Splunk SOAR (Cisco)vTorq
Splunk SOAR (Cisco) 6.68Torq 6.77
Splunk SOAR (Cisco) v Torq: the totals are 0.09 apart, inside the 0.25 band. They are a band, not a ladder, so read the rows that decide the pair. Rows won: Splunk SOAR (Cisco) 3, Torq 4, level 2.
The difference that decides Splunk SOAR (Cisco) v Torq
On integration depth, Splunk SOAR states 300+ third-party tools and 2,800+ automated actions (vendor claim, score 8.0), while Torq states no count on the home page, and a third party reports 300 integrations (score 5.0). splunk.com, read 2026-11-03
Rows with the widest weighted gap: Integration count and depth documented (Splunk SOAR (Cisco) ahead by 3.0), Approvals and human-in-the-loop controls (Torq ahead by 3.0), Ownership stability (Torq ahead by 2.5).
Splunk SOAR (Cisco) v Torq: the nine rows side by side
Playbook authoring model
weight 14 of 100Splunk SOAR (Cisco)
8.0
Release notes show the classic visual editor was removed in 6.4.0 (2025-02-20) and playbooks are now built in the modern editor with Python; classic playbooks must be converted to edit them visually.
help.splunk.com, read 2026-11-03
Torq
8.0
Low-code and full-code workflow builder; natural-language workflow creation and agentic runbooks for hunting.
torq.io, read 2026-11-03 (vendor claim) (search summary only)
Integration count and depth documented
weight 14 of 100Splunk SOAR (Cisco)
8.0Ahead
Splunk's blog states 300+ third-party tools and 2,800+ automated actions (vendor claim; read through a search summary, page not opened).
splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Torq
5.0
The torq.io home page read states no count. A third party reading Torq pages reports 300 integrations and 4,000+ pre-built steps; confirm on Torq's own page before publishing.
torq.io, read 2026-11-03
Case management and collaboration
weight 8 of 100Splunk SOAR (Cisco)
6.0
Microsoft's mapping table lists Splunk containers and cases as the incident and case objects. Collaboration features were not read on a Splunk page.
learn.microsoft.com, read 2026-11-03
Torq
8.0Ahead
A 'Manage' module creates, assigns and manages cases from one record, per the vendor page.
torq.io, read 2026-11-03 (vendor claim)
Approvals and human-in-the-loop controls
weight 12 of 100Splunk SOAR (Cisco)
5.0
Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened.
splunk.com, read 2026-11-03 (search summary only)
Torq
8.0Ahead
Vendor page: response can run completely autonomously or with human-on-the-loop oversight, with a manual override and transparent audit logs. Per-action gating detail not read.
torq.io, read 2026-11-03 (vendor claim)
Agentic or AI features that are documented
weight 12 of 100Splunk SOAR (Cisco)
8.0
Release notes: Automation Builder agent in 8.6.0 (understands playbooks, builds playbooks), Connector Builder Agent added in 8.7.0 (2026-09-02). Cloud only and needs Splunk Enterprise Security 8.6 or later. The agents build automation; they do not decide cases.
help.splunk.com, read 2026-11-03
Torq
8.5Ahead
Agents for triage, investigation, response, hunting and reporting on a continuously updated context model that records verdicts, exceptions and overrides. Limits of the agents are not stated. 'Over 90 percent of cases closed autonomously' is a vendor claim reported by third parties; not on the page read.
torq.io, read 2026-11-03 (vendor claim)
Hosting and data residency options
weight 8 of 100Splunk SOAR (Cisco)
8.0Ahead
Cloud, on-prem and hybrid per Splunk material; 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions not read.
help.splunk.com, read 2026-11-03
Torq
5.0
Described as cloud-native with SOC 2, HIPAA and ISO certifications per third-party reading; no regions or self-hosted option read.
torq.io, read 2026-11-03
Pricing model and transparency
weight 8 of 100Splunk SOAR (Cisco)
4.0Ahead
No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate.
splunk.com, read 2026-11-03 (search summary only)
Torq
3.0
No price on the home page; its pricing URL returned 404. Review sites report demo-only pricing and no free trial.
torq.io, read 2026-11-03
Migration tooling and import or export formats
weight 14 of 100Splunk SOAR (Cisco)
6.0
Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel.
help.splunk.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03
Torq
6.0
Workflows export and import as YAML including custom steps, nested workflows and tags. No converter from XSOAR or Splunk SOAR found; a 'Kill Your SOAR' guide is behind a form.
kb.torq.io, read 2026-11-03
Ownership stability
weight 10 of 100Splunk SOAR (Cisco)
6.0
Owned by Cisco since the Splunk deal (closing date 2024-03-18 per D3, a competitor). Splunk now describes SOAR as a native capability within Enterprise Security but licensed separately. No end-of-sale notice found. Python 3.9 support ends with the September 2026 release.
splunk.com, read 2026-11-03 (vendor claim) (search summary only); help.splunk.com, read 2026-11-03 (vendor claim) (search summary only)
Torq
8.5Ahead
Independent. USD 140M Series D at USD 1.2B valuation announced 2026-01-12; USD 332M raised in total per press.
businesswire.com, read 2026-11-03
The verdict for Splunk SOAR (Cisco) v Torq, by buyer type
- Splunk shop
- Splunk SOAR fits better, because it is native inside Splunk Enterprise Security, with a separate SOAR subscription required; Torq documents nothing for this buyer type on the pages read.
- regulated or air-gapped
- Splunk SOAR fits better, because it deploys to cloud, on-prem or hybrid, with FIPS 140-3 for FedRAMP Cloud added in 8.6.0; Torq is cloud-native, with SOC 2, HIPAA and ISO certifications per a third-party reading and no self-hosted option read.
- agent-first
- Torq fits better, because it runs agents for triage, investigation, response and hunting on a context model that records overrides (vendor claim); Splunk SOAR added agents that build playbooks and connectors, though they do not decide cases.
When to pick each
Pick Splunk SOAR (Cisco) when
Pick Splunk SOAR when you are a Splunk shop and you want a tool that is native inside Splunk Enterprise Security, with a separate SOAR subscription required.
Pick Torq when
Pick Torq when you are agent-first and you want a tool that runs agents for triage, investigation, response and hunting on a context model that records overrides (vendor claim).
Moving playbooks between Splunk SOAR (Cisco) and Torq
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Identity actions | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Torq advises redesign over lift and shift and names no converter, its migration guide is gated and unread, so no documented path on 2026-11-03. torq.io, read 2026-11-03 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Identity actions | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Torq custom logic is Python script steps, but Splunk SOAR documents no importer for it, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Torq documents workflow YAML, but no importer for it or migration guide was found for Splunk SOAR, so no documented path on 2026-11-03. kb.torq.io, read 2026-11-03 |
Profiles
Splunk SOAR (Cisco). Torq. Alternatives: instead of Splunk SOAR (Cisco), instead of Torq.