Splunk SOAR Reviews

We agreed to speak about Splunk SOAR this time.

I have worked with Splunk SOAR since 2025.

I work with Splunk SOAR as an integrator.

Splunk SOAR is used for cyber security or security operations relative to cyber security, SOC, DevOps, or where security is more important than other things, such as banking and insurance.

Splunk SOAR consolidates tools in my environment significantly, notifying users about ongoing malicious activities based on integrated security features in my banking app.

Before implementing Splunk SOAR, we did not utilize any enterprise solutions but integrated security features in our applications with our own antivirus and log provider.

It substantially improves business resilience as it helps predict, identify, and solve problems in real time, providing significant security to systems against various threats.

The biggest advantage I see from my personal experience as an integrator with Splunk SOAR is that it integrates with most of the security features among the Defenders, Microsoft Defender, firewalls, CloudWatch, and AWS security agents, as well as EC2 machines, firewalls, EDR, IAM, email security, and antivirus. It automates the security process over phishing emails and any other brute force attacks. It helps quite a lot because if 100 phishing emails were sent to a domain, a developer can only reach one, two, or five, but for hundreds of others, it actually supports better automated playbooks and provides major security.

Splunk SOAR introduced some new and innovative capabilities or approaches that transformed the way my SOC operates.

Splunk SOAR provides playbooks for automatic security features, such as for firewalls, phishing mails, and utilizing Defenders or virtual tools. A playbook maintains its algorithms or processes, so if any kind of security issue arises, the playbook automatically runs and handles actions such as IP blocking or resolving brute force attacks, notifying the admin about suspicious users.

After implementing Splunk SOAR, the training process for my SOC team to use playbooks takes a long time during the whole integration part, as it retrieves all credentials from us, whether for an EC2 machine or any antivirus. It takes about one to two months for the team to fully sustain and know the processes of the playbooks and security, particularly for three or four individuals in the cyber security or DevOps team.

Splunk SOAR significantly reduces the time spent on monotonous security tasks. In banking, insurance, or healthcare, automated services for addressing phishing emails and security threats are common. Having a manual workforce of two or three individuals can only handle five or ten security threats while Splunk SOAR automates the entire process across apps and machines, making it easier and notifying the admin about the threats.

If someone tries to breach, Splunk SOAR immediately processes incoming requests, validating them and blocking any unsecured requests, which reduces a lot of time and effort.

With the help of the playbook viewer, I assess the visibility provided by Splunk SOAR as very positive, especially for security purposes. If someone is attacked by 100 users, it blocks all the users, while individual developers such as myself can only handle two or three at a time. The automated process of Splunk SOAR handles all the processes concurrently, making it a game-changing solution.

It helps reduce mean time to resolve (MTTR).

It takes around 10 to 20 minutes to resolve one incident through the whole process and notify the admin of the issue. If there are multiple incidents, calculating the time taken for each, it generally requires around 40 to 50 minutes to resolve five incidents.

They should elaborate on existing features or add new ones. They provide good documentation on all their features, and any new features will come with corresponding documentation and support.

They should add an AI assistant to automate the entire process, summarizing it for the admin, which will ease debugging and re-implementation, providing robust security features against future incidents.

The installation of Splunk SOAR is complex, requiring integration with various tools such as CloudWatch, antivirus, and EC2 machines, making it difficult.

I have worked with Splunk SOAR since 2025.

I would rate the solution at about 97 to 98 percent stable; it can resolve threats but needs to operate faster, possibly by integrating an AI assistant.

It is easy to scale as it provides many integration tools.

I have reviewed its documentation, which covers many integration details. I have not yet contacted customer service, but I have seen good reviews regarding guidance and support.

Before implementing Splunk SOAR, we did not utilize any enterprise solutions but integrated security features in our applications with our own antivirus and log provider.

The installation of Splunk SOAR is complex, requiring integration with various tools such as CloudWatch, antivirus, and EC2 machines, making it difficult.

It is a good investment and effectively reduces threats and major incidents for security purposes, thus is beneficial for major industries such as banking and cyber security-related issues such as DevOps.

There are many competitors such as IBM QRadar SOAR, FortiSOAR, Science, and D3 Security, but I used Splunk SOAR directly for our consent project without exploring competitors due to cost considerations.

It is a hybrid model, using EC2 instances for deployed applications and utilizing antivirus on the machines.

We use Azure.

I believe the pricing varies depending on our use case. Although the consent project is moderate, it becomes quite expensive for banking solutions due to covering around seven to eight products.

Splunk SOAR makes it easy to visualize and troubleshoot my cloud-native environments by providing dashboards to analyze and manage.

It saves time in alert triage, directly notifying the admin of security issues in the apps within milliseconds, around 200 to 300 milliseconds.

It also saves time for threat response.

I would rate this review an 8 out of 10.

I work with Splunk SOAR as well. We mostly use it for phishing-related use cases, brute force-related use cases, and port scan-related use cases. There are many other use cases beyond these three that we utilize. We have ID sweep-related use cases, threat activity detected related use cases, a ransomware use case, and a malware use case. We use Splunk SOAR for plenty of use cases to automate their resolution and response.

