# After SOAR > Head-to-heads between SOAR platforms and agent-run ones, scored on nine published criteria, with switching guides and a playbook portability matrix. Scores read on 2026-11-03. Every vendor fact carries a source link and a read date. The full text of every page is in /llms-full.txt. ## The lead bout and the card - [Tines v Torq on nine published rows](https://aftersoar.com/): Head-to-heads between SOAR platforms and agent-run ones, scored on nine published criteria, with switching guides and a playbook portability matrix. - [The card for Microsoft shop](https://aftersoar.com/card/microsoft-shop): Microsoft shop: the covered platforms in the order that suits a team that runs sentinel, defender and entra, and wants automation that sits inside that estate. the usual question is whether to stay with logic apps playbooks or buy a second automation product, with the weights stated and the totals computed from the nine published rows. - [The card for Splunk shop](https://aftersoar.com/card/splunk-shop): Splunk shop: the covered platforms in the order that suits a team that runs splunk enterprise security and either uses splunk soar today or is deciding whether to buy it. cisco owns the product, and splunk calls it native inside enterprise security but licensed separately, with the weights stated and the totals computed from the nine published rows. - [The card for Small team](https://aftersoar.com/card/small-team): Small team: the covered platforms in the order that suits a security team of a few people with no automation engineer. they need playbooks they can build and fix themselves, a price they can read before a call, and a vendor that will still exist in three years, with the weights stated and the totals computed from the nine published rows. - [The card for Regulated or air-gapped](https://aftersoar.com/card/regulated-air-gapped): Regulated or air-gapped: the covered platforms in the order that suits a team under a regulator or a classification rule that limits where playbooks run and who can approve an action. it may need on-prem or air-gapped deployment, named regions and an audit trail for every automated step, with the weights stated and the totals computed from the nine published rows. - [The card for Agent-first](https://aftersoar.com/card/agent-first): Agent-first: the covered platforms in the order that suits a team that wants agents to run investigations and uses playbooks only where a fixed, audited step is needed. it is testing whether an agent-run platform can take whole alert categories, with the weights stated and the totals computed from the nine published rows. - [The card for Leaving a legacy SOAR](https://aftersoar.com/card/leaving-a-legacy-soar): Leaving a legacy SOAR: the covered platforms in the order that suits a team that owns xsoar, splunk soar, swimlane, siemplify or another older soar, with hundreds of playbooks, and has decided to move or has been told to, with the weights stated and the totals computed from the nine published rows. ## Method - [How After SOAR scores SOAR platforms](https://aftersoar.com/scoring): The nine rubric rows, their weights, the 0 to 10 scale, how totals are computed and why totals within 0.25 are a band and not a ladder. ## Platforms - [Palo Alto Cortex XSOAR: score, strengths and gaps](https://aftersoar.com/platforms/palo-alto-cortex-xsoar): Palo Alto Cortex XSOAR scored 6.18 on nine published rows, 8th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Splunk SOAR (Cisco): score, strengths and gaps](https://aftersoar.com/platforms/splunk-soar): Splunk SOAR (Cisco) scored 6.68 on nine published rows, 3rd of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Swimlane (Turbine): score, strengths and gaps](https://aftersoar.com/platforms/swimlane): Swimlane (Turbine) scored 6.14 on nine published rows, 9th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Torq: score, strengths and gaps](https://aftersoar.com/platforms/torq): Torq scored 6.77 on nine published rows, 2nd of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Tines: score, strengths and gaps](https://aftersoar.com/platforms/tines): Tines scored 6.42 on nine published rows, 5th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [D3 Security: score, strengths and gaps](https://aftersoar.com/platforms/d3-security): D3 Security scored 6.67 on nine published rows, 4th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Google Security Operations: score, strengths and gaps](https://aftersoar.com/platforms/google-secops): Google Security Operations scored 5.98 on nine published rows, 10th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Microsoft Sentinel: score, strengths and