The most valuable features are the Splunk SOAR apps and playbooks.
Splunk SOAR enhances security management with risk-based access control and offers flexible integration and automation playbook development, saving time for analysts. Its extensive library of pre-built integrations streamlines workflows, though API connectivity needs improvement. While advanced searchability simplifies log management, the integration with Microsoft and identity solutions is lacking. The platform is costly for small customers, and better simulation tools and upgrade processes are needed, alongside improved training materials.