From my perspective, the best thing that I perceive with Splunk SOAR is where it is able to consolidate the data from the different log sources, and that helps me to investigate any incident. I am ingesting from multiple log sources. If there is an incident that has been logged, I will have visibility about all the different data that are required to investigate that incident in the single pane. In the single dashboard, I should be able to visualize it. I am able to see what has happened with this incident and what action has to be taken. Automatic recommendations also come from Splunk SOAR. These are the few things that we value very much on a day-to-day basis.

Splunk SOAR has improved our MTTD and MTTR both with the consolidation with a unified platform with Splunk. Mean Time to Detect and Mean Time to Resolve were trending high before Splunk SOAR. Once we finalized and fine-tuned Splunk SOAR platform, it started trending within the limit that is defined for our organization. That's the first thing. The second thing that we have started observing is that there used to be a quality issue when it comes to investigating the incident. If an analyst investigated by looking at and correlating the data from the different sources, they always tended to make some mistake where they were overlooking some of the aspects for the incident investigation. We have improved this a lot. Since we have Splunk SOAR, where things are being automated and we are able to visualize things, we have zero or maybe no chance of missing things. That is helping us to improve the incident investigation quality. These are a few things that I will call out that has helped and that are helping on a day-to-day basis.

One thing that we would like to see with Splunk SOAR is the expandability to the threat intelligence feed. Currently, we have limited ingestion to the threat intelligence feed for the correlation purpose. We would like to see it being integrated, with license cost or without license cost, to leading threat intelligence sources such as Recorded Future, Feedly, or Flare. That is something we would appreciate having integrated. The second thing on the improvement side is about exposed credential-related information. If we start ingesting those data to Splunk SOAR or SIEM with some sort of integration with threat intelligence feed, that will also improve our detection and prediction method or help us with the investigation.

I have been working with Splunk SOAR for the last three years.

We have not experienced stability issues. We are always notified if there are any maintenance activities. The impact would always be minimal. We have not seen any impact in the work that we do with Splunk SOAR or the SIEM platform. I would rate it at 99.9 percent.

We have not experienced scalability issues as of now, but there is a plan where we should be able to expand the usage of Splunk SOAR soon.

Splunk's customer service and technical support teams are being helpful. Sometimes if they are not able to decide where the resolution should happen, we always have a customer support representative who will come in the picture and help us to direct any ticket or any issue that we are facing to the right team. I would rate eight on a scale of one to ten for the overall technical support of Splunk.

Positive

It used to be Splunk SIEM only, the simple SIEM solution before implementing Splunk SOAR. It was not open source.

The setup was smooth because we used to be a Splunk shop itself, so we just had to add Splunk SOAR on top of it. It took a couple of weeks to get everything running. There wasn't much hurdle that we had to go through. The only thing we had to focus on was automating the workflow where we had to attach the response plan and the fine-tuning in a few cases. That was something we had taken as part of business-as-usual activity.

Splunk SOAR has saved us a lot. Monthly, around 300 hours of effort, it is saving with Splunk SOAR. We used to have a large team. It is not about only hours that it has saved, but it has saved cost from the cost point of view. It has helped us where we were able to run the SOC operation with the less number of headcount versus what we used to do earlier. 300 plus hours per month it has saved, as well as from the headcount perspective, it has saved us on the costing.

I am familiar with the pricing aspect, setup cost, and licensing cost of Splunk SOAR, and it is pretty much similar to what industries are offering these days. We never had any issue when we had to set up this Splunk SOAR platform. We got all the help from the Splunk vendor itself. They had their team members come in and implement all those things. That's where we are running it from the last couple of years.

It used to be Splunk SIEM only, the simple SIEM solution before implementing Splunk SOAR. It was not open source.

Recently we had one malware alert where something occurred and we had multiple malware alerts from one system that was sent and the SIEM had flagged about it. That specific alert immediately, once Splunk SOAR started to take action, it was able to flag a recommendation and the next step. That basically helped team members to immediately contain the system and resolve that incident. Within one hour we were able to figure out what had happened and what the impacted system was that was generating the malware alert, and we were able to contain that system.

Skill-wise, we have been getting recommendations on the different training on a time-to-time basis with Splunk SOAR. We used to connect with the account manager as well where they used to facilitate or propose some of the sessions that our team could attend, so that has also been very improving and beneficial for the team.

Splunk SOAR has been helping us in terms of detecting and helping us to investigate the security alerts. We have been very much satisfied with how well this platform has been helping us and helping us to see our full infrastructure with Splunk SOAR.

The playbook integration and automation of the workflow would be something one can plan in advance regarding Splunk SOAR. Given that it had taken a lot of time and required fine-tuning, if one can focus on that aspect before even initiating Splunk SOAR, then that will ease the things once Splunk SOAR will be in operational mode. My overall rating for this product is seven out of ten.

I started working with Splunk SOAR four years ago. I provide Splunk SOAR solutions to our customers as an MSSP. We work with two customers that have different solutions. They have defense-in-width with Trend Micro, Vision One, CrowdStrike, and Windows Event Logs, and all those logs are pushed into the firewall and Zscaler. All the logs are being pushed into Splunk, and we correlate all the logs, perform automation with those logs, integrate threat intelligence, and act on the notables that we get.

