Splunk SOAR (Cisco)vTines
Splunk SOAR (Cisco) 6.68Tines 6.42
Splunk SOAR (Cisco) v Tines: the totals are 0.26 apart, outside the 0.25 band. Splunk SOAR (Cisco) leads on the total; the rows below say why. Rows won: Splunk SOAR (Cisco) 4, Tines 3, level 2.
The difference that decides Splunk SOAR (Cisco) v Tines
On integration depth, Splunk SOAR states 300+ third-party tools and 2,800+ automated actions (vendor claim, score 8.0), while Tines states no integration count and reaches APIs through HTTP actions (score 5.0). splunk.com, read 2026-11-03
Rows with the widest weighted gap: Integration count and depth documented (Splunk SOAR (Cisco) ahead by 3.0), Approvals and human-in-the-loop controls (Tines ahead by 2.0), Ownership stability (Tines ahead by 2.0).
Splunk SOAR (Cisco) v Tines: the nine rows side by side
Playbook authoring model
weight 14 of 100Splunk SOAR (Cisco)
8.0
Release notes show the classic visual editor was removed in 6.4.0 (2025-02-20) and playbooks are now built in the modern editor with Python; classic playbooks must be converted to edit them visually.
help.splunk.com, read 2026-11-03
Integration count and depth documented
weight 14 of 100Splunk SOAR (Cisco)
8.0Ahead
Splunk's blog states 300+ third-party tools and 2,800+ automated actions (vendor claim; read through a search summary, page not opened).
splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Tines
5.0
No integration count on the home page; positioned as vendor-agnostic. HTTP-based actions reach any API (not read on a docs page).
tines.com, read 2026-11-03
Case management and collaboration
weight 8 of 100Splunk SOAR (Cisco)
6.0Ahead
Microsoft's mapping table lists Splunk containers and cases as the incident and case objects. Collaboration features were not read on a Splunk page.
learn.microsoft.com, read 2026-11-03
Approvals and human-in-the-loop controls
weight 12 of 100Splunk SOAR (Cisco)
5.0
Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened.
splunk.com, read 2026-11-03 (search summary only)
Tines
7.0Ahead
Home page states governance, guardrails and monitoring, and that you choose where and when models are used. Coverage of the January 2026 AI interaction layer cites human-in-the-loop controls and audit logging (search summary).
tines.com, read 2026-11-03 (vendor claim) (search summary only); tines.com, read 2026-11-03 (vendor claim) (search summary only)
Agentic or AI features that are documented
weight 12 of 100Splunk SOAR (Cisco)
8.0Ahead
Release notes: Automation Builder agent in 8.6.0 (understands playbooks, builds playbooks), Connector Builder Agent added in 8.7.0 (2026-09-02). Cloud only and needs Splunk Enterprise Security 8.6 or later. The agents build automation; they do not decide cases.
help.splunk.com, read 2026-11-03
Hosting and data residency options
weight 8 of 100Splunk SOAR (Cisco)
8.0Ahead
Cloud, on-prem and hybrid per Splunk material; 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions not read.
help.splunk.com, read 2026-11-03
Pricing model and transparency
weight 8 of 100Splunk SOAR (Cisco)
4.0
No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate.
splunk.com, read 2026-11-03 (search summary only)
Tines
6.0Ahead
A free edition (3 live workflows, one-time USD 50 AI allowance) is published; paid editions are by request with no pricing unit.
tines.com, read 2026-11-03
Migration tooling and import or export formats
weight 14 of 100Splunk SOAR (Cisco)
6.0
Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel.
help.splunk.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Tines
6.0
Tines' help article, read 2026-11-03, names the format: stories export as JSON with credentials, resources and event data excluded and import with a Replace option, while the docs page itself does not name the format, no inbound SOAR converter was found, and a library story moves Splunk SOAR case records, not logic.
explained.tines.com, read 2026-11-03; tines.com, read 2026-11-03
Ownership stability
weight 10 of 100Splunk SOAR (Cisco)
6.0
Owned by Cisco since the Splunk deal (closing date 2024-03-18 per D3, a competitor). Splunk now describes SOAR as a native capability within Enterprise Security but licensed separately. No end-of-sale notice found. Python 3.9 support ends with the September 2026 release.
splunk.com, read 2026-11-03 (vendor claim) (search summary only); help.splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Tines
8.0Ahead
Independent; USD 125M round led by Goldman Sachs Alternatives in February 2025 at about USD 1.13B. Product naming changed in 2026 (Tines Stories and 3B).
pymnts.com, read 2026-11-03 (search summary only); tines.com, read 2026-11-03 (search summary only)
The verdict for Splunk SOAR (Cisco) v Tines, by buyer type
- Splunk shop
- Splunk SOAR fits better, because it is native inside Splunk Enterprise Security, with a separate SOAR subscription required; Tines moves Splunk SOAR case records through a library story, though not playbook logic.
- small team
- Tines fits better, because it publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance; Splunk SOAR publishes no price and needs a SOAR subscription on top of Enterprise Security.
- regulated or air-gapped
- Splunk SOAR fits better, because it deploys to cloud, on-prem or hybrid, with FIPS 140-3 for FedRAMP Cloud added in 8.6.0; Tines lists a self-hosted deployment in its docs sidebar.
When to pick each
Pick Splunk SOAR (Cisco) when
Pick Splunk SOAR when you are a Splunk shop and you want a tool that is native inside Splunk Enterprise Security, with a separate SOAR subscription required.
Pick Tines when
Pick Tines when you are a small team and you want a tool that publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance.
Moving playbooks between Splunk SOAR (Cisco) and Tines
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | moves with rework | A Tines library story moves Splunk SOAR case records into Tines cases, which is case data and not playbook logic. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines custom logic is Python Run script action, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
Profiles
Splunk SOAR (Cisco). Tines. Alternatives: instead of Splunk SOAR (Cisco), instead of Tines.