Swimlane Reviews

I have been using Swimlane for almost four years.

There are multiple use cases for Swimlane. I have mainly worked on phishing triage, building use cases for customers, automating their use cases using playbooks, and designing workflows. The implementation was for case and incident management, and we also have vulnerability management.

For phishing triage, we monitor a mailbox and as soon as any email arrives in the inbox folder, the workflow is triggered, and we grab all the details of that email. We parse it and then use VirusTotal for obtaining scores for the email, which is how phishing triage works in Swimlane.

Swimlane is a low-code security platform with most things having connectors and plugins available from the marketplace. You can directly download and configure them and use them instead of writing multiple lines of code; you can directly use the connectors and get your task automated.

Regarding my experience using those plugins from the marketplace, you can download whatever the use case is. Based on the use case, you just download the connectors or plugins available, configure them, and once those configurations are complete, create a playbook, design the workflow, and you can directly use an expression for obtaining the desired result. You can create a record for the SOC analyst team, and they can work on specific records, and you can also create UI buttons for the SOC analyst team. You can design another playbook that will be linked with the button. The SOC analyst will have a view to work on the records and can reassign tasks with everything done from the UI. You just need to integrate the workflow with the button. For instance, you can send notifications via multiple endpoints such as Microsoft Teams or Slack. You can configure the Slack connectors, create a playbook workflow, and then the SOC analyst can click a button to have the workflow post messages to the Slack channel, integrating multiple APIs using connectors.

Swimlane positively impacts my organization as it is a product company that provides cybersecurity automation. Initially, it was Swimlane, but with multiple releases, now we have a product called Turbine, where we can do the same thing in a more advanced way with agentic AI and the use of AI/ML capabilities.

You can improve Swimlane by allowing customers to raise feature requests if they feel some important fields are missing, and they can reach out to the support team to suggest features that need to be added or to request a simpler UI.

I have been working in the cybersecurity domain for five years.

Swimlane is stable.

For Swimlane's scalability, we use Docker and Kubernetes for deployments, typically using three pods for task API and task API pods. It depends on the number of users, and if a company has many users, we can have three replicas of each pod. Standalone deployments are available for fewer users, ensuring Swimlane can handle multiple users without crashing.

Customer support is quite good, taking time for resolution but acknowledging within the timeframe and trying to resolve use cases as quickly as possible, including escalations to senior staff if needed.

This is the first SOAR product I have used in cybersecurity. I later transitioned to Splunk SOAR.

I have seen a return on investment with Swimlane. I generally worked on the automation side to develop playbooks and workflows. If a company uses Swimlane, the SOC analyst team typically handles multiple events such as true positives and false positives. If everything is automated, we can filter out false positives or true positives, allowing for UI customization where the SOC analysts can trigger notifications and actions with buttons to create another playbook or automate using cron jobs, saving time for the SOC analyst team.

I have not evaluated other options before choosing Swimlane.

Swimlane offers this too, but it depends on the user's preference, similar to how some prefer Flipkart while others prefer Amazon. Since I worked with Swimlane, I felt more comfortable compared to Splunk.

Regarding Swimlane's AI capabilities, I think we have pretty good security for credentials with Bitwarden, which we promote for sharing all details. Additionally, there is an architect who designs the workflows or playbooks, and development will be done based on that, which is quite good.

Regarding Swimlane's AI capabilities, its accuracy and reliability are quite good. I have worked with multiple APIs, and when we have the proper credentials, everything gets done on time, the accuracy remains high, and it takes less time. We compare response times of the APIs, and since we use plugins and connectors, it depends totally on the API response and the result from the API. Swimlane automates the SOC analyst tasks.

Swimane is quite good without needing any additional improvements.

I would advise others to consider Swimlane as it is quite simple and user-friendly, with training provided for new customers or developers through good training materials, making it easy to learn for those unfamiliar with Swimlane. I would rate Swimlane around eight on a scale of one to ten.

I feel that compared to other tools such as Splunk, which has other functionalities and was in the market before Swimlane, the reason for my rating is that Splunk provides more flexibility in writing code. You can have a custom code block to write Python scripts.

We are using Swimlane for automation purposes and security orchestration.

We are using Swimlane's Playbook Automation. One of the major playbooks that we use in Swimlane is for phishing email automation, so whenever there is a phishing email delivered to a user inbox, Swimlane will automatically sandbox that.

We integrate Swimlane with third-party tools such as CrowdStrike, VirusTotal, URL Proofpoint, and all other different tools we have, so that we get various enrichment of any alerts to make sure that the analyst doesn't spend much time doing manual tasks and gets all the information from the tools in the Swimlane console itself.