gaps](https://aftersoar.com/platforms/microsoft-sentinel): Microsoft Sentinel scored 6.21 on nine published rows, 7th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [ServiceNow Security Operations: score, strengths and gaps](https://aftersoar.com/platforms/servicenow-secops): ServiceNow Security Operations scored 4.90 on nine published rows, 12th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [BlinkOps: score, strengths and gaps](https://aftersoar.com/platforms/blink-ops): BlinkOps scored 5.82 on nine published rows, 11th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Cyware: score, strengths and gaps](https://aftersoar.com/platforms/cyware): Cyware scored 7.24 on nine published rows, 1st of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [Mate Security: score, strengths and gaps](https://aftersoar.com/platforms/mate-security): Mate Security scored 6.22 on nine published rows, 6th of 12 covered. Strengths, gaps, pricing, customers and who should shortlist it. - [ThreatConnect: why it is not on the card](https://aftersoar.com/platforms/threatconnect): ThreatConnect is scored in the dataset but is not profiled or paired. The sourced reason, the score it would carry and what would bring it back. - [Revelstoke (Arctic Wolf): why it is not on the card](https://aftersoar.com/platforms/revelstoke-arctic-wolf): Revelstoke (Arctic Wolf) is scored in the dataset but is not profiled or paired. The sourced reason, the score it would carry and what would bring it back. ## Head-to-head bouts - [BlinkOps v Cyware: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-cyware): BlinkOps v Cyware: 5.82 to 7.24 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v D3 Security: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-d3-security): BlinkOps v D3 Security: 5.82 to 6.67 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Google Security Operations: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-google-secops): BlinkOps v Google Security Operations: 5.82 to 5.98 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Mate Security: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-mate-security): BlinkOps v Mate Security: 5.82 to 6.22 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Microsoft Sentinel: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-microsoft-sentinel): BlinkOps v Microsoft Sentinel: 5.82 to 6.21 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-palo-alto-cortex-xsoar): BlinkOps v Palo Alto Cortex XSOAR: 5.82 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-servicenow-secops): BlinkOps v ServiceNow Security Operations: 5.82 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-splunk-soar): BlinkOps v Splunk SOAR (Cisco): 5.82 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-swimlane): BlinkOps v Swimlane (Turbine): 5.82 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Tines: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-tines): BlinkOps v Tines: 5.82 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [BlinkOps v Torq: nine rows side by side](https://aftersoar.com/bouts/blink-ops-v-torq): BlinkOps v Torq: 5.82 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v D3 Security: nine rows side by side](https://aftersoar.com/bouts/cyware-v-d3-security): Cyware v D3 Security: 7.24 to 6.67 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Google Security Operations: nine rows side by side](https://aftersoar.com/bouts/cyware-v-google-secops): Cyware v Google Security Operations: 7.24 to 5.98 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Mate Security: nine rows side by side](https://aftersoar.com/bouts/cyware-v-mate-security): Cyware v Mate Security: 7.24 to 6.22 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Microsoft Sentinel: nine rows side by side](https://aftersoar.com/bouts/cyware-v-microsoft-sentinel): Cyware v Microsoft Sentinel: 7.24 to 6.21 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/cyware-v-palo-alto-cortex-xsoar): Cyware v Palo Alto Cortex XSOAR: 7.24 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/cyware-v-servicenow-secops): Cyware v ServiceNow Security Operations: 7.24 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/cyware-v-splunk-soar): Cyware v Splunk SOAR (Cisco): 7.24 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/cyware-v-swimlane): Cyware v Swimlane (Turbine): 7.24 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Tines: nine rows side by side](https://aftersoar.com/bouts/cyware-v-tines): Cyware v Tines: 7.24 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Cyware v Torq: nine rows side by side](https://aftersoar.com/bouts/cyware-v-torq): Cyware v Torq: 7.24 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Google