Palo Alto Cortex XSOARvSplunk SOAR (Cisco)
Palo Alto Cortex XSOAR 6.18Splunk SOAR (Cisco) 6.68
Palo Alto Cortex XSOAR v Splunk SOAR (Cisco): the totals are 0.50 apart, outside the 0.25 band. Splunk SOAR (Cisco) leads on the total; the rows below say why. Rows won: Palo Alto Cortex XSOAR 1, Splunk SOAR (Cisco) 4, level 4.
The difference that decides Palo Alto Cortex XSOAR v Splunk SOAR (Cisco)
On documented AI features, Splunk SOAR added an Automation Builder agent in 8.6.0 and a Connector Builder Agent in 8.7.0 on 2026-09-02, which build automation and do not decide cases (score 8.0), while Cortex XSOAR describes Cortex AgentiX as its successor, with the agents' limits not stated (vendor claim, score 6.0). help.splunk.com, read 2026-11-03
Rows with the widest weighted gap: Agentic or AI features that are documented (Splunk SOAR (Cisco) ahead by 2.0), Playbook authoring model (Splunk SOAR (Cisco) ahead by 1.0), Approvals and human-in-the-loop controls (Splunk SOAR (Cisco) ahead by 1.0).
Palo Alto Cortex XSOAR v Splunk SOAR (Cisco): the nine rows side by side
Playbook authoring model
weight 14 of 100Palo Alto Cortex XSOAR
7.0
Vendor page lists a visual playbook editor for code-free automation and 'thousands of security actions for DIY playbooks'. Scripting and content-pack authoring were not read in the docs.
paloaltonetworks.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
8.0Ahead
Release notes show the classic visual editor was removed in 6.4.0 (2025-02-20) and playbooks are now built in the modern editor with Python; classic playbooks must be converted to edit them visually.
help.splunk.com, read 2026-11-03
Integration count and depth documented
weight 14 of 100Palo Alto Cortex XSOAR
8.0
Vendor page states 900+ prebuilt integration and automation packs. The count is a vendor claim; community and custom pack paths were not read.
paloaltonetworks.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
8.0
Splunk's blog states 300+ third-party tools and 2,800+ automated actions (vendor claim; read through a search summary, page not opened).
splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Case management and collaboration
weight 8 of 100Palo Alto Cortex XSOAR
7.0Ahead
Vendor page lists a virtual war room for incident investigation and collaboration. Case fields, SLAs and role controls were not read.
paloaltonetworks.com, read 2026-11-03 (vendor claim)
Splunk SOAR (Cisco)
6.0
Microsoft's mapping table lists Splunk containers and cases as the incident and case objects. Collaboration features were not read on a Splunk page.
learn.microsoft.com, read 2026-11-03
Approvals and human-in-the-loop controls
weight 12 of 100Palo Alto Cortex XSOAR
4.0
Not found in the pages read on 2026-11-03. Manual tasks and approval steps exist in the product but no page read here documents them.
paloaltonetworks.com, read 2026-11-03
Splunk SOAR (Cisco)
5.0Ahead
Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened.
splunk.com, read 2026-11-03 (search summary only)
Agentic or AI features that are documented
weight 12 of 100Palo Alto Cortex XSOAR
6.0
Cortex AgentiX is described by Palo Alto as the next generation of XSOAR (October 2025 launch; agents for threat intel, email, endpoint and network investigation per launch coverage). The XSOAR product page itself only lists a webinar. What the agents cannot do is not stated.
investors.paloaltonetworks.com, read 2026-11-03 (vendor claim) (search summary only); paloaltonetworks.com, read 2026-11-03 (vendor claim) (search summary only)
Splunk SOAR (Cisco)
8.0Ahead
Release notes: Automation Builder agent in 8.6.0 (understands playbooks, builds playbooks), Connector Builder Agent added in 8.7.0 (2026-09-02). Cloud only and needs Splunk Enterprise Security 8.6 or later. The agents build automation; they do not decide cases.
help.splunk.com, read 2026-11-03
Hosting and data residency options
weight 8 of 100Palo Alto Cortex XSOAR
8.0
Palo Alto lifecycle docs show three deployments: XSOAR 8 SaaS, XSOAR 8 on-prem (versions with dated end-of-life) and XSOAR 6 recommended for on-prem and air-gapped. Data residency regions were not read.
