D3 SecurityvSplunk SOAR (Cisco)
D3 Security 6.67Splunk SOAR (Cisco) 6.68
D3 Security v Splunk SOAR (Cisco): the totals are 0.01 apart, inside the 0.25 band. They are a band, not a ladder, so read the rows that decide the pair. Rows won: D3 Security 4, Splunk SOAR (Cisco) 4, level 1.
The difference that decides D3 Security v Splunk SOAR (Cisco)
On migration and export, D3 Security runs a Legacy SOAR Migration Program for six named source SOARs, with a written list of what does not port, a parity report and a rollback path (vendor claim, score 8.5), while Splunk SOAR documents a JSON download and a .tgz import, an on-prem to Cloud path, and no export to another SOAR (score 6.0). d3security.com, read 2026-11-03
Rows with the widest weighted gap: Migration tooling and import or export formats (D3 Security ahead by 2.5), Hosting and data residency options (Splunk SOAR (Cisco) ahead by 4.0), Case management and collaboration (Splunk SOAR (Cisco) ahead by 2.0).
D3 Security v Splunk SOAR (Cisco): the nine rows side by side
Playbook authoring model
weight 14 of 100D3 Security
7.0
Smart SOAR is described by Gartner's listing as codeless integrations with visual playbook design; migrated playbooks arrive in Morpheus in Deterministic mode. D3's authoring docs were not read.
d3security.com, read 2026-11-03 (search summary only)
Splunk SOAR (Cisco)
8.0Ahead
Release notes show the classic visual editor was removed in 6.4.0 (2025-02-20) and playbooks are now built in the modern editor with Python; classic playbooks must be converted to edit them visually.
help.splunk.com, read 2026-11-03
Integration count and depth documented
weight 14 of 100D3 Security
8.0
D3 states 800+ integrations for Morpheus (vendor claim).
d3security.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
8.0
Splunk's blog states 300+ third-party tools and 2,800+ automated actions (vendor claim; read through a search summary, page not opened).
splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Case management and collaboration
weight 8 of 100Splunk SOAR (Cisco)
6.0Ahead
Microsoft's mapping table lists Splunk containers and cases as the incident and case objects. Collaboration features were not read on a Splunk page.
learn.microsoft.com, read 2026-11-03
Approvals and human-in-the-loop controls
weight 12 of 100D3 Security
6.0Ahead
D3 states approval and wait steps carry over in migrated playbooks.
d3security.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
5.0
Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened.
splunk.com, read 2026-11-03 (search summary only)
Agentic or AI features that are documented
weight 12 of 100D3 Security
7.0
Morpheus is positioned as an autonomous SOC platform. Vendor figures: up to 95 percent of alerts investigated end to end in under two minutes and USD 0.97 per investigated alert. Method and sample not published on the page read.
d3security.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
8.0Ahead
Release notes: Automation Builder agent in 8.6.0 (understands playbooks, builds playbooks), Connector Builder Agent added in 8.7.0 (2026-09-02). Cloud only and needs Splunk Enterprise Security 8.6 or later. The agents build automation; they do not decide cases.
help.splunk.com, read 2026-11-03
Hosting and data residency options
weight 8 of 100Splunk SOAR (Cisco)
8.0Ahead
Cloud, on-prem and hybrid per Splunk material; 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions not read.
help.splunk.com, read 2026-11-03
Pricing model and transparency
weight 8 of 100D3 Security
6.0Ahead
A per-alert benchmark (USD 0.97 per investigated alert) is cited by the vendor; no plan tiers.
d3security.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
4.0
No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate.
splunk.com, read 2026-11-03 (search summary only)
Migration tooling and import or export formats
weight 14 of 100D3 Security
8.5Ahead
Legacy SOAR Migration Program: porting for six source platforms (XSOAR, Splunk SOAR, QRadar SOAR, Siemplify, Swimlane, FortiSOAR), three artifact types, a written list of what is not portable (custom code, in-house connectors), a parity report from replayed incidents and a rollback path. All vendor claims; no third-party check found.
d3security.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
6.0
Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel.
help.splunk.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Ownership stability
weight 10 of 100D3 Security
7.0Ahead
Independent; no 2026 acquisition found. The product line moved from Smart SOAR to Morpheus, which is a renaming risk for existing customers.
d3security.com, read 2026-11-03
Splunk SOAR (Cisco)
6.0
Owned by Cisco since the Splunk deal (closing date 2024-03-18 per D3, a competitor). Splunk now describes SOAR as a native capability within Enterprise Security but licensed separately. No end-of-sale notice found. Python 3.9 support ends with the September 2026 release.
splunk.com, read 2026-11-03 (vendor claim) (search summary only); help.splunk.com, read 2026-11-03 (vendor claim) (search summary only)
The verdict for D3 Security v Splunk SOAR (Cisco), by buyer type
- small team
- D3 Security fits better, because it publishes a subscription structure by daily alert volume tier, 500 to 10,000 alerts a day (vendor claim); Splunk SOAR publishes no price and needs a SOAR subscription on top of Enterprise Security.
- regulated or air-gapped
- Splunk SOAR fits better, because it deploys to cloud, on-prem or hybrid, with FIPS 140-3 for FedRAMP Cloud added in 8.6.0; D3 Security documents nothing for this buyer type on the pages read.
- leaving a legacy SOAR
- D3 Security fits better, because it runs a migration program for six named source SOARs, with a list of what does not port, a parity report and a rollback path (vendor claim); Splunk SOAR documents an on-prem to Cloud path only and no export to another SOAR.
When to pick each
Pick D3 Security when
Pick D3 Security when you are leaving a legacy SOAR and you want a tool that runs a migration program for six named source SOARs, with a list of what does not port, a parity report and a rollback path (vendor claim).
Pick Splunk SOAR (Cisco) when
Pick Splunk SOAR when you run in a regulated or air-gapped setting and you want a tool that deploys to cloud, on-prem or hybrid, with FIPS 140-3 for FedRAMP Cloud added in 8.6.0.
Moving playbooks between D3 Security and Splunk SOAR (Cisco)
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Phishing triage | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Endpoint containment | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Identity actions | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Ticketing and case sync | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Custom scripted logic | rebuild from scratch | D3 Security custom logic is Python utility commands, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Scheduled or batch jobs | rebuild from scratch | D3 Security documents playbook export and import as encrypted XML, YAML or JSON between D3 systems, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. docs.d3security.com, read 2026-11-04 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| Phishing triage | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| Endpoint containment | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| Identity actions | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| Ticketing and case sync | moves with tooling | D3 states published porting coverage for this source and says structure, inputs, outputs, approval steps and mapped integration commands port without a human (vendor claim, marketing page, no technical documentation read). d3security.com, read 2026-11-03 (vendor claim) |
| Custom scripted logic | moves with rework | D3 says custom code and anything without an equivalent is handled by people, so scripted logic needs rework (vendor claim). d3security.com, read 2026-11-03 (vendor claim) |
| Scheduled or batch jobs | moves with rework | D3's page does not mention schedules or batch triggers, so these need checking and likely rework (vendor claim). d3security.com, read 2026-11-03 (vendor claim) |
Profiles
D3 Security. Splunk SOAR (Cisco). Alternatives: instead of D3 Security, instead of Splunk SOAR (Cisco).