Splunk SOAR Reviews

Name: Splunk SOAR
Brand: Splunk
Rating: 4.0 (44 reviews)

Vendor: Splunk

4.0 out of 5

44 reviews
85% willing to recommend

558 followers

Start review

What is Splunk SOAR?

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Get the Splunk SOAR Buyer's Guide and find out what your peers are saying about Splunk SOAR, Microsoft Sentinel, Elastic Security and more!

Splunk SOAR is the #3 ranked solution in SOAR tools. PeerSpot users give Splunk SOAR an average rating of 8.0 out of 10. Splunk SOAR is most commonly compared to Microsoft Sentinel: Splunk SOAR vs Microsoft Sentinel. Splunk SOAR is popular among the large enterprise segment, accounting for 65% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 14% of all views.

Helped 842,388 peers since 2012

Featured Splunk SOAR reviews

Shubham Sinha.

Senior Principal Information Security Analyst at Veritas Technologies LLC

One of the features I like most is playbook creation, and custom functions are another. When you design a playbook, you can integrate multiple log sources and define rules. That used to be done by the analysts by going to the respective tools and doing tasks manually. Now, with playbook design, writing down those rules is a one-time activity that a SOAR admin has to do. After that, the platform automatically compiles all these activities and, based on the results, the analyst only has to indicate whether the result is a true or false positive. That reduces the time and effort involved. Our KPIs have greatly improved. An incident that used to take 15 to 20 minutes, was reduced to five minutes. This helped us speed up our response to any alert, whether it was a true positive or false positive. Another of the best parts of the SOAR platform is its ability to integrate with other systems and applications. It provides API integrations and, through them, I can limit the rights for the tool, which is good. If I want to integrate any of the applications with CrowdStrike, but only for incident-review policies or just to review the work automation, I can grant rights only for those purposes. That is one of the best features available in SOAR. It is very easy to implement and very user-friendly.

Read full review

Hamada Elewa

System Engineer - Security Presales at Raya Integration

We work with Splunk SOAR from a security perspective, focusing on User Behavior Analytics (UBA) and Security Orchestration, Automation, and Response (SOAR) The customization of the playbook in Splunk SOAR is very beneficial. After building the playbook, it operates professionally. There is an AI…

Read full review

SAURABHYADAV4

Consultant at HCL Technologies

The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection. Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product. I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours. Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system. The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%. I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system. It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare. After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes. Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.

Read full review

Splunk SOAR mindshare

As of March 2025, the mindshare of Splunk SOAR in the Security Orchestration Automation and Response (SOAR) category stands at 7.3%, down from 8.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

PeerAnalyst reports based on Splunk SOAR reviews

Type	Title	Date
Category	Security Orchestration Automation and Response (SOAR)	Mar 26, 2025	Download
Product	Reviews, tips, and advice from real users	Mar 26, 2025	Download
Comparison	Splunk SOAR vs Microsoft Sentinel	Mar 26, 2025	Download
Comparison	Splunk SOAR vs Palo Alto Networks Cortex XSOAR	Mar 26, 2025	Download
Comparison	Splunk SOAR vs IBM Security QRadar	Mar 26, 2025	Download

Title	Rating	Mindshare	Recommending
Microsoft Sentinel	4.1	19.6%	93%	90 interviews Add to research
Elastic Security	3.8	4.9%	86%	63 interviews Add to research

Valuable Features

Splunk SOAR excels with features like risk-based access control, seamless API integration, automated playbooks, and ease of use. It offers powerful security automation, superior dashboard and user interface, customizable playbooks with Python integration, and efficient workflows. Users appreciate its ability to automate redundant tasks, enhance searchability, and reduce incident response time. Its extensive integration capabilities streamline actions across various tools, providing comprehensive visibility and enabling rapid incident response and decision-making.

"The customization of the playbook in Splunk SOAR is very beneficial."
"Splunk has many features that make work easier, and it's simple to implement in a large production environment. Splunk collects a massive amount of data from cloud servers and handles it perfectly."
"Splunk integrates with so many products. It provides us with good information for us to be able to do our jobs."