One of the biggest advantages is that since we are working with two different products—one is the enterprise solution and the other is Splunk SOAR—the SOC analyst effort is reduced at a huge margin when using Splunk SOAR. The response time and effort with the enterprise solution is less compared to Splunk SOAR. We have alerts generated, those alerts investigated, and all the correlation clubbed together, giving us the notables, which makes investigation quite easy. For example, in the enterprise solution, we may not have threat intelligence integrated, but with Splunk SOAR, we have two threat intelligences integrated—one is Cisco, and the other is VirusTotal. If there is an IOC found in their database, it clearly gives us a trigger, indicating this seems to be a true positive incident. This reduces our effort in the enterprise solution, as we usually need to check IPs manually, whereas in Splunk SOAR, we already have those results. If the enterprise solution takes 15 to 60 minutes, Splunk SOAR takes approximately less than 10 minutes.

The consolidation of tools does not have any negative impact. I found it very useful when it comes to Palo Alto, VirusTotal, and all the other threat intelligence platforms. It is very important and conclusive for us. We have integrated Cisco and VirusTotal, and these are quite helpful.

One particular example I can recall is that in enterprise, we get around 100 to 200 notables daily, which consumes approximately 16 to 40 hours per day for an analyst. Since we have Splunk SOAR, it is now just about five to seven minutes or five to 10 minutes per alert. Initially, we had a small team of around 17 members working on different products, and it was quite difficult to manage with the enterprise solution. When we onboarded Splunk SOAR, we effectively managed it without additional workload pressure or headcount. When it comes to a specific incident, for example, if there is an incident from Defender, in the enterprise solution, we need to log into Defender, open the incident, check the risk level, associated entities, sign-in logs, and also check the IOC in VirusTotal. With Splunk SOAR, about 70% of the information will be available here, so there is no need to navigate multiple platforms.

I am working with both Splunk SOAR and Splunk Enterprise Security. The biggest advantage I have found is that the SOC analyst effort is reduced at a huge margin when using Splunk SOAR. The response time and effort with the enterprise solution is less compared to Splunk SOAR. We have alerts generated, those alerts investigated, and all the correlation clubbed together, giving us the notables, which makes investigation quite easy. For example, in the enterprise solution, we may not have threat intelligence integrated, but with Splunk SOAR, we have two threat intelligences integrated—one is Cisco, and the other is VirusTotal. If there is an IOC found in their database, it clearly gives us a trigger, indicating this seems to be a true positive incident. This reduces our effort in the enterprise solution, as we usually need to check IPs manually, whereas in Splunk SOAR, we already have those results. If the enterprise solution takes 15 to 60 minutes, Splunk SOAR takes approximately less than 10 minutes.

When it comes to Splunk SOAR, in terms of improvement, I feel there should be some pre-deployed solutions available. If we want to enable Splunk SOAR capability, we need to process some playbooks and look at the process behind it. CrowdStrike provides pre-fetched information which we can pick up and schedule accordingly, making it easier. This aspect requires a bit of improvement, as the onboarding process for Splunk is quite demanding. It might happen that we design an automation that results in alert fatigue or multiple false positives because we are human and not 100% accurate. These issues need to be predefined. CrowdStrike and Trend Micro show fewer false positives compared to Microsoft, which has more. We also spend a lot of time on integration efforts, so a simpler way to integrate multiple log sources should be improved.

Pricing depends on how much we are consuming. When it comes to log sources, it can be expensive.

I have been using Splunk SOAR for four years in total.

Latency does exist, but I would not say it is 99% stable. I would say it is about 95% stable.

The solution is highly scalable. This is one of the biggest advantages of Splunk.

The customer service from Splunk is fine but not exceptional. I would not say they are down or very good; it is okay. I would compare it to Microsoft. They do take time, but they do provide a clear and complete resolution. I would give them an eight for support on a scale from 0 to 10, with 10 being the best.

I would not say Splunk is the leader. I prefer CrowdStrike, and the least expensive option is Microsoft Sentinel.

It is a bit complicated, not that easy when it comes to the installation part of Splunk SOAR.

According to me, I would rather consider some different solutions. In cases where a customer has multiple log sources, like the one with approximately 20 different vendors, it works well for them. But for vendors with four to five log sources, or maybe up to 10, it can become quite expensive.

We do not use Google Cloud as of now; we are fetching logs from AWS and Azure, two different cloud providers. We mostly use AI tools like Copilot when we get stuck.

From my perspective, there is no impact on the level of expertise and training needed to perform incident investigations because I probably have enough experience.

I have not worked with Splunk Observability Cloud for application performance monitoring yet, although I have heard about it and am yet to explore it. I am using Trend AI Vision One. I recently attended a workshop on it.

I would give this review an overall rating of 9 out of 10.

Splunk SOAR is used for internal company operations. One of the best use cases implemented in the last three months with Splunk SOAR is automated phishing triage. Before using Splunk SOAR, if a user reported any suspicious mail, I had to manually extract IOCs such as URLs, file hashes, or IPs and then jump between a Threat Intel platform to check their reputations. It was a repetitive and time-consuming process. Now, we have a playbook that handles the initial heavy lifting. As soon as a suspicious mail is reported, Splunk SOAR automatically parses the email and extracts all the artifacts and cross-references them against our threat intel source.