We use the case management feature in Swimlane as well. This case management feature is helpful because, in security, we don't want our security incidents to be visible to end users. For example, if I am using ServiceNow, I have to impose many restrictions on the backend table to ensure that whatever incidents are created and written into that table are not available to any end users or other IT team members. We use case management for that purpose so that our security alerts are isolated and only the security team has visibility on them. Whenever we need any remediation, we integrate it with ServiceNow, so if I need to raise a remediation ticket for re-imaging the system, we can create a ticket in ServiceNow from the Swimlane console or from the case management itself with all the proper information.

We do utilize the analytics aspect in Swimlane, and we use their Hero AI module as well.

We also use customizable dashboards in Swimlane because many clients, including CISOs, whom we manage need an executive-level view of what is happening over Swimlane. We create dashboards for them that provide proper information, such as how many alerts were created, what was the mean time to triage, and mean time to respond; we cover all these as KPI metrics in the executive dashboard.

The biggest advantage of Swimlane for us is that it saves time, which in turn helps us in cost-saving.

One of the disadvantages of Swimlane is that to manage the platform, we need hardcore developers. We have recently seen new products such as Tines and Blink Ops coming into the market, where a person with a good knowledge of APIs and JSON format can manage the platform and create playbooks. Even a security analyst can create some playbooks on those platforms. However, on Swimlane, it's difficult for security analysts since they must mandatorily know Python to create the playbooks.

In terms of pricing, Swimlane is on the slightly expensive side.

Swimlane is scalable in general, but there are some limitations. It involves maintenance overhead because you need a complete engineer who knows the product in and out to scale it for the on-prem environment, while in a SaaS model, it works without many problems.

Installation can be quite complex, especially when we have to use Kubernetes, and if we need to create load balancing. In those situations, it requires a good engineer to deploy the platform.

In relation to bugs, sometimes the enrichment playbook we have does not enrich the alert, resulting in missing details, so in those scenarios, the automation team has to manually run the playbook again.

Improvements could be made in terms of quality, particularly.

I have been working with Swimlane for almost seven years.

Swimlane is scalable in general, but there are some limitations. It involves maintenance overhead because you need a complete engineer who knows the product in and out to scale it for the on-prem environment, while in a SaaS model, it works without many problems.

I would rate technical support from Swimlane a seven on a scale where ten is the best.

Positive

Installation can be quite complex, especially when we have to use Kubernetes, and if we need to create load balancing. In those situations, it requires a good engineer to deploy the platform.

We see these savings approximately close to 30-35%.

In terms of pricing, Swimlane is on the slightly expensive side.

We have recently seen new products such as Tines and Blink Ops coming into the market, where a person with a good knowledge of APIs and JSON format can manage the platform and create playbooks. Even a security analyst can create some playbooks on those platforms. However, on Swimlane, it's difficult for security analysts since they must mandatorily know Python to create the playbooks.

I would rate Swimlane a seven out of ten as a product.

My main use case for Swimlane is security automation workflows, automating most of the daily SOC workflows, especially ticketing, alerting, and reporting.

The main workflow I automated with Swimlane that helped my team was connecting our SIEM, which is mainly Splunk, to a ticketing system, specifically Jira, with Swimlane in the middle. It automatically gets alerts or notable use cases from the SIEM, processes them through Swimlane, and sends them to Jira, performing a lot of logic and automation, including DFIR and automatic response to specific threats that can be automated.

The best features Swimlane offers are the flexibility of writing your own Python code and the existing workflows with a marketplace for the most known workflows, which is great because you can quickly use workflows similar to those in other solutions.

Swimlane has positively impacted my organization by saving a lot of time, reducing all the manual work that the SOC used to do, and improving response times. It saved about ten minutes for every alert that comes out, and we get hundreds of alerts, meaning it saved many hours every day.

Customizing workflows or scripts in Swimlane was a bit challenging, perhaps too challenging because of how the code base is structured. When writing a new custom Python script for a Swimlane workflow, I had to follow their specific template, which was annoying due to the lack of good documentation at the time. I had to understand how their SDK worked to write Python based on that for defining inputs, values, and outputs to test everything.

To improve Swimlane, I suggest more documentation, more flexibility, and ease in developing new custom workflows and modifying existing ones.

Support from Swimlane is very nice, great, and very supportive. The user interface is solid and does not need updates, but improving the development experience for custom workflows would be beneficial, as edge cases often create issues when building things. Apart from that, Swimlane excels in what it does.

Other improvements Swimlane might need include taking a closer look at the open-source community, as adopting some of that simplicity and flexibility would be beneficial to have.

I have been working in my current field for two years.

