IBM Resilient vs Splunk SOAR comparison

IBM and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. IBM is ranked #7 with an average rating of 7.5, while Splunk is ranked #3 with an average rating of 8.1. IBM holds a 2.2% mindshare in SOAR, compared to Splunk’s 7.2% mindshare. Additionally, 75% of IBM users are willing to recommend the solution, compared to 87% of Splunk users who would recommend it.

IBM Resilient

Read 18 IBM Resilient reviews

1,461 Views
904 Comparison Views

75% willing to recommend

Splunk SOAR

Read 43 Splunk SOAR reviews

4,898 Views
2,961 Comparison Views

87% willing to recommend

IBM Resilient

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 8, 2024

IBM Resilient and Splunk SOAR both compete in the cybersecurity incident response and automation space. Splunk SOAR seems to have the upper hand due to its strong integration flexibility with third-party tools and automation capabilities.

Features: IBM Resilient is known for strong incident response capabilities, flexibility, and integration with other IBM products, offering a comprehensive stack of tools. It allows extensive customization and suits diverse environments, fostering action-oriented responses. Splunk SOAR excels in integration flexibility, especially with third-party tools, through powerful automation and machine learning-based analytics. It supports efficient playbook development, reducing response times, and provides strong orchestration capabilities.

Room for Improvement: IBM Resilient could improve third-party integration, pricing structures, and setup complexity. Support responsiveness and expanding automation features are also crucial areas. Splunk SOAR may benefit from enhanced integration capabilities, better documentation, and refined pricing models. Users also desire advanced automation options and simplified playbook development processes.

Ease of Deployment and Customer Service: IBM Resilient primarily offers on-premises deployment with responsive technical support, although resolution times have room for improvement. Splunk SOAR offers cloud and hybrid deployment models and provides adequate technical support, though users wish for swifter support and better data source integration.

Pricing and ROI: IBM Resilient’s high pricing, based on user licenses, is considered a barrier for large implementations. Some users report significant ROI via time savings. Splunk SOAR faces criticism for high pricing but is seen as valuable for its performance benefits. Subscription-based pricing is costly, but automation and cost savings offer potential ROI.

To learn more, read our detailed IBM Resilient vs. Splunk SOAR Report (Updated: January 2025).

Buyer's Guide

IBM Resilient vs. Splunk SOAR

January 2025

Download the complete report

Helped 838,713 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

IBM Resilient

Ranking in Security Orchestration Automation and Response (SOAR)

7th

Average Rating

7.4

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Security Incident Response (3rd)

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

3rd

Average Rating

8.2

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of February 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of IBM Resilient is 2.2%, down from 2.7% compared to the previous year. The mindshare of Splunk SOAR is 7.2%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Featured Reviews

Usman Bhatti

Senior Officer Security Operations Center at a financial services firm with 10,001+ employees

Simple deployment, scalable, but lacking third-party solution compatibility

Integrating IBM Resilient with other applications can be very difficult and technically challenging. Often, they use the excuse that you are using the latest version of an application, such as an endpoint security system, and they don't have an API or support for it at the moment. There is no automation in the SOAR solution. It's worth noting that many third-party add-on applications needed to be purchased separately to integrate with IBM Resilient. While there were built-in applications available for incident remediation, the selection was limited. Additionally, integrating third-party applications was often a difficult and time-consuming process due to the technical complexity involved.

Read full review

Shubham Sinha.

Senior Principal Information Security Analyst at Veritas Technologies LLC

Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work

The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The integration with IBM SIM and the ability to block users during brute force attacks are particularly effective."

"What I like most about IBM Resilient is that it has a complete stack, which means you don't need to use different OEM products because you have all you need under the IBM Resilient umbrella. You don't need to worry much about integrations and components because you're working with tested and proven architecture."

"As a whole, the product is stable...Technical support is very good."

"Its flexibility is the most valuable."

"It is a stable solution...It is a scalable solution."

"The solution is reliable in our usage."

"The most valuable features of IBM Resilient are its flexibility and customization options for incident response."

"IBM Resilient is scalable."

More IBM Resilient pros

"It helps increase efficiency and productivity."

"Splunk integrates with so many products. It provides us with good information for us to be able to do our jobs."

"The most valuable feature of Splunk SOAR that stands out is it has a great SOAR. The automation and orchestration module is highly mature. A lot of use cases are on user entity and behavioral analytics (UEBA), which is artificial intelligence and machine learning-based (AIML)."

"The customization continues to be excellent."

"Splunk SOAR's quick response to incidents is the most valuable part."