The biggest valuable feature of Splunk SOAR is the integration ecosystem. Since we have used a mix of tools such as SentinelOne and Splunk, having a SOAR that connects seamlessly with everything is huge. The visual playbook editor is quite user-friendly, allowing us to map out logic visually instead of writing complex code.

Splunk SOAR has helped a lot for my team in prioritizing and responding to security alerts and incidents. Better documentation for troubleshooting has been valuable, while documentation is challenging work for us, and it can be difficult to find clear, step-by-step solutions. I would love to see a larger library of production-ready playbook templates.

The impact of implementing Splunk SOAR's automated playbooks on my security analysts' daily workload and responsibilities has been a game-changer for our SOC visibility. Before, we were dealing with large amounts of data, and I could spend way too much time manually piecing together what happened on the endpoint by jumping between different tools. Since we implemented Splunk SOAR, the correlation pulls all those different data streams into a single comprehensive timeline. I have the context I need right there on the screen. My Mean Time to Respond has dropped significantly because I'm no longer chasing false positives or alert noise.

Splunk SOAR has helped a lot to reduce my Mean Time to Resolve.

I have found a challenge in my three months with Splunk SOAR in that it is quite a heavy tool to maintain. It's definitely not a set it and forget it situation. Playbooks require constant maintenance and upkeeping. For example, if the API for one of our integrated tools changes or gets updated, the automation can break and I have to jump in to fix it.

I am satisfied with the customization and management of Splunk SOAR playbooks in my environment. Right now, the learning curve to build complex logic from scratch is a little difficult for beginners. However, the templates for common threats are easier to customize.

The use of Splunk SOAR's automation playbooks has improved how my analysts allocate their time during a typical security investigation. We don't need to see small alerts, and two analysts no longer might handle the same type of alert in slightly different ways. Now every alert goes through the same automation steps such as checking threat reputation or pulling endpoint logs every single time. It eliminates human error because I am not missing a step when I'm rushing or dealing with a high volume of alerts. It's basically given me a force multiplier. The playbook handles the boring and repetitive parts, so I can actually focus on the complex incidents that really need human insight.

There is a need for improvement in terms of using advanced terminology.

I have been working with Splunk SOAR since the last three months.

In terms of stability, overall the stability in the three months I have been using Splunk SOAR, we handle a constant flow of alerts throughout the day. The platform handles that workload without any major lag or crashing. The playbooks execute reliably every time, which is critical because if an automation tool is unstable, it just creates more work for us to verify if an action actually finished. I haven't run into any stability glitch or unexpected downtime, so I have been really confident in its ability to process our triage requests without needing any constant monitoring.

For now, we didn't encounter any challenges or limitations with Splunk SOAR. The scaling has been impressive. Since we have been using it at our organization, I have seen that the platform is built to handle enterprise-level workloads without breaking. In my three months of using it, even as our alert volume shifts or we add more playbooks to the system, the system has remained stable with lots of playbooks and other operations going in the backgrounds and backends. I really appreciate that it supports scaling. As our SOC grows, our SOC team grows, and we need to process more data or more concurrent automations, the architecture is designed to handle that load.

It has a lot of scaling capability. As I said earlier, it has improved a lot in our organization. Scaling as a junior SOC analyst isn't just about doing alerts faster; it's about shifting from being a consumer of a SOC tool to an architect of its efficiency. It is good in scaling.

We have a support team for Splunk SOAR that communicates any technical faults we encounter to the Splunk technical support.

The technical support experience with Splunk is quite good. If we get into a problem, the technical support experience is a bit good in my experience.

The support is generally a bit complicated for someone who is a beginner or new to this product to understand the scope, initial deployment, or any query regarding it.

We did also use Shuffle for a SOAR tool before Splunk SOAR.

We decided to switch from our previous solution to Splunk SOAR because Shuffle has some limitations and it doesn't have many features that Splunk provides. It is a little more complex to learn.

I was a little bit involved in the deployment part of Splunk SOAR. From that point of view, the deployment wasn't exactly plug and play, because we integrated it across our existing stack, such as our SIEM and EDR. That's a fair amount of configuration involved in it, especially getting the API keys and authentication set up correctly for each connector. It's not something you can just spin up immediately. Once the core architecture is in place and the connectors are mapped to our environment, expanding it to new playbooks is much easier.

I am satisfied with the customization and management of Splunk SOAR playbooks in my environment. Right now, the learning curve to build complex logic from scratch is a little difficult for beginners. However, the templates for common threats are easier to customize.

We decided to use Splunk SOAR because it's a powerful, reliable engine that has significantly improved our SOC operations, especially in terms of incident response time and scaling features. It's an essential tool for enterprise environments.

Our team recommended us to use and learn about Splunk SOAR, so that's why I got started with it. I really appreciate this tool because it gives us very practical knowledge about the enterprise Splunk SOAR product. I provided this review a rating of 9.

