If it had impacted my system at that time, I would have needed to call my employees to please come online and try to see what is happening, but that was really saved by Splunk SOAR. Calling an employee on leave is not a good option, according to me.

That is managed by someone else in my team, and I will not be a good person to answer that. I was in talk with my team that whatever I am paying for Splunk SOAR and the licensing I have purchased is really in terms of a benefit to me. It is way below what it costs to hire some professionals to do only that type of work. It is very low and I get more control over my systems.

I was analyzing what tools were available, but I have not found any other tools that were better for me because I was using other Splunk products. It would be great to have a Splunk product, and I went with Splunk SOAR.

I rate Splunk SOAR a nine out of ten.

On-premises

Other

Splunk SOAR serves as our main security automation and response platform, functioning as a central nervous system for our SOC to enable security analysts to ingest alerts and automate repetitive tasks through the platform.

A specific example of a repetitive task we are automating with Splunk SOAR involves any phishing-related attacks, spear phishing, or incidents that pertain to malicious URL clicks or opening of malicious attachments.

In terms of our main use case, consolidating logs from various sources is another critical function we perform, such as getting syslogs, SNMP logs, or audit logs from various endpoints, including Active Directory authentication-related logs, Cisco switches, and Palo Alto logs.

Integration has made our operations significantly easier, and for phishing investigations, IP checks, and endpoint isolations, our response time to incidents has reduced substantially, and false positives are identified much quicker because of Splunk SOAR.

Our response times have improved by at least 25 to 30 percent.

In my experience, the best features Splunk SOAR offers include playbooks, which are beneficial because they have thousands of pre-built app integrations with automated actions across EDRs, firewalls, and identity platforms including Active Directory and Entra IDs, and they can establish connections with email gateways and ticketing systems such as ServiceNow.

The playbooks and app integrations have helped my team by supporting a modular playbook architecture, which allows us to use reusable playbooks such as IP enrichment and containment actions within larger master workflows, and it also enables us to create basic tasks.

Splunk SOAR has positively impacted my organization, and our response time to incidents has reduced significantly, while false positives are identified much quicker because of Splunk SOAR.

In terms of improving Splunk SOAR, it is challenging to identify areas, but it is not purely a no-code solution and it needs a much better IDE platform where things are simplified, so that someone who does not have much understanding of Python or coding languages can do the work, and the cost is another factor since it is a costly platform.

I cannot think of anything else needed for improvements, such as integrations or scalability.

I have been using Splunk SOAR for a year.

I have realized measurable business outcomes such as risk reduction from using Splunk SOAR, and the response time has improved significantly.

If you are already running a Splunk enterprise environment, I advise you to use Splunk SOAR because it integrates well, has playbooks, better API capabilities, and integration is more viable and doable than with any other platform, and that is my perspective at a high level. I would rate this product seven out of ten.

On-premises

I don't have much hands-on experience with the solution. While I understand its capabilities regarding logging and reporting, I haven't had much direct involvement. The administration is handled by teams within the organization, including our SOC team and the managed security tools team. Our cybersecurity engineers are responsible for managing those aspects.

We receive reports that track user login activity. We get SOAR reports based on this activity, which inform us when someone hasn't logged in for a certain period of time. Our SOC analysts monitor alerts and investigate them. Sometimes, I need to review the information they send me to validate findings and determine whether there is any malicious activity or if it's just natural behavior within our environment.

While my primary role doesn't involve monitoring alerts, I do receive external reports from the system. Occasionally, I need to investigate tickets related to alerts. This involves working with engineers, cloud engineers, or system administrators for the flagged systems.

We aggregate data from sources such as CloudTrail and CloudWatch to provide a comprehensive view of activity across the entire environment. We maintain an enterprise cloud setup where we host our customers. The SOC has visibility into everything happening within the system and monitors external components as well, such as internet-facing elements. This allows them to detect any malicious activity or unauthorized access attempts to the network.

I don't have the metric on the time saved. However, I do see that the SOC team receives a lot of reports. I’m not sure of the exact number, but it’s like hundreds of thousands of alerts every month. A single person couldn't go through them all. Fortunately, the system helps to parse through these alerts and determine which ones are important and need further investigation.

It organizes the alerts in a way that makes it easier for the team to go through them. They wouldn't be able to manage that volume without some organization in place.

It has helped improve our organization’s business resilience. I believe we are currently preparing for a security assessment, and Splunk may be collecting some performance data as part of that. This data might be coming from our performance monitoring system, but I need to confirm. Overall, Splunk provides a wealth of information. Our performance monitoring tools detect high CPU utilization, monitor storage, and identify any abnormal activity in the environment. Additionally, some of our tools have machine learning capabilities, which I find very helpful.

It has some automated features, including alerting and the ability to set up notifications for different entities. This ensures that we are informed of any activity related to user accounts or privileged accounts. It helps identify instances where an account is not being used or when someone has left the organization, making it unnecessary to manually look up accounts. The integration of automation in the SOAR capability enhances this process. The automation reduces the need for manual searches. 

I'm not an expert on Splunk SOAR, but I'm sure our team members know what areas could be improved. I haven't spoken to them specifically about what could be improved or what they would want Splunk SOAR to improve.

We have been using this solution for about five years. 

It's been pretty reliable. I get some alerts as a security lead when there are auditing failures. We get a few of those occasionally, but it's not a common issue.

I haven't interacted with them directly, but the team has said their support is really good.

Positive

I do not have any experience with deploying Splunk SOAR. I know that the solution we’re using is cloud-based and hosted in a SaaS environment. Our team deploys agents and sets up the configurations for reporting. I can’t really speak to how complex the setup process is, but our teams could take advantage of or leverage the service.

I would rate this solution an eight out of ten.