Security Operations: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-google-secops): D3 Security v Google Security Operations: 6.67 to 5.98 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Mate Security: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-mate-security): D3 Security v Mate Security: 6.67 to 6.22 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Microsoft Sentinel: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-microsoft-sentinel): D3 Security v Microsoft Sentinel: 6.67 to 6.21 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-palo-alto-cortex-xsoar): D3 Security v Palo Alto Cortex XSOAR: 6.67 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-servicenow-secops): D3 Security v ServiceNow Security Operations: 6.67 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/d3-security-v-splunk-soar): D3 Security v Splunk SOAR (Cisco): 6.67 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/d3-security-v-swimlane): D3 Security v Swimlane (Turbine): 6.67 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Tines: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-tines): D3 Security v Tines: 6.67 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [D3 Security v Torq: nine rows side by side](https://aftersoar.com/bouts/d3-security-v-torq): D3 Security v Torq: 6.67 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Mate Security: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-mate-security): Google Security Operations v Mate Security: 5.98 to 6.22 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Microsoft Sentinel: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-microsoft-sentinel): Google Security Operations v Microsoft Sentinel: 5.98 to 6.21 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-palo-alto-cortex-xsoar): Google Security Operations v Palo Alto Cortex XSOAR: 5.98 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-servicenow-secops): Google Security Operations v ServiceNow Security Operations: 5.98 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/google-secops-v-splunk-soar): Google Security Operations v Splunk SOAR (Cisco): 5.98 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/google-secops-v-swimlane): Google Security Operations v Swimlane (Turbine): 5.98 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Tines: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-tines): Google Security Operations v Tines: 5.98 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Google Security Operations v Torq: nine rows side by side](https://aftersoar.com/bouts/google-secops-v-torq): Google Security Operations v Torq: 5.98 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Microsoft Sentinel: nine rows side by side](https://aftersoar.com/bouts/mate-security-v-microsoft-sentinel): Mate Security v Microsoft Sentinel: 6.22 to 6.21 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/mate-security-v-palo-alto-cortex-xsoar): Mate Security v Palo Alto Cortex XSOAR: 6.22 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/mate-security-v-servicenow-secops): Mate Security v ServiceNow Security Operations: 6.22 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/mate-security-v-splunk-soar): Mate Security v Splunk SOAR (Cisco): 6.22 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/mate-security-v-swimlane): Mate Security v Swimlane (Turbine): 6.22 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Tines: nine rows side by side](https://aftersoar.com/bouts/mate-security-v-tines): Mate Security v Tines: 6.22 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Mate Security v Torq: nine rows side by side](https://aftersoar.com/bouts/mate-security-v-torq): Mate Security v Torq: 6.22 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v Palo Alto Cortex XSOAR: nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-palo-alto-cortex-xsoar): Microsoft Sentinel v Palo Alto Cortex XSOAR: 6.21 to 6.18 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-servicenow-secops): Microsoft Sentinel v ServiceNow Security Operations: 6.21 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-splunk-soar): Microsoft Sentinel v Splunk SOAR (Cisco): 6.21 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-swimlane): Microsoft Sentinel v Swimlane (Turbine): 6.21 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v Tines: nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-tines): Microsoft Sentinel v Tines: 6.21 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Microsoft Sentinel v Torq: nine rows side by side](https://aftersoar.com/bouts/microsoft-sentinel-v-torq): Microsoft Sentinel v Torq: 6.21 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Palo