In our SOC environment, Splunk SOAR is primarily used for security tasks and repetitive security tasks. Common use cases include phishing email investigation, IOC enrichment, malware investigation, IP and domain reputation checks, and ticket creation. Whenever alerts come from a SIEM tool, Splunk SOAR automatically gathers that information from different security tools and provides analytical and required context. This has helped to reduce our manual, repetitive tasks.

For business resilience, Splunk SOAR significantly improves our incident response process. Whenever we raise a ticket, we have to follow up with the team or client to determine whether it's a true positive or false positive, or if any action has been taken. Since we have integrated with multiple devices such as firewalls, AWS, switches, routers, and servers, we can directly perform mitigation tasks from our side. We only need to integrate the client server to Splunk SOAR technology through playbooks. Playbooks help very well for our organization.

We are using two products: Shuffle SOAR and Splunk SOAR. Compared to Shuffle SOAR, Splunk SOAR's integration is very easy for multiple security tools. The second valuable feature is the playbooks and how they are very organized with standard playbooks available for incident response. Third, the visibility is very good in Splunk SOAR. These are the three things I value the most.

Splunk SOAR helps a lot with consolidating our networking, security, and observability tools. We are saving almost 200 hours compared to not using Splunk SOAR. As repetitive tasks are generally performed by our L1 team, we are saving most of our valuable time compared to the manual approach. This time is now used for investigation purposes, such as when incidents occur or when ransomware or malware attacks happen, rather than doing the same manual tasks repetitively.

The price of Splunk SOAR is high. From a price perspective, the cost for an organization is very high. The documentation and playbooks can be better. For all integration partners, not all tools are integrated with Splunk SOAR technology. Documentation and costing are two important factors that could be improved.

I have been using Splunk SOAR for one year.

I rate Splunk SOAR as nine for stability. Stability-wise, it is good. There have been no issues or errors.

Scalability depends on the integration part for Splunk SOAR. I would rate it as nine. It depends on the integration part: how many alerts there are, how many devices there are, and how we integrate those devices with Splunk SOAR technology.

I rate technical support for Splunk SOAR as eight.

Splunk SOAR is very easy to deploy. The initial setup is very easy. Multiple playbooks are available for repetitive tasks. We generally follow these for repetitive tasks. The use case design is very easy for a beginner level. However, if you want to integrate with other devices, vendor documentation is required for that integration part. For initial setup, Splunk SOAR is very beginner user-friendly for repetitive tasks.

We do not calculate ROI formally, but based on my knowledge, we can say there is a 40% return on investment with Splunk SOAR. Not every alert is generally raised to the client. We primarily raise tickets from repetitive tasks through Splunk SOAR technology, not for incidents or malware or ransomware. The time savings also contribute to the overall value.

Shuffle is open source and also good, but it has a limited scope. Splunk SOAR has a larger integration ecosystem. Shuffle SOAR is very good, but compared to Splunk SOAR, it is not as comprehensive. Scalability-wise is also better with Splunk SOAR compared to Shuffle. Splunk SOAR is suitable for a large SOC environment. We are a medium environment, so we use it for that. There is also better support from the teams and TAC teams for Splunk SOAR. Compared to Shuffle, we do not have that support, so we have to manually raise tickets to their support team and request help from them.

Splunk SOAR provides a 50% reduction in threat response time. If a multiple login failure occurs, we previously required 15 minutes to raise that ticket to the client or our teams. After implementing Splunk SOAR, it takes only one to two minutes or four to five minutes. We are saving almost 50% of the time for our customer from an SLA point of view.

Splunk SOAR rates an eight on the pricing scale, from one to ten, where one is cheap and ten is expensive.

Splunk SOAR can be used for initial repetitive tasks as it is user-friendly. If you have specialists, you can create and modify the playbooks provided by Splunk SOAR. All of Splunk SOAR implementation is basically dependent on playbooks and how you modify, edit, or implement them. If your organization has good experts on playbooks and creating playbooks, you can go with Splunk SOAR. My overall rating for this solution is nine out of ten.

My use case for Splunk SOAR is for orchestration, mostly for automation, as I work with the Security Operations Center. We have a lot of notables firing in Splunk, and in cases where there is just a need for system owners to be notified, I use this SOAR tool to send an email, send a message, or create a ticket in ServiceNow. It checks for a few parameters, and we push out an email for those kinds of things.

In terms of time savings in threat responses, as a team, we save more than 30%, estimated around 30-40%. This is because previously, analysts spent time on cases that could easily be automated, but now after implementing these automations, the load has significantly reduced, allowing us to focus on further improvements.

The best features of Splunk SOAR include its multiple capabilities. For example, if there is a malicious IP, such as from a phishing mail, we can find out the sender IP and take action based on the verdict by using multiple app connectors in Splunk SOAR.

It sends an API call to check the IP reputation and informs us if it's malicious and what actions we should take, either blocking the IP address from the perimeter firewall or storing it for future threat hunting.

It connects with multiple apps such as ServiceNow and reduces the burden on the analyst by automating processes that don't require much investigation, allowing us to generate monthly reports on tasks performed by Splunk SOAR.

