After SOAR

Instead of Splunk SOAR (Cisco)

Splunk SOAR (Cisco) scores 6.68 of 10 and sits 3 of 12 on the card. The gaps below are the reasons a team looks elsewhere. Each alternative is placed by what it answers.

Where Splunk SOAR (Cisco) leaves gaps

Splunk's product page says SOAR capabilities can be used by an Enterprise Security deployment and marks a Splunk SOAR subscription as required, so orchestration inside ES is a second licence with no published price. splunk.com, read 2026-11-03

  • Import accepts a .tgz archive only into the same or a higher Splunk SOAR version and the same editor type, and the page does not explain how the JSON export relates to that archive. help.splunk.com, read 2026-11-03
  • Approval before actions rests on a third-party reading of Splunk pages because the Splunk documentation page was not opened. Approvals score 5.0 and are flagged for a re-read. splunk.com, read 2026-11-03

Where Splunk SOAR (Cisco) scores lowest on the rubric

  • Pricing model and transparency, 4.0 of 10: No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate. splunk.com, read 2026-11-03
  • Approvals and human-in-the-loop controls, 5.0 of 10: Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened. splunk.com, read 2026-11-03
  • Migration tooling and import or export formats, 6.0 of 10: Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel. help.splunk.com, read 2026-11-03

The alternatives, in the order that answers the gaps

  1. Torq, 6.77 of 10. Torq is second at 6.77 and answers the licence gap with a single product that includes a case module, though it publishes no price. Its YAML export is documented, and it names no converter from Splunk SOAR. Splunk SOAR (Cisco) v Torq.
  2. D3 Security, 6.67 of 10. D3 Security is fourth at 6.67. Its migration program lists Splunk SOAR among six sources with a parity report and a rollback path, all vendor claims, which answers the export gap. D3 Security v Splunk SOAR (Cisco).
  3. Tines, 6.42 of 10. Tines is fifth at 6.42. A library story moves Splunk SOAR case records into Tines cases, and a free edition gives a way to test without a contract. It moves no playbook logic. Splunk SOAR (Cisco) v Tines.
  4. Microsoft Sentinel, 6.21 of 10. Microsoft Sentinel is seventh at 6.21. It publishes prices and a concept map from Splunk SOAR to Logic Apps, updated 2026-08-12, which answers the price gap for Microsoft shops. The guide names no converter tool. Microsoft Sentinel v Splunk SOAR (Cisco).
  5. Swimlane (Turbine), 6.14 of 10. Swimlane is ninth at 6.14. Its migration page names Splunk SOAR as a source with an up to 90 percent claim, a vendor claim with no technical page. It publishes no price or hosting detail, so it answers the export gap only on paper. Splunk SOAR (Cisco) v Swimlane (Turbine).

Splunk SOAR (Cisco) on its own: profile. If you are leaving it, see the portability matrix, and Leaving Splunk SOAR (Cisco).