cortex-docs.paloaltonetworks.com, read 2026-11-03; cortex-docs.paloaltonetworks.com, read 2026-11-03
Splunk SOAR (Cisco)
8.0
Cloud, on-prem and hybrid per Splunk material; 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions not read.
help.splunk.com, read 2026-11-03
Pricing model and transparency
weight 8 of 100Palo Alto Cortex XSOAR
3.0
No price or pricing unit on the product page, which offers an ROI calculator instead.
paloaltonetworks.com, read 2026-11-03
Splunk SOAR (Cisco)
4.0Ahead
No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate.
splunk.com, read 2026-11-03 (search summary only)
Migration tooling and import or export formats
weight 14 of 100Palo Alto Cortex XSOAR
6.0
The pan.dev pages, read in full on 2026-11-03, name the YAML file format of integrations and scripts and the content-pack layout that bundles playbooks, but the playbook on-disk format is not stated and no leaving-XSOAR guide or importer from another vendor was found, so it is counted as a named format under the rule at 6.0 while the zip export bundle, seen in a search summary only, is not counted; a competitor also claims XSOAR scripts are not portable, a claim about a rival.
xsoar.pan.dev, read 2026-11-03; paloaltonetworks.com, read 2026-11-03
Splunk SOAR (Cisco)
6.0
Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel.
help.splunk.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Ownership stability
weight 10 of 100Palo Alto Cortex XSOAR
6.0
Public parent. XSOAR 6.12 and 6.13 reached end-of-life on 2026-06-30 and XSOAR 8 on-prem versions retire on a three-month cycle; AgentiX is positioned as the successor. No end-of-sale notice found. A third party's 30 September 2029 on-prem end-of-life date does not appear on the Palo Alto lifecycle pages read.
cortex-docs.paloaltonetworks.com, read 2026-11-03; cortex-docs.paloaltonetworks.com, read 2026-11-03
Splunk SOAR (Cisco)
6.0
Owned by Cisco since the Splunk deal (closing date 2024-03-18 per D3, a competitor). Splunk now describes SOAR as a native capability within Enterprise Security but licensed separately. No end-of-sale notice found. Python 3.9 support ends with the September 2026 release.
splunk.com, read 2026-11-03 (vendor claim) (search summary only); help.splunk.com, read 2026-11-03 (vendor claim) (search summary only)
The verdict for Palo Alto Cortex XSOAR v Splunk SOAR (Cisco), by buyer type
- Splunk shop
- Splunk SOAR fits better, because it is native inside Splunk Enterprise Security, with a separate SOAR subscription required; Cortex XSOAR documents nothing for this buyer type on the pages read.
- regulated or air-gapped
- No separation on the evidence read: Cortex XSOAR documents XSOAR 6 as the recommended version for on-prem and air-gapped installs, and Splunk SOAR deploys to cloud, on-prem or hybrid, with FIPS 140-3 for FedRAMP Cloud added in 8.6.0.
- agent-first
- Splunk SOAR fits better, because it added agents that build playbooks and connectors, though they do not decide cases; Cortex XSOAR points to Cortex AgentiX as its successor, with agent limits not stated.
When to pick each
Pick Palo Alto Cortex XSOAR when
Pick Cortex XSOAR when you run in a regulated or air-gapped setting and you want a tool that documents XSOAR 6 as the recommended version for on-prem and air-gapped installs, though Splunk SOAR matches it on that point.
Pick Splunk SOAR (Cisco) when
Pick Splunk SOAR when you are a Splunk shop and you want a tool that is native inside Splunk Enterprise Security, with a separate SOAR subscription required.
Moving playbooks between Palo Alto Cortex XSOAR and Splunk SOAR (Cisco)
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Identity actions | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Palo Alto Cortex XSOAR custom logic is Python or JavaScript, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Palo Alto Cortex XSOAR documents YAML metadata plus Python or JavaScript in content packs, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. xsoar.pan.dev, read 2026-11-03 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Splunk SOAR custom logic is Python 3.9 playbooks, but Palo Alto Cortex XSOAR documents no importer for it, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Splunk SOAR documents JSON playbook export and .tgz import, but no importer for it or migration guide was found for Palo Alto Cortex XSOAR, so no documented path on 2026-11-03. help.splunk.com, read 2026-11-03 |
Profiles
Palo Alto Cortex XSOAR. Splunk SOAR (Cisco). Alternatives: instead of Palo Alto Cortex XSOAR, instead of Splunk SOAR (Cisco).