There are areas for improvement in Splunk SOAR, such as the need for more code-level customizations despite providing drag-and-drop options. I feel that integrating AI for customization could streamline the process, as not everyone using Splunk SOAR has programming skills, and AI prompts would help better integrate code.

There's also a need for faster integration of multiple apps such as ServiceNow to enhance usability, as I've seen people considering other SOAR platforms that require less coding.

I have been using the product for about one year, as Splunk SOAR was quite recent.

I notice that Splunk SOAR is performing its tasks well. However, some errors require manual troubleshooting, which feels more cumbersome compared to ServiceNow, which seems more user-friendly.

Nevertheless, I find Splunk SOAR stable as it fulfills its function when everything is correctly set up.

I would rate Splunk SOAR's stability at around eight, indicating that it is quite stable with minimal downtime, bugs, or glitches.

Regarding scalability, I find it to be a nine, as we have had no issues with scaling Splunk SOAR.

I'd rate Splunk's technical support around five because compared to IBM QRadar, their support is much better. I feel Splunk should enhance their support, as it appears lacking, especially considering the costs associated with higher licenses.

Positive

Before implementing Splunk, my team primarily used QRadar in this company.

The deployment was easy and straightforward; I don't think it was complex.

I don't remember the exact time taken for deployment, but it was done quite some time ago, possibly within three to four hours, though I'm not entirely sure.

The purchase of Splunk SOAR was made through a partner purchase.

Splunk's unified platform consolidates networks, security, and IT observability tools, though I have noticed that it's an admin's task to ensure all logs are consolidated and parsed correctly. While Splunk does some consolidation, it requires manual effort to ensure that the source IPs and key values are consistent across different source types.

My advice for others looking to implement Splunk SOAR is to first conduct a proof of concept to ensure it meets their requirements. There is a perception that Splunk SOAR is costlier than other SOAR tools, so exploring options during a POC is vital to determine if it's suitable for their needs.

Approximately 50 users in my company work with Splunk SOAR, mainly the development team involved with ticketing tools, while more than 1000 use the actual Splunk.

The users are global, with deployments in three locations: India, Denmark, and the US. I would rate this product a 7 overall.

I have been working with Splunk SOAR for about two years now, and it started out of necessity as my team was primarily using Splunk for centralized logging, which became a bottleneck as we scaled to over 5,000 users and integrated more apps through Okta and Ping, exacerbated by an onslaught of account lockout alerts and impossible travel flags.

My main use case for Splunk SOAR right now is automating identity threat detection, specifically ITDR, as we deal with our 5,000 users across various SaaS applications and are overwhelmed by alerts related to breaches requiring investigations, such as impossible travel and brute force attempts.

A recent incident that highlighted Splunk SOAR's value involved one of our senior DevOps engineers being targeted by an MFA fatigue attack, where Splunk Core flagged multiple MFA prompts that would have typically alerted a SOC, but thanks to Splunk SOAR, the situation was efficiently managed without human error.

After witnessing Splunk SOAR handle that incident quickly, my team felt a significant relief as there had been skepticism about automated playbooks, yet seeing Splunk SOAR manage real-world MFA attacks transformed our perspective on automation and its benefits in reducing alert fatigue.

The preparation time for audits has dropped significantly, transforming from weeks of manual log gathering into just days, aided by the automated actions that Splunk SOAR documents in a comprehensive manner.

In my opinion, the best features of Splunk SOAR include the visual playbook editor, which serves as a lifesaver for automating responses, the app ecosystem with hundreds of pre-built apps that connect our tools seamlessly, and the orchestration capabilities that greatly enhance our security posture.

One feature that I believe deserves more recognition is the playbook debugger, which allows us to run our playbooks against real data without executing actions, and this capability has significantly built our confidence in automating processes without risking critical errors.

While I appreciate Splunk SOAR, there are areas for improvement, notably regarding the CI/CD pipeline for playbook lifecycle management, as transitioning playbooks from development to production currently feels cumbersome and requires more manual effort than I would prefer.

Expanding on the needed improvements, I find that the user interface needs refinement, especially for complex flows where nested views would enhance readability and usability, making it easier to manage extensive playbooks.

Prior to choosing Splunk SOAR, we evaluated alternatives including Palo Alto XSOAR and IBM Resilient, but ultimately selected Splunk SOAR due to its native integration capabilities and superior playbook viewer.

Splunk SOAR has saved our organization considerable time, with its automation allowing us to shift focus from managing a backlog of identity tasks to prioritizing projects such as zero trust architecture and threat hunting.

Since deploying Splunk SOAR, there has been a notable reduction in time spent on monotonous security tasks, which I estimate to be around 95%, enabling my team to focus on more strategic initiatives.

Splunk SOAR has improved our organization's business resilience by increasing response speed and reducing manual complexity, positioning us to predict issues more proactively, thereby preventing potential disruptions before they impact users.

My advice for those considering Splunk SOAR is to clarify what needs automating and to treat it as a capability-building measure, establishing clear goals and investing in a solid framework for integrating it effectively. I would rate this product an 8 out of 10.