Alto Cortex XSOAR v ServiceNow Security Operations: nine rows side by side](https://aftersoar.com/bouts/palo-alto-cortex-xsoar-v-servicenow-secops): Palo Alto Cortex XSOAR v ServiceNow Security Operations: 6.18 to 4.90 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Palo Alto Cortex XSOAR v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/palo-alto-cortex-xsoar-v-splunk-soar): Palo Alto Cortex XSOAR v Splunk SOAR (Cisco): 6.18 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Palo Alto Cortex XSOAR v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/palo-alto-cortex-xsoar-v-swimlane): Palo Alto Cortex XSOAR v Swimlane (Turbine): 6.18 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Palo Alto Cortex XSOAR v Tines: nine rows side by side](https://aftersoar.com/bouts/palo-alto-cortex-xsoar-v-tines): Palo Alto Cortex XSOAR v Tines: 6.18 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Palo Alto Cortex XSOAR v Torq: nine rows side by side](https://aftersoar.com/bouts/palo-alto-cortex-xsoar-v-torq): Palo Alto Cortex XSOAR v Torq: 6.18 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [ServiceNow Security Operations v Splunk SOAR (Cisco): nine rows side by side](https://aftersoar.com/bouts/servicenow-secops-v-splunk-soar): ServiceNow Security Operations v Splunk SOAR (Cisco): 4.90 to 6.68 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [ServiceNow Security Operations v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/servicenow-secops-v-swimlane): ServiceNow Security Operations v Swimlane (Turbine): 4.90 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [ServiceNow Security Operations v Tines: nine rows side by side](https://aftersoar.com/bouts/servicenow-secops-v-tines): ServiceNow Security Operations v Tines: 4.90 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [ServiceNow Security Operations v Torq: nine rows side by side](https://aftersoar.com/bouts/servicenow-secops-v-torq): ServiceNow Security Operations v Torq: 4.90 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Splunk SOAR (Cisco) v Swimlane (Turbine): nine rows side by side](https://aftersoar.com/bouts/splunk-soar-v-swimlane): Splunk SOAR (Cisco) v Swimlane (Turbine): 6.68 to 6.14 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Splunk SOAR (Cisco) v Tines: nine rows side by side](https://aftersoar.com/bouts/splunk-soar-v-tines): Splunk SOAR (Cisco) v Tines: 6.68 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Splunk SOAR (Cisco) v Torq: nine rows side by side](https://aftersoar.com/bouts/splunk-soar-v-torq): Splunk SOAR (Cisco) v Torq: 6.68 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Swimlane (Turbine) v Tines: nine rows side by side](https://aftersoar.com/bouts/swimlane-v-tines): Swimlane (Turbine) v Tines: 6.14 to 6.42 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Swimlane (Turbine) v Torq: nine rows side by side](https://aftersoar.com/bouts/swimlane-v-torq): Swimlane (Turbine) v Torq: 6.14 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. - [Tines v Torq: nine rows side by side](https://aftersoar.com/bouts/tines-v-torq): Tines v Torq: 6.42 to 6.77 on nine published rows. Rubric side by side, the rows that decide it and a verdict by buyer type. ## Alternatives - [Palo Alto Cortex XSOAR alternatives, ordered by the rubric](https://aftersoar.com/alternatives/palo-alto-cortex-xsoar): Where Palo Alto Cortex XSOAR leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Splunk SOAR (Cisco) alternatives, ordered by the rubric](https://aftersoar.com/alternatives/splunk-soar): Where Splunk SOAR (Cisco) leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Swimlane (Turbine) alternatives, ordered by the rubric](https://aftersoar.com/alternatives/swimlane): Where Swimlane (Turbine) leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Torq alternatives, ordered by the rubric](https://aftersoar.com/alternatives/torq): Where Torq leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Tines alternatives, ordered by the rubric](https://aftersoar.com/alternatives/tines): Where Tines leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [D3 Security alternatives, ordered by the rubric](https://aftersoar.com/alternatives/d3-security): Where D3 Security leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Google Security Operations alternatives, ordered by the rubric](https://aftersoar.com/alternatives/google-secops): Where Google Security Operations leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Microsoft Sentinel alternatives, ordered by the rubric](https://aftersoar.com/alternatives/microsoft-sentinel): Where Microsoft Sentinel leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [ServiceNow Security