"When you design a playbook, you can integrate multiple log sources and define rules... After that, the platform automatically compiles all these activities and, based on the results, the analyst only has to indicate whether the result is a true or false positive. That reduces the time and effort involved."

"The customizable playbook is the most valuable aspect of the solution."

"So far, the interface is very easy to use."

More Splunk SOAR pros

Cons

"IBM Resilient is quite complex, including its configuration."

"The initial setup is complex."

"The tool needs to improve its documentation on license scripts."

"The response time of the support is an area of concern where improvements are required."

"Integration with some devices, including Cisco PowerPower and certain antivirus products, has limitations."

"The integration could be improved so that it is easy to integrate with other solutions."

"It is not very straightforward to set up custom integrations, especially with services like Azure. You need an additional server for integration."

"The ability to analyze incidents needs to be improved in the solution."

More IBM Resilient cons

"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."

"The Splunk SOAR platform was not designed specifically for case management which is why this area needs improvement."

"Splunk SOAR has room to improve its offering for small-sized customers. The price is not fair for smaller-sized customers."

"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."

"The solution must provide more AIOps to improve predictability."

"The cost of Splunk SOAR has room for improvement."

"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."

"Splunk's support for integration is subpar and has room for improvement."

More Splunk SOAR cons

Pricing and Cost Advice

"I feel it is an expensive product when my company pays annually for renewal, support, and follow-up."

"The licensing cost for IBM Resilient is not too expensive, but it's not affordable, so it's moderately expensive. Regarding price, I'm rating the solution seven out of ten. The company pays for the license yearly, based on the number of users. Apart from the cost of the license you need to pay for each user, you also need to spend an initial investment for the base platform. You also have to pay for IBM Resilient support."

"The cost of the product is quite high."

"There is a license you need to pay for in order to use this product."

"It is very expensive."

"Pricing for the solution is good, in my opinion."

"We could create unlimited users using the license we had purchased."

"There are no costs except for the support services that our company pays in addition to the licensing charges attached to the solution."

More IBM Resilient pricing and cost advice

"The tool is not cheap."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"Splunk SOAR is more expensive compared to other options for SOAR."

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"I don't know the exact price, but for my region, it is very expensive."

"I found the price of Splunk SOAR to be good."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

838,713 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

30%

Computer Software Company

11%

Manufacturing Company

10%

Government

Computer Software Company

14%

Financial Services Firm

13%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about IBM Resilient?

It is a stable solution...It is a scalable solution.

See all answers

What is your experience regarding pricing and costs for IBM Resilient?

I am not the one in charge of pricing, so I am not sure about the costs.

See all answers

What needs improvement with IBM Resilient?

Integration with some devices, including Cisco PowerPower and certain antivirus products, has limitations.

See all answers

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

I rate Splunk SOAR two out of 10 for affordability. Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all ...

See all answers

What needs improvement with Splunk Phantom?

The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginne...

See all answers

Comparisons

Palo Alto Networks Cortex XSOAR vs IBM Resilient

Compared 37% of the time

IBM Security QRadar vs IBM Resilient

Compared 18% of the time

ServiceNow Security Operations vs IBM Resilient

Compared 15% of the time

Fortinet FortiSOAR vs IBM Resilient

Compared 8% of the time

Microsoft Sentinel vs IBM Resilient

Compared 5% of the time

More IBM Resilient Competitors

Cortex XSIAM vs Splunk SOAR

Compared 26% of the time

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 18% of the time

Tines vs Splunk SOAR

Compared 9% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 9% of the time

VMware Carbon Black Cloud vs Splunk SOAR

Compared 2% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

IBM Resilient

February 2025

Download IBM Resilient product report

Buyer's Guide

Splunk SOAR

February 2025

Download Splunk SOAR product report

Also Known As

No data available

Phantom

Overview

The Resilient Incident Response Platform (IRP) is the leading platform for orchestrating and automating incident response processes.

The Resilient IRP quickly and easily integrates with your organization’s existing security and IT investments. It makes security alerts instantly actionable, provides valuable intelligence and incident context, and enables adaptive response to complex cyber threats.

IBM

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

Golden Living, Health Equity, USA Funds

Recorded Future, Blackstone

Buyer's Guide

IBM Resilient vs. Splunk SOAR

January 2025

Free Report: IBM Resilient vs. Splunk SOAR

Find out what your peers are saying about IBM Resilient vs. Splunk SOAR and other solutions. Updated: January 2025.

DOWNLOAD NOW

838,713 professionals have used our research since 2012.

See our IBM Resilient vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.