My main use cases for Splunk SOAR are automating security response and incident response. We use Splunk SOAR for phishing campaigns and detecting any kind of malicious viruses or anything similar that is in the organization. I can provide examples of how these features benefit my organization.

The features of Splunk SOAR that I appreciate most are the integrations with all the other applications and tools. The consolidation of tools greatly impacts my organization since I have everything all in one place, which is great. 

It has saved me time in threat response since we had no wait time in threat response. Splunk SOAR has helped improve my organization's business resilience. 

My impressions of Splunk's ability to predict, identify, and solve problems in real-time are very impressive. Doing everything in real-time provides us with the best actual notifications and alerts, which really helps us a lot.

I haven't gone too far into it to see anything that needs improvement yet. We can likely include some features related to the integration with on-premises resources, rather than focusing solely on the existing automation. 

These are the additional features that could be included in the future. Splunk's Unified Platform does help consolidate networking security and IT observability tools. They should integrate Splunk Enterprise Security better into Splunk Cloud.

I have been using Splunk SOAR for a year.

The reliability of Splunk SOAR is definitely there. The stability depends on how much we scale, which is something we can determine at a later point. We have not experienced any downtime, crashes, or performance issues.

Splunk SOAR has the ability to scale quite significantly. Our organization's needs are very low, so we can't really measure the scaling. I know that it has that capability. We have not expanded usage, and the process has not been smooth.

I would rate customer service and technical support as an eight out of ten. The resources are largely community-based, which makes it more difficult with Splunk SOAR. 

While support is available, the resources around Splunk SOAR are more homegrown by other users, and discovering different troubleshooting methods is harder to do with Splunk SOAR than with Enterprise Security or other Splunk services.

Positive

Before implementing Splunk SOAR, my team used tools such as VirusTotal, hybrid analysis, and other open-source tools for detection. That's how we guided our SecOps team in performing security investigations.

In terms of deployment, there were no issues. It was pretty seamless. Some areas around the automation broker gave us a few hiccups. Otherwise, it's a seamless deployment.

We have seen ROI with Splunk SOAR. Our ROI is evident in our phishing campaigns and in detecting phishing alerts. We've seen a decrease in false positives and a significant increase in our containment.

I don't have experience with costs; management handles that aspect.

I would rate Splunk SOAR overall a nine out of ten. 

The advice I would give to other organizations considering Splunk SOAR is that if you have the license, use it; if you don't have it, find a use case for it and implement it. 

My company does not have a business relationship with Splunk other than being a customer.

My main use case for Splunk SOAR is automating repetitive SOC tasks and speeding up incident response, and I mainly use it for alert enrichment, gathering information from security tools, and performing actions such as blocking IPs or isolating affected endpoints when required. This reduces manual effort and helps analysts respond to incidents faster.

One example of how I have used Splunk SOAR for alert enrichment was a suspicious IP alert where I automated the enrichment process; the playbook checked the IP reputation using my threat intelligence source and gathered additional information before the analyst reviewed the alert. If the IP was confirmed as malicious, the playbook could trigger the blocking action through the relevant security tool, which reduced the manual steps and helped me respond faster.

Splunk SOAR mainly helps me automate repetitive tasks and make investigations faster; it fits into my daily workflow by enriching alerts, collecting information from different security tools, and automating response actions where appropriate. This allows analysts to spend more time on investigation rather than manual enrichment tasks.

The best features of Splunk SOAR, in my opinion, are playbook automation, alert enrichment, and integration with different security tools, and the playbooks are especially useful because they automate repetitive investigation and response steps, which saves time for SOC analysts. The wide range of integrations also makes it easier to connect Splunk SOAR with existing security tools.

I find playbooks fairly easy to customize once I understand the workflow and available actions, and I mainly use them for alert enrichment, such as checking IP or domain reputation and collecting information from security tools. Common integrations in my workflow include Splunk, threat intelligence platforms, and endpoint security tools, and the main benefit is that I can automate repetitive investigation steps and customize the playbook based on the alert type.

Another useful feature of Splunk SOAR is the ability to run actions across multiple security tools from a single playbook; overall, it helps reduce manual work, standardize investigation steps, and makes the incident response process faster and more convenient.

Splunk SOAR could be improved by making playbook development easier for new users and providing better troubleshooting and debugging options. More out-of-the-box integrations and simpler configuration for integrations would also be helpful, and better reporting on playbook performance and automation results would make it easier to measure the overall value of the automation.

One challenge I face is that some integrations can require additional configurations and troubleshooting before they work smoothly; also, debugging complex playbooks can sometimes take time. Improving documentation, error messages, and troubleshooting guidance would make it easier for SOC analysts to build and maintain playbooks.

I have been using Splunk SOAR for 1.5 years.

I saw value relatively quickly after implementation; once the main integrations and a few common playbooks were configured, I started seeing benefits within the first few weeks. The biggest early benefit was the reduction in manual enrichment and repetitive response tasks, which helped analysts save time and focus on higher-priority investigations.

Splunk SOAR has helped me reduce manual work and improve the speed of incident response, and automating alert enrichment and repetitive investigation steps allows analysts to focus more on actual investigation and high-priority incidents. It has also made my response process more consistent by using standardized playbooks for common alert types.

