Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSOAR vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 9, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Fortinet FortiSOAR
Ranking in Security Orchestration Automation and Response (SOAR)
11th
Average Rating
7.6
Reviews Sentiment
6.8
Number of Reviews
16
Ranking in other categories
No ranking in other categories
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
44
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of March 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Fortinet FortiSOAR is 4.1%, up from 3.1% compared to the previous year. The mindshare of Splunk SOAR is 7.3%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Augustine Onewo - PeerSpot reviewer
Inexpensive while enhancing security operations with intuitive automation tools
Usually, FortiSOAR is used for some of our security operation tasks where it is necessary to ascertain the integrity of threat vectors and then take action against them. In addition, we automate other processes within our security operations procedure through FortiSOAR FortiSOAR is really…
Shubham Sinha. - PeerSpot reviewer
Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work
The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The reputation of the brand is very good."
"Generally, the tool helps just automating a lot of manual load or repetitive tasks."
"It is a scalable solution...The implementation phase of the product was not tough or difficult."
"We use the product for security."
"It has a quick detection and response time."
"The playbook and the dashboard of FortiSOAR are really informative."
"The initial setup is straightforward."
"It's great that the solution is integrated with FortiAnalyzer."
"I have found all the security automation platform features of Splunk SOAR to be good. The Automation playbook development is highly useful."
"We are not a 24/7 SOC, so the most valuable feature of Splunk SOAR is the auto-response to threats when we are not in the office and the notifications that it sends to the on-call engineer."
"The most valuable features are the Splunk SOAR apps and playbooks."
"Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack."
"My understanding is the initial setup isn't too hard."
"The most valuable feature is the API connector, depending on how it's formatted and who made the actual app offering for it. The REST API is my favorite component. It's very easy to use. The filters are also really valuable. Those are the two primary features but I enjoy using the rest of it."
"SOAR allows custom code to be written and integrates with various technologies through pre-built apps like Windows Remote Management or custom apps we can build ourselves like a secret retrieval app from our vault."
"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."
 

Cons

"The ease of playbook creation on FortiSOAR needs improvement."
"Fortinet's tech support overall is not great when they are at their best."
"The UI design of the solution needs to be changed since it can get difficult for a newbie to operate."
"Fortinet FortiSOAR should improve its analysis."
"The tool's user interface is an area of concern where improvements are needed."
"The solution doesn't connect well with the network devices."
"Technical support could be improved."
"The solution lacks proper documentation, so we have to test and trial each playbook and integration."
"Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch.."
"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."
"I haven't had any issues with the solution so far."
"Providing Splunk app developers and playbook developers Python Stub files so that way when they create custom code through their IDE, they can have IntelliCode suggestions."
"The scalability could be better."
"There is a lot of room for improvement with the UI."
"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."
"The creation of playbooks is complex in Splunk SOAR, and the number of integrations needs enhancement. Although it enhances alert handling, it still has a journey to compete with Palo Alto SOAR and FortiSOAR."
 

Pricing and Cost Advice

"Fortinet FortiSOAR is an expensive solution."
"The solution offers both licensing and subscription models that are similar in price to other products."
"Since Africa is struggling with foreign exchange, the solution is pretty expensive there."
"The price of the product should be lower. The brand value that Fortinet has, it has the reputation of being a reasonably priced product, and they have an enormous customer base in India. Most of the SME market is covered by FortiGate firewalls. It becomes an easy way for consultants, such as us, or even system integrators, to open the door with the Fortinet product lines."
"Considering all the features of Fortinet FortiSOAR, I think it has a good price."
"Pricing is fine compared to other solutions."
"Fortinet FortiSOAR is expensive."
"If you compare Fortinet FortiSOAR's price with the prices of the market leader, Palo Alto, then it can be considered a cheaper product."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"I don't know the exact price, but for my region, it is very expensive."
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"I found the price of Splunk SOAR to be good."
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"The tool is not cheap."
"The licensing cost is reasonable."
"Splunk SOAR is more expensive compared to other options for SOAR."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
842,388 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
12%
University
7%
Healthcare Company
7%
Computer Software Company
14%
Financial Services Firm
13%
Manufacturing Company
11%
Government
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Fortinet FortiSOAR?
Fortinet FortiSOAR is a very interactive and user-friendly solution.
What is your experience regarding pricing and costs for Fortinet FortiSOAR?
FortiSOAR is considered costly, and I would rate its pricing at three out of ten, where one is high and ten is low.
What needs improvement with Fortinet FortiSOAR?
FortiSOAR needs to improve the response time for executing playbooks. Compared to IBM Resilient, the execution time for playbooks is slower. Additionally, FortiSOAR should include more ready-to-use...
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
Splunk SOAR is affordable cost-wise only, but not competitive from a technical perspective compared to Palo Alto SOAR and FortiSOAR.
What needs improvement with Splunk Phantom?
The creation of playbooks is complex in Splunk SOAR ( /categories/security-orchestration-automation-and-response-soar ), and the number of integrations needs enhancement. Although it enhances alert...
 

Also Known As

CyberSponse, FortiSOAR
Phantom
 

Overview

 

Sample Customers

Information Not Available
Recorded Future, Blackstone
Find out what your peers are saying about Fortinet FortiSOAR vs. Splunk SOAR and other solutions. Updated: March 2025.
842,388 professionals have used our research since 2012.