Swimlane was somewhat stable; the version we had was kind of buggy, but support indicated we just needed to do updates to resolve the issues, though we did not perform the updates.

Swimlane's scalability was adequate to some extent, but then it needed a DevOps engineer to maintain it properly, which we lacked. The Kubernetes cluster became hard to maintain because it required a dedicated DevOps engineer to manage the workloads.

Customer support was very helpful and responsive; once I had a disaster, and they provided assistance within the same hour. I would rate customer support a ten.

We chose another solution after Swimlane.

We have seen a return on investment; with the same number of engineers, we now handle double the number of customers, even with the new, larger customers requiring dedicated teams, thanks to the automation we implemented in Swimlane leading to the need for fewer employees.

My experience with pricing, setup cost, and licensing was positive; I was the one maintaining it, not the one who deployed it, but the pricing was very nice with a great discount.

We evaluated options like FortiSOAR, XSOAR, Splunk SOAR, and IBM SOAR before choosing Swimlane.

My advice for others considering using Swimlane is to ensure it is the right fit for you and to have someone capable of managing the Kubernetes cluster if you use it on-premises. If not, it is great to have it on the cloud, and you will definitely need people who understand Python for writing custom workflows. I would rate this solution a seven overall.

Swimlane is used for tasks that need multiple task owners. For instance, with bank applications, if you're opening a new account or need KYC, the application might undergo several stages - from submission to bank manager approval, back to verification, and finally to signers for signature purposes. Swimlane allows the movement of tasks to multiple users, being assigned to a single person, a specific user, a group of people, or a customized role.

Moreover, once a task is assigned using Swimlane, it's visible on the portal of each group member, allowing any of them to perform an action on the task.

Swimlane's persisting feature makes managing tasks very easy. When a task is assigned, it remains visible to all members it's assigned to, making it easy to manage and follow. Its integration within Appian allows tasks to stay active and notify users regularly.

Another benefit is it reduces workload with minimal coding, requiring just drag-and-drop for setting assignments. It's both time and manpower efficient.

Swimlane should enhance its integration features beyond the current task assignment, reaction, and persistence capabilities. It should support integrations with multiple signals or queues.

Additionally, Swimlane's tight coupling with Appian standalone applications limits its scalability. It should be exposed so external clients can use it without needing a local setup. This would improve its dynamic adaptability and scalability.

I have been working with Appian for around 8 years.

If you have already used your tool inside any Appian Studio, which is already built on Appian technology, then the Swimlane will be available to it, and it's a component you can integrate very easily. It is just a drag and drop thing. Drag and drop and assign some values.

If the event is written correctly, then Swimlane is a hundred percent accurate. It will always determine which person to assign, and what to do, for that claiming thing. I haven't seen any production issue or anything coming up because of Swimlane.

Swimlane is not scalable because it is not exposed. Currently, it's a manual component that requires configuration through coding. If it were exposed or ported to a cloud platform, it could achieve better scalability. Swimlane should have the capability to be moved out of Appian and integrated with other platforms.

Appian community is there for technical support. You can raise a ticket or incident, and it gets addressed based on priority. Additionally, working with a firm that has a dedicated person for support is beneficial.

If the primary support contact is unable to assist, tickets must be created within the Appian community, though sometimes response times extend for weeks.

Positive

If we consider options outside of Appian, Java has many similar solutions, but within Appian, the task assignment capability is uniquely provided by Swimlane.

For the initial setup, the licensing needs to be handled appropriately. Existing applications wanting integration must have their process structures within Appian, as Swimlane isn't exposed. A process image is necessary in Appian to use Swimlane, which can be a drawback.

The best part of Swimlane is the persistent notifications and its ease of integration, requiring minimal coding. While it lacks response features, it can be integrated with messaging or queue services to achieve this. Any incident response requires additional integration since Swimlane itself doesn't react to incidents.

Real-time data in terms of persistence is configurable, and without config, tasks persist indefinitely until completion. If using Appian versions below 11, integration features for Swimlane aren't available. By default, Swimlane lacks built-in intelligence, needing coding for integration.

Although the Swimlane is beneficial and reduces manpower requirements, it's hindered by its lack of exposure. If exposed through services or endpoints, its functionality could be accessed without needing a local standalone application.

On a scale of one to ten, this solution deserves a rating of nine.

We are using it for a SOAR platform at a Cyber Security company which is MSSP. We are providing services to other companies, and we are utilizing it as a SOAR platform.

It has not impacted our organization positively, as we are using it primarily as a ticketing system. Normally, there should be some AI platform to include it and add alert traffic or other functionality, but it currently serves just as a ticketing system, which is not perfect.