Room for Improvement

Splunk SOAR needs better integration with other Splunk products and more seamless connectivity with external data sources. Integration with communication tools like Slack and third-party solutions such as Elasticsearch is lacking. Users find the interface complex and report expensive pricing. Improved search capabilities, documentation, report generation, and support for Android are desired. Enhancements in automation, integration ecosystem, case management functionality, and ease of implementation are needed. Scalability and comprehensive training materials are areas requiring attention.

"The creation of playbooks is complex in Splunk SOAR, and the number of integrations needs enhancement. Although it enhances alert handling, it still has a journey to compete with Palo Alto SOAR and FortiSOAR."
"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."
"I haven't had any issues with the solution so far."

ROI

Splunk SOAR offers good value and effective automation of routine tasks. Implementing it can be challenging initially, requiring time to build up playbooks and integrate devices. Many users report efficient task management and reduced personnel needs in security teams. The system's interconnected structure can pose difficulties, and the time to realize value varies. Users experience significant time savings and faster task completion, seeing value once it’s fully deployed and metrics are established.

Pricing

Splunk SOAR employs a subscription-based licensing model, often described as costly but justified by its comprehensive capabilities and performance benefits. The pricing is consumption-based with user-based licensing options. While many users find the cost high compared to competitors, some appreciate its value through automation and workflow efficiencies. Volume discounts and professional services add to pricing complexity. The solution's cost-effectiveness varies, with larger enterprises often considering the investment worthwhile despite occasional price increases.

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"I found the price of Splunk SOAR to be good."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

Popular Use Cases

Various organizations utilize Splunk SOAR for security automation, threat detection, and response enhancement. They implement it for threat analysis, process automation, and phishing investigation. Splunk SOAR integrates with existing systems to streamline security operations, enrich alerts, and automate incident interpretation. It supports threat hunting, user behavior analysis, and ransomware attack response. Companies employ Splunk SOAR for their cybersecurity centers, integrating it with user accounts and leveraging its orchestration and automation capabilities across environments.

Service and Support

Many find Splunk SOAR's customer service and support responsive with quality documentation reducing the need for direct interaction. Some face challenges with industry-specific cases. Support is praised for its expertise, fast response, and helpfulness, yet some note variability in consistency and speed. Community-driven solutions supplement official channels. Users appreciate dedicated support teams, but others prefer engaging service providers for quicker resolution. There is some variability in support experience during initial setups and complex queries.

Deployment

Splunk SOAR's initial setup varies in complexity. Some users find it straightforward, requiring minimal time with adequate documentation, while others experience challenges due to use case specifics, necessitating knowledgeable engineers. Deployments can span days to months based on architecture and license issues. Customizations and configurations often demand extra time, with larger teams sometimes involved. Transitioning between versions poses difficulties, especially regarding Python updates. Despite variability, some find it manageable as experience grows.

Scalability

Splunk SOAR is praised for its scalability, allowing organizations to expand usage efficiently. Users report flexibility and ease with management and implementation in both small and large setups. Some experience challenges with hardware bottlenecks and node limitations. Yet, many find it accommodates thousands of users and vast hardware configurations. There are occasional scaling difficulties, but the tool is customized to meet growing demands, making it adaptable and reliable across various environments.

Stability

Many experiences point to Splunk SOAR being stable with no significant downtime or glitches. Users rate its stability highly, though some note issues with traffic overload or third-party services. High Availability and Disaster Recovery features support its reliability. Users appreciate its ability to handle vast data efficiently, despite occasional upgrade challenges or API latency. Splunk SOAR is described as a reliable, responsive, SaaS-based tool providing consistent uptime and minimal human intervention needed.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Splunk SOAR Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

14%

Financial Services Firm

13%

Manufacturing Company

11%

Government

University

Energy/Utilities Company

Educational Organization

Comms Service Provider

Healthcare Company

Insurance Company

Retailer

Construction Company

Real Estate/Law Firm

Outsourcing Company

Non Profit

Media Company

Hospitality Company

Aerospace/Defense Firm

Legal Firm

Transportation Company

Wholesaler/Distributor

Recreational Facilities/Services Company

Performing Arts

Consumer Goods Company

International Affairs Institute

Pharma/Biotech Company

Compare Splunk SOAR with alternative products

Learn more about Splunk SOAR

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk SOAR was previously known as Phantom.