What I liked the most about Torq is the actual workflow builder. It is really great because they offer a lot of features and convenience features that are useful for any automation engineer. We can drag and drop and copy-paste. It does not provide much flexibility compared to Swimlane, but it does offer a very convenient user interface that can speed up the workflow building process. In terms of Torq's unified platform approach to AI SOC automation and case management compared to managing multiple point solutions across my security stack, I find it case-centric. They have many triggers that execute workflows based on specific changes in the cases. Each time there is a change an analyst makes in case management, it triggers a workflow. It is a case-centric platform, and when discussing a unified view, it is essentially about integrating various security solutions using API and some authentication, bringing in the data and allowing the workflows to do the work. I have used Torq to automate triage, investigation, and remediation actions across multiple attack surfaces, including endpoint, identity, cloud, and IT. They provide good connector actions for various remediations like isolating or quarantining devices or blocking IPs. As long as the third-party API supports those actions, Torq can effectively deliver these connector actions. In cases where Torq lacks connector actions, there are HTTP steps and actions we can configure to hit the API endpoint and perform response actions.
