Splunk SOAR Reviews

Name: Splunk SOAR
Brand: Splunk
Rating: 4.1 (43 reviews)

Vendor: Splunk

4.1 out of 5

43 reviews
87% willing to recommend

557 followers

Post review

What is Splunk SOAR?

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Get the Splunk SOAR Buyer's Guide and find out what your peers are saying about Splunk SOAR, Microsoft Sentinel, AWS Security Hub and more!

Splunk SOAR is the #3 ranked solution in SOAR tools. PeerSpot users give Splunk SOAR an average rating of 8.2 out of 10. Based on the analysis of the 43 most recent Splunk SOAR reviews, the overall sentiment is positive, with a sentiment score of 6.8. Splunk SOAR is most commonly compared to Microsoft Sentinel: Splunk SOAR vs Microsoft Sentinel. Splunk SOAR is popular among the large enterprise segment, accounting for 66% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 15% of all views.

Helped 824,053 peers since 2012

Featured reviews

Ryan Plas

SOAR Engineer at Accenture Federal Services

When it comes to Splunk SOAR's ability to provide end-to-end visibility into our company's cloud-native environment, I would say that we are not using the cloud portions of it. I don't know if that's super relevant to what we are doing in our organization. I am 100 percent sure that Splunk SOAR helped reduce your mean time to resolve, but I don't have any metrics on hand but I know it has dramatically decreased. The tool has helped with the business resilience part. I think having it as a platform has been a solid portion of the product that we offer to people. Spunk SOAR has definitely saved my time in alert triage. When some of the tedious enrichment and lookup stuff happens, the analyst doesn't have to deal with such areas, and they can just jump in and see relevant data all in one pane of glass, which has been super helpful for speeding things up. The unified platform helps consolidate networking, security, and IT observability tools. The consolidation of tools impacts our organization as it just helps focus the SOC analyst on a single unified place to find information. It helps keep things streamlined and regular so they know where to look for certain stuff they want. It really helps people with training. It is a really easy tool to onboard people into because everything is right there in the product itself. The product is really great. I would love to see more SOAR innovation going into the tool, especially the on-premises version since it is what we use in our company. I feel the tool needs to encourage continuous improvements, but as a product itself, my company is really happy with the solution. I rate the tool an eight out of ten.

Read full review

Rodrigo Scorsatto

Senior Principal Site Reliability Engineer at Dell Technologies

Splunk SOAR has a user-friendly interface that simplifies playbook creation. While some initial training is helpful, the drag-and-drop functionality and pre-built code generation features make it accessible even for those without extensive coding experience. This ease of use allows teams to quickly automate incident response tasks, reducing the business impact. Splunk SOAR helps us improve our data collection and automate operational tasks. While it enriches data, some actions require approval or additional information. For application outages, immediate action is crucial to avoid business impact, and time to respond is key to be able to identify the root cause of issues. For example, if a database server goes down, if the analyst doesn't check the issue right after it occurs, they may end up losing precious logs, which would help them identify the issue and avoid reoccurrence. Additionally, manual database tasks like service restarts or log checks are time-consuming. Splunk SOAR automates these tasks, enriching our log collection, running health checks, and generating reports for the database team. This allows for faster issue identification and resolution, ultimately contributing to high system availability and minimal customer impact. It provides a comprehensive solution for our environment's health. Splunk offers two key products: Splunk as an observability tool that detects critical issues, and Splunk SOAR, an automation platform that enriches data and even automates remediation actions. SOAR offers easy integration with various tools. We can leverage pre-built apps for common integrations or create custom ones. While Splunk integrations are automatic, SOAR's API allows us to send data from any observability tool using the SOAR API. This API offers different options to manage the platform, and one of the options is to create a container in SOAR, which can trigger the appropriate playbook based on a label name, simplifying integration with new tools and accelerating proof-of-concept deployments. Implementing a SOAR platform significantly improved our IT operations. Previously, frequent application downtime overwhelmed our busy operations team, forcing them to prioritize and leave some issues unresolved. SOAR automation relieved this pressure by allowing us to create playbooks that automatically detect and fix recurring problems. While the initial setup required developing playbooks and standards, the resulting reduction in alerts and faster issue resolution freed up the operations team's time and had a major positive impact on our overall IT environment. Our mean time to detect is within seconds. Before SOAR, manually detecting and resolving server issues was slow and unreliable. It could take hours for an overloaded team to identify a problem, and even longer to fix it, potentially impacting customers. SOAR automates this process, triggering immediate responses that take seconds, minimizing downtime, and ensuring a smooth customer experience. Our mean time to resolution is improved. SOAR helps resolve issues quickly by automating tasks through playbooks. When an issue is detected, SOAR can run a playbook to fix it or provide more information to analysts, expediting resolution. SOAR has significantly improved our efficiency by automating manual tasks. This frees our IT staff to focus on resolving issues faster and tackling more complex projects.

Read full review

Nagendra Nekkala.

Senior Manager ICT & at Bangalore International Airport Limited

The playbooks are great. They are very useful. We can define rules, including what the remediation should be. Everything gets clearly defined. You can set up different types of automation. It helps increase efficiency and productivity. The solution provides us with end-to-end visibility. It's easy to visualize and troubleshoot our cloud-native environment using Splunk. There's simple product management and quick detection and response that helps minimize risks. I can handle continuous monitoring from an operation control center. We can integrate with other systems. It's helped minimize incident tickets and my overall response time has been lowered. We began to realize benefits within three to four months of deployment. Splunk is very easy to use during an investigation. It's very straightforward. We've been able to reduce our security event volume by 50%. We've also been able to reduce our mean time to detect by about 25%. It's helped us save time and consolidate tools in our environment so that we can minimize staff appropriately. The automation makes all of this possible.

