After SOAR

How to read a vendor's integration count

Published 4 November 2026. About 5 minutes.

An integration count is a unit problem. Cortex XSOAR states 900+ packs on one page and 850+ integrations on another, Splunk says 300+ tools and 2,800+ actions, Mate gives ten categories and no number. This guide shows how to ask what is counted, who maintains it and how to test it.

A count with no unit is not a measurement

A SOAR page that says "900+ integrations" has told you nothing you can plan around until you know what it counts. The unit might be a content pack, an app, a connector, an action, a template or a workflow. Those differ by a factor of ten or more inside one product, and vendors mix them.

We score integrations on two things: how many the vendor publishes, split into vendor-maintained, community and custom-connector paths, and whether the count comes with a source. A count with no source is a vendor claim. The rubric caps a count at 8.0 unless it names what is counted. Here is how the counts on our twelve platforms read when you apply that test.

What the published numbers actually say

Cortex XSOAR. The product page states 900+ prebuilt integration and automation packs (Cortex XSOAR product page) (read 2026-11-03, vendor claim). The Marketplace page states 850+ product integrations under a "largest SOAR community" heading (XSOAR Marketplace) (read 2026-11-03, vendor claim). Neither is dated. Packs also carry support levels, xsoar, partner, developer or community, and a certified or verified tag (XSOAR pack format) (read 2026-11-03). A pack count that includes community packs is not the same as a vendor-supported count.

Splunk SOAR. Splunk states 300+ third-party tools and 2,800+ automated actions. The 300 counts tools. The 2,800 counts actions. They are different units on one line (Splunk SOAR product page) (read 2026-11-03, vendor claim). The page links to a Splunkbase integrations list without giving an app count.

Cyware. Cyware states 400+ tool integrations by webhook, API and prebuilt connector (Cyware Orchestrate) (read 2026-11-03, vendor claim). That is one of the clearer statements, because it names the three ways of connecting. It still does not say how many are prebuilt.

D3 Security. D3 states 800+ integrations for Morpheus (D3 Security integrations) (read 2026-11-03, vendor claim). The page does not separate vendor-maintained from custom.

Blink Ops. The home page says 500+ pre-built agent templates. Blink says it has 30,000+ built-in integrations, but its own blog calls them "30,000+ actions" in one comparison table and "integrations" elsewhere, so the unit is not consistent (Blink blog on replacing SOAR) (read 2026-11-04, vendor claim). Third-party figures also conflict, at 30,000 integrations in one place and 7,000 workflows with 500 agent templates in another.

Torq. The home page we read states no count. A third party reports 300 integrations and 4,000+ pre-built steps, and we did not find that on a Torq page (Torq home page) (read 2026-11-03). Torq's Integration Builder creates custom integrations with step and trigger types, needs the Workspace Creator role or higher, and shares them workspace-wide (Torq knowledge base, custom integrations) (read 2026-11-03, search summary).

Tines, Swimlane, Mate. Tines states no count and positions HTTP-based actions as the way to reach any API. Swimlane says "infinite integrations", which is not a number, and supports third-party MCP server tools (Swimlane Turbine page) (read 2026-11-03, vendor claim). Mate lists ten integration categories, including Slack, ticketing, Microsoft identity and mail, cloud risk, email security, threat intelligence, EDR and identity context, and gives no count (Mate platform page) (read 2026-11-03, vendor claim). Mate does not claim to be a SOAR, so categories are its answer to the job.

Google SecOps, Sentinel, ServiceNow. Google's Content Hub carries commercial, community and custom integrations (Google Content Hub docs) (read 2026-11-03). Its product page also claims orchestration of over 300 tools (Google Security Operations product page) (read 2026-11-04, vendor claim). Sentinel draws on Logic Apps connectors, Content hub solutions and GitHub samples, with no count in the pages we read. ServiceNow added an AI-powered Integration Builder in Q1 2026 that drafts integrations from REST API documentation for review (ServiceNow SecOps Q1 2026 notes) (read 2026-11-03).

Four tests that turn a count into a decision

Test the unit. Ask: is this a pack, an app, a connector or an action? Divide by your own tool list instead.

Test your stack, not the total. List the 20 to 40 tools your SOC calls today: EDR, identity, email security, ticketing, cloud, SIEM, threat intelligence. Check each in the vendor's catalogue. A vendor with 300 that covers all of yours beats one with 900 that covers 60 percent.

Test the depth. An integration with one action, "get host", is a different thing from one with isolate, release, tag and query. Count actions per tool for your top five tools.

Test the custom path. Every real stack has an in-house tool. Find the documented route: a builder, an SDK, a plain HTTP step. Swimlane's Turbine SDK, a Node tool that scaffolds, validates, signs and pushes connectors, is one example of a stated path (Swimlane Turbine SDK) (read 2026-11-03, search summary). Tines and Blink point at HTTP and OpenAPI. Ask who maintains the connector when the vendor API changes.

Who maintains it decides the real cost

Support levels matter more than totals. In XSOAR, a community pack has no vendor behind it. In Google's Content Hub, custom integrations are private to the instance. In Torq, custom steps and integrations are recreated on import and versioned if changed. In all of these, an integration you built is an integration you maintain. Budget for it.

Also check the Python or runtime version each integration needs. XSOAR dropped Python 2 support for existing content on 2025-10-01 (XSOAR code conventions) (read 2026-11-03). Splunk 8.7.0 dropped Python 3.9 on 2026-09-02 (Splunk SOAR 8.7.0 release notes) (read 2026-11-03, vendor claim). A runtime change can break integrations you did not touch.

Checklist for reading a count

  • Write down the unit the vendor counts: pack, app, connector, action or template.
  • Find the page and the date. If there is no date, mark it undated.
  • Check whether two pages from the same vendor give different counts.
  • Split vendor-maintained, community and custom if the vendor does.
  • Check each tool on your own list against the catalogue.
  • Count actions per tool for your top five tools.
  • Find the custom path and who maintains it.
  • Ask what runtime each integration needs and when it ends.
  • Run one real action per key tool in a trial before you sign.