I have noticed a clear reduction in manual investigation time for common alerts since using Splunk SOAR; Splunk SOAR playbooks can automate several enrichment steps that previously required analysts to perform them manually. In practice, this can save around 10 to 15 minutes per alert, depending on the use case, and allows analysts to focus more on investigation and response.

Splunk SOAR has helped free up some analysts' time by automating repetitive enrichment and response tasks; on average, it can save around 10 to 15 minutes on common alerts, depending on the playbook. It gives analysts more time to focus on detailed investigations, threat hunting, and other security projects.

Splunk SOAR improves my ability to investigate and respond by bringing enrichment and response action into a single workflow. It provides good visibility into the investigation through the data collected by the playbook, although understanding complex cloud environments can still require additional knowledge and troubleshooting. Overall, it makes routine investigations and remediation steps easier by reducing the number of manual steps.

My experience connecting existing security tools with Splunk SOAR has been good overall; I mainly use integrations with Splunk, endpoint security tools, threat intelligence sources, and network security tools for alert enrichment and response actions. Once the integrations are configured, playbooks can easily pass information between the tools, which helps reduce manual work during investigation.

My advice would be to start with a few common and repetitive SOC use cases rather than trying to automate everything at once; make sure the required integrations are properly configured and test playbooks before using automated response actions in production. Splunk SOAR is most useful when it is used to reduce manual work and standardize common investigation and response processes. I would rate my overall experience with Splunk SOAR as a 9 out of 10.

I mainly using Splunk SOAR for security automation. We want to create security incidents based on monitoring data and logs in Splunk. For example, if we identify firewall issues such as unauthenticated firewall login attempts, we analyze these logs and create security incidents. Our SOC team then works on these incidents to find the resolution and take necessary actions.

We use many playbooks and customize them extensively. We have built most of our playbooks based on learnings from our experience.

Splunk SOAR is very flexible. We can use Python, which is one of the best aspects because we can write many Python-based playbooks that significantly reduce manual SOC work. Additionally, it supports all environments including on-premises, cloud, and hybrid deployments.

There are many workflows available to investigate issues, which is very valuable. Splunk SOAR provides alerts immediately whenever something wrong happens, unlike our previous Splunk alerts which we could only schedule for specific times. This immediacy is very useful.

It is also helpful for threat intelligence enrichment. When we identify threats in our logs, Splunk SOAR assists us. We frequently receive phishing IPs and phishing emails, and Splunk SOAR immediately identifies all of these and informs our full team via email.

Analysts save a lot of time with Splunk SOAR. For example, with phishing emails, we can find the email in our email logs and identify it as phishing from a specific sender. We can integrate many things with the playbook including the email ID, IP address, sender information, and email content such as links or attachments. All of these details are included in the incident and sent to ServiceNow to create an incident containing everything needed. This makes troubleshooting easier because analysts can read all information and understand the full issue, allowing them to start investigating directly or know what to do next. We can also include next steps in the playbook such as blocking the sender.

Licensing becomes expensive for large-scale automation. We currently have fewer than 50 playbooks, but if we were to go over 100 or 500 playbooks, licensing would become significantly more expensive because of the large amount of data ingestion.

To make Splunk SOAR more usable, the tool needs to be simplified. There are many other tools in the market that are very good. For instance, Torq is better than Splunk SOAR because Torq has a no-code UI where we can accomplish anything through drag and drop. In Splunk SOAR, we need to write playbooks, so the tool could be improved with drag and drop functionality or default predefined playbooks.

Another limitation of Splunk SOAR is that initial learning is required. Additionally, when a playbook fails partway through, it is difficult to identify and troubleshoot the issue.

I have been using Splunk SOAR for one year.

Splunk SOAR is a stable product. We have not experienced any downtime or issues.

Scalability will increase cost somewhat because of more data ingestion. However, there are many benefits that come with the increased cost, and the return on investment is very good compared to the cost. For example, we are paying a certain amount but receiving value equal to that investment.

Technical support was very good and very helpful. Whenever we have a problem, we raise a case and the support team comes and fixes the issue. They are very responsive.

We have never used another SOAR solution before. I am aware that Palo Alto SOAR exists, but I do not know details about it.

We did not switch from another SOAR at our current company. However, at my previous company, we were using Torq, and at my current company, we are using Splunk SOAR. This is why I am familiar with both. By comparing both products, I prefer Torq.

Deployment was very easy. We received help from Splunk support, and they provided excellent assistance, making the deployment straightforward. We experienced no challenges.

I can provide one piece of advice. Before purchasing Splunk SOAR, explore many other SOARs as well. Palo Alto SOAR is available, and I have heard of Tines, which is also a product worth considering. Based on your use cases, you can make a decision. If you are completely dependent on security automation and an incident response platform, then Splunk SOAR may be suitable. If your use case does not match this area, you should choose another SOAR or consider Torq.

Onboarding a junior analyst is somewhat complex because they need to become familiar with the UI, which is complex for new junior analysts. However, if someone has experience with Splunk SOAR and other similar tools, they can onboard easily and work on the platform effectively. I would rate this product overall as a five-star solution based on the overall experience.