Read full review

Splunk SOAR mindshare

As of December 2024, the mindshare of Splunk SOAR in the Security Orchestration Automation and Response (SOAR) category stands at 8.6%, down from 9.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

PeerAnalyst reports

Type	Title	Date
Category	Security Orchestration Automation and Response (SOAR)	Dec 21, 2024	Download
Product	Reviews, tips, and advice from real users	Dec 21, 2024	Download
Comparison	Splunk SOAR vs Microsoft Sentinel	Dec 21, 2024	Download
Comparison	Splunk SOAR vs Palo Alto Networks Cortex XSOAR	Dec 21, 2024	Download
Comparison	Splunk SOAR vs IBM Security QRadar	Dec 21, 2024	Download

Title	Rating	Mindshare	Recommending
Microsoft Sentinel	4.1	21.0%	93%	89 interviews Add to research
AWS Security Hub	3.8	11.4%	90%	20 interviews Add to research

Valuable Features

Splunk SOAR offers highly flexible integration capabilities with third-party systems like VirusTotal and ServiceNow, automates and customizes playbooks, and provides end-to-end visibility. Users commend its user-friendly interface, impressive documentation, and effective collaboration features. It's praised for its ability to automate redundant tasks, handle phishing attempts, and reduce incident response time significantly. Splunk SOAR's API connectors, advanced analytics, and customization options enhance business resilience, reducing mean time to detect and resolve incidents efficiently.

"Splunk has many features that make work easier, and it's simple to implement in a large production environment. Splunk collects a massive amount of data from cloud servers and handles it perfectly."
"Splunk integrates with so many products. It provides us with good information for us to be able to do our jobs."
"Its ability to integrate with other systems and applications in our environment is pretty easy. Sometimes if we see any complexity we try to involve a consultant to help us. Everything is through the built-in app. Splunk can connect to any assets through the built-in app. It could be in a platform, firewalls, or endpoints. It's easy if it's an app integration."

Room for Improvement

Splunk SOAR's integration across platforms, scalability, and ease of use require enhancement. Users cite challenges with APIs, IAM integration, and support documentation. The user interface and reporting features lack intuitive design. Automation is limited, and playbook and case management are cumbersome. Cost and pricing are obstacles for smaller organizations. There's a need for more advanced training resources, better app integration, and support for additional mobile platforms. Enhanced AI and machine learning capabilities, as well as more efficient logging, are needed.

"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."
"I haven't had any issues with the solution so far."
"The font used in the interface could be changed and made easier to read."

ROI

Organizations experience varying ROI from Splunk SOAR. Some report substantial value, especially through automation and time-saving efficiencies, while others find the investment challenging to quantify due to integration complexities. Initial setup and returns can be time-intensive, requiring dedicated resources, yet feedback from leadership tends to be positive. Many witness a tangible impact on daily operations, and some achieve significant cost reduction in staffing needs. Users with prior knowledge perceive benefits more swiftly.

Pricing

Splunk SOAR employs a subscription-based, consumption-driven licensing model, renowned for being costly due to factors like user numbers and data volume. Many users highlight its high expense compared to competitors, with costs potentially ranging from hundreds of thousands to a million dollars annually. Despite high prices, users acknowledge value through automation efficiencies. Splunk SOAR includes modules like analytics and professional services, available for additional fees, and offers discounts on high data volume. The model may vary with pricing changes anticipated.

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"I found the price of Splunk SOAR to be good."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

Popular Use Cases

Consulting firms utilize Splunk SOAR for threat analysis, automation of phishing processes, security monitoring, and incident response automation. They focus on integrating multiple data sources, orchestrating security workflows, and reducing manual intervention. It's employed for email filtering, infrastructure maintenance, threat intelligence, and risk management. Splunk SOAR supports cloud and on-premises deployments and is used across security operations, legal processes, and various automation tasks, leveraging playbooks for efficient action execution.

Service and Support

Splunk SOAR's customer support has improved since being acquired by Splunk, with many users finding it effective and responsive. Support is often rated between 7 and 10 out of 10. While documentation and community resources are helpful, there's room for flexibility in telecom and IoT cases. The professional support team is praised for their expertise and quick response. Users appreciate dedicated support and collaborative engagement, though some prefer community solutions for faster resolution.

Deployment

Experiences with Splunk SOAR's initial setup vary. Some find it straightforward, aided by clear documentation, taking a few days with a small team. Others describe the setup as complex due to integration challenges, requiring expert assistance and weeks to months to stabilize. While the SaaS version is quicker, on-premise deployment may involve difficulties, such as clustering issues. Maintenance and customization also play roles in the overall setup experience.

Scalability

Splunk SOAR is highly scalable, performing well in large and small environments. It allows flexibility and can handle vast user numbers effectively. Some organizations experience scalability issues, often due to deployment challenges. While factors like implementation and node limitations can impact performance, many find it meets diverse needs. Its ability to grow with infrastructure, along with handling multiple alerts, makes it adaptable. High scalability ratings emphasize its effectiveness across varied scales.

Stability

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Splunk SOAR Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

11%

Government

10%

University

Energy/Utilities Company

Educational Organization

Retailer

Insurance Company

Real Estate/Law Firm

Construction Company

Healthcare Company

Comms Service Provider

Media Company

Non Profit

Outsourcing Company

Legal Firm

Transportation Company

Hospitality Company

Aerospace/Defense Firm

Wholesaler/Distributor

Recreational Facilities/Services Company

International Affairs Institute

Consumer Goods Company

Performing Arts

Compare Splunk SOAR with alternative products

Learn more about Splunk SOAR

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk SOAR was previously known as Phantom.