We have been using Splunk SOAR for analyzing threats and mitigating issues in cybersecurity. We provide input and SQL queries to Splunk SOAR, which analyzes the data and provides information on whether an IP address is legitimate or if it is a bot.

Splunk SOAR is user-friendly, and the SQL language inputs are intuitive. It provides precise information about what you are searching for.

I have used a couple of other cybersecurity tools in comparison. Splunk SOAR is more user-friendly than those tools and provides more precise and advanced information that we require to analyze whether a case is a true positive or false positive. It improves accuracy significantly.

Sometimes it lags when I am working on multiple things. Apart from that, every feature is useful.

Integration is an area for improvement. I would say it could include some other features that are present in IBM QRadar, which would be really helpful.

I have been using Splunk SOAR for around five years.

Sometimes it lags when I am working on multiple things.

Its scalability is really good.

The customer service is excellent. They are responsive whenever I try to reach them.

Positive

The solution has resulted in money saved.

Splunk SOAR is a very good application and a great tool to start your work with in cybersecurity. It will provide you with deeper investigation capabilities. The SQL language and other features will help you learn more. Compared to IBM QRadar, Splunk SOAR is a really excellent tool. I would rate this product an 8 out of 10.

Private Cloud

Other

My main use cases for Splunk SOAR are automating security response and incident response. We use Splunk SOAR for phishing campaigns and detecting any kind of malicious viruses or anything similar that is in the organization. I can provide examples of how these features benefit my organization.

The features of Splunk SOAR that I appreciate most are the integrations with all the other applications and tools. The consolidation of tools greatly impacts my organization since I have everything all in one place, which is great. 

It has saved me time in threat response since we had no wait time in threat response. Splunk SOAR has helped improve my organization's business resilience. 

My impressions of Splunk's ability to predict, identify, and solve problems in real-time are very impressive. Doing everything in real-time provides us with the best actual notifications and alerts, which really helps us a lot.

I haven't gone too far into it to see anything that needs improvement yet. We can likely include some features related to the integration with on-premises resources, rather than focusing solely on the existing automation. 

These are the additional features that could be included in the future. Splunk's Unified Platform does help consolidate networking security and IT observability tools. They should integrate Splunk Enterprise Security better into Splunk Cloud.

I have been using Splunk SOAR for a year.

The reliability of Splunk SOAR is definitely there. The stability depends on how much we scale, which is something we can determine at a later point. We have not experienced any downtime, crashes, or performance issues.

Splunk SOAR has the ability to scale quite significantly. Our organization's needs are very low, so we can't really measure the scaling. I know that it has that capability. We have not expanded usage, and the process has not been smooth.

I would rate customer service and technical support as an eight out of ten. The resources are largely community-based, which makes it more difficult with Splunk SOAR. 

While support is available, the resources around Splunk SOAR are more homegrown by other users, and discovering different troubleshooting methods is harder to do with Splunk SOAR than with Enterprise Security or other Splunk services.

Positive

Before implementing Splunk SOAR, my team used tools such as VirusTotal, hybrid analysis, and other open-source tools for detection. That's how we guided our SecOps team in performing security investigations.

In terms of deployment, there were no issues. It was pretty seamless. Some areas around the automation broker gave us a few hiccups. Otherwise, it's a seamless deployment.

We have seen ROI with Splunk SOAR. Our ROI is evident in our phishing campaigns and in detecting phishing alerts. We've seen a decrease in false positives and a significant increase in our containment.

I don't have experience with costs; management handles that aspect.

I would rate Splunk SOAR overall a nine out of ten. 

The advice I would give to other organizations considering Splunk SOAR is that if you have the license, use it; if you don't have it, find a use case for it and implement it. 

My company does not have a business relationship with Splunk other than being a customer.

Public Cloud

Regarding Splunk SOAR, we are using it for log collection only. The main use case for Splunk SOAR is addressing security incidents.

Splunk SOAR has helped to improve my company's business resilience.

In Splunk SOAR, the functions and features I have found most valuable are SPL, dashboard, and reports.

The main benefits I have received from Splunk SOAR include it being easy to use and function, the alert configurations being easy, and third, they are valuable.

It saves my time in case of threat response because Splunk is very beneficial.

I can share a success story where the Splunk SOAR automation process helps us save time. For example, the schedule reports and schedule searches are helpful for us in making automated reports.

For points of improvement, I can see that other solutions like XSOAR or XSIEM have enhanced AI features, and I understand if Splunk may add some AI features.

The gap for improvement I see is response time because it takes a lot of time to have a response from them.

Regarding security functions, I do not have any suggestions.

I have been using Splunk SOAR for five years.

For stability, I would rate Splunk SOAR an eight.

For scalability, I would rate Splunk SOAR a six or seven.

My mark for Splunk technical support is six.

The initial setup for Splunk SOAR is easy.

For pricing, I would rate Splunk SOAR a seven where one is high price and ten is low price.

I can compare Splunk SOAR with QRadar and IBM QRadar.

Currently, I am still working with Splunk in the SOC. I am mostly working with Azure for the deployment process. Regarding my clients, we are just using it for a SIEM tool. I am working in SOC, and for the past two years, I have been using Splunk for the SIEM tool only as a user.

Before that, I was using it for administrator purposes as well, developing the SPLs, alerts, reports, dashboards, and making configurations. Currently, I am just a user.

I cannot mention a recommendation because right now I have been in other tasks, so I may not be able to clearly explain or give feedback.

Definitely, I will recommend the product to other users because I was using Splunk SPL, which was very easy to understand. Right now I am using XSOAR, which has some aspects that are hard to understand, and I am also using CrowdStrike. Compared to Splunk SPL, these are harder because SPL is easy to understand and easy to learn.

My overall review rating for Splunk SOAR is eight.

Public Cloud

Microsoft Azure