I have used many different SOAR platforms, and I think Swimlane needs to upgrade and improve itself significantly.

Swimlane's search bar is not working effectively, and there is no option to differentiate between two cases at the same time. When cases become incidents, they should be marked with a different color to visualize escalations better. Our platform has some issues that do not disappear, and they have an unsupportive team. Their AI functionality exists but is not helpful. Sometimes there are glitches and problems with performance.

I have been using it for almost two years.

Swimlane has experienced problems with bugs and breakdowns.

My impressions of Swimlane's scalability are average. We are using it for different customers, and while we have numerous clients, the scalability is adequate.

I would rate their support a three out of ten due to both knowledge and response time.

Neutral

We are currently looking for different SOAR platforms.

The initial setup was moderately complex but manageable.

We implemented it ourselves without using an integrator or reseller.

I am evaluating other options at the moment.

Swimlane is in the middle class range in terms of expense.

I am not the decision maker, but I do not think it is worth the money to have as a tool.

I would not recommend using Swimlane.

On a scale of 1-10, I rate this solution a 5.

For example, we receive an alert that a user has accessed a suspicious URL, and therefore, we perform an analysis of that URL and in Swimlane we document the analysis of our investigation.

I would not be able to estimate the time I have managed to save in daily processes since I started using Swimlane because I don't have that data, but there have been noticeable improvements in the team's efficiency, since having everything integrated and being easier to explain to new people, the learning times are shortened.

I sense that Swimlane was integrated with Sentinel and maybe BMC Helix, with CrowdStrike as well, though I don't know what integrations it has in the background because we work for an external client.

If I had to think of some minor aspects or details that could be optimized, the dashboards could be more visual, with more visual elements and not so much text.

We have been using Swimlane for security automation within our company. All the ingestions, automations, and everything within our department goes through Swimlane.

Swimlane is easy to start with, as it requires minimal prior knowledge to get started. It is flexible, providing room for users to set up specific incident response flows. Additionally, its integration capabilities allow connections to various platforms, enhancing its usability. Swimlane has helped reduce analyst time, contributing to operational efficiency.

There is a need for enhanced version control in Swimlane. Currently, our version does not support it, making it tough to move changes between environments during significant updates. Furthermore, despite being advertised as a no-code tool, it remains code-reliant, demanding users to build solutions through coding.

We have been using Swimlane for the past three years.

I would rate the stability of Swimlane as a seven. We encountered issues requiring multiple restarts, which suggests that stability could be optimized further.

Swimlane is very scalable, and I would rate it a nine. We did not encounter issues even when managing thousands of alerts, as scalability is only limited by our instance's server capacity.

Swimlane's technical support is very good. They are attentive, responsive, and work to resolve issues efficiently.

Neutral

We previously used Splunk SOAR, but switched to Swimlane due to cost considerations. Swimlane was more cost-effective.

The initial setup of Swimlane is easy to learn but requires customers to design their solutions. Deployment of Swimlane took us three to four months, which involved migrating existing playbooks.

Around ten people from Swimlane and five from our team were involved in the implementation.

I wasn't part of the initial evaluation process. Still, we had some evaluations of other SOAR solutions within our company after migrating to Swimlane.

I would recommend Swimlane for those proficient with code and prepared for the maintenance efforts required. On a scale of one to ten, I rate Swimlane a seven.

My main use case for Swimlane is as a SOAR platform and for documentation. I use Swimlane for documentation by documenting all the alerts that we get and adding all of our documentation.

I appreciate the UI and the ease of usability that Swimlane offers. What stands out to me about the UI of Swimlane is how everything has a feature on the side that you can easily move around, which is quite convenient.

Swimlane has positively impacted my organization by helping us quickly work on alerts and document them. From being able to quickly work on alerts and document them, I have seen improved response times and efficiency since we are able to work very easily using the amazing UI and the tool.

Swimlane can be improved by being faster and quicker so it is easier for us and does not hang sometimes.

I have been using Swimlane for two and a half years, almost three years now.

On a scale of one to ten, I would rate Swimlane a nine. I chose nine because it is a pretty great tool and the only reason I did not give a full ten is because there is room for improvement and how it always should be.

Regarding Swimlane's AI capabilities, I have not used it so I cannot say anything about its governance and security. I cannot say anything about the accuracy and reliability of output since I have not used it yet.

My advice to others looking into using Swimlane is to keep an open mind; it might be a lot in the start, but it is an amazing tool. Give it some time, get used to it, get your hands dirty, and you will love this tool after a while. I have no additional thoughts about Swimlane, just keep improving, keep doing what you do, and you are doing a great job. My overall rating for Swimlane is nine out of ten.

Positive