Operations alternatives, ordered by the rubric](https://aftersoar.com/alternatives/servicenow-secops): Where ServiceNow Security Operations leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [BlinkOps alternatives, ordered by the rubric](https://aftersoar.com/alternatives/blink-ops): Where BlinkOps leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Cyware alternatives, ordered by the rubric](https://aftersoar.com/alternatives/cyware): Where Cyware leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. - [Mate Security alternatives, ordered by the rubric](https://aftersoar.com/alternatives/mate-security): Where Mate Security leaves gaps in its public documentation and which platforms answer each gap, ordered by score on the nine published rows. ## Switching guides - [Leaving Palo Alto Cortex XSOAR: what moves and what breaks](https://aftersoar.com/leaving/palo-alto-cortex-xsoar): A switching guide for teams leaving Palo Alto Cortex XSOAR: the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving Splunk SOAR (Cisco): what moves and what breaks](https://aftersoar.com/leaving/splunk-soar): A switching guide for teams leaving Splunk SOAR (Cisco): the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving Swimlane (Turbine): what moves and what breaks](https://aftersoar.com/leaving/swimlane): A switching guide for teams leaving Swimlane (Turbine): the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving Microsoft Sentinel: what moves and what breaks](https://aftersoar.com/leaving/microsoft-sentinel): A switching guide for teams leaving Microsoft Sentinel: the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving Google Security Operations: what moves and what breaks](https://aftersoar.com/leaving/google-secops): A switching guide for teams leaving Google Security Operations: the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving D3 Security: what moves and what breaks](https://aftersoar.com/leaving/d3-security): A switching guide for teams leaving D3 Security: the portability row for that source, what documentation says will not port, and a parallel run you can audit. - [Leaving Cyware: what moves and what breaks](https://aftersoar.com/leaving/cyware): A switching guide for teams leaving Cyware: the portability row for that source, what documentation says will not port, and a parallel run you can audit. ## Playbook portability matrix and data - [Playbook portability matrix](https://aftersoar.com/portability): Nine source platforms against eleven targets, seven playbook types per cell, each with a verdict, a reason, a source and its own read date. - [How the portability matrix is built](https://aftersoar.com/portability/method): The four verdicts, the seven playbook types, what counts as a documented path and what the matrix does not measure. - [Download the portability dataset](https://aftersoar.com/data): The playbook portability matrix as CSV and JSON under CC BY 4.0: 693 rows, one per source, target and playbook type, each with a verdict and a source. ## Features - [Features on leaving, running and reading SOARs](https://aftersoar.com/features): Long reads for SOAR leads on export formats, approvals, parallel runs and reading an integration count, each with sourced facts and a checklist. - [A parallel run you can audit: parity reports, rollback and exit criteria](https://aftersoar.com/features/a-parallel-run-you-can-audit-parity-reports-rollback-and-exit-criteria): How to run an old SOAR beside its replacement, prove parity on replayed incidents, keep a rollback and set exit criteria. Vendor claims stay labelled. - [Approvals: per action, per playbook or per product](https://aftersoar.com/features/approvals-per-action-per-playbook-or-per-product): Where each platform puts the human: Mate autonomy modes, Torq oversight, Sentinel author-built steps, Cyware mobile approval. Sources read 2026-11-03. - [Export formats compared: Torq YAML, Tines story files, ARM templates](https://aftersoar.com/features/export-formats-compared-torq-yaml-tines-story-files-arm-templates): Which platforms export playbooks as YAML, JSON, ZIP, XML or ARM, what each file leaves out and which import a rival's format. Sources read 2026-11-03. - [How to read a vendor's integration count](https://aftersoar.com/features/how-to-read-a-vendors-integration-count): Integration counts mix packs, apps, actions and templates. Compare 900+, 400+, 800+ and 2,800+ by unit, date and custom path. Sources read 2026-11-03. - [Leaving Splunk SOAR as it becomes part of Enterprise Security](https://aftersoar.com/features/leaving-splunk-soar-as-it-becomes-part-of-enterprise-security): What the Enterprise Security packaging, the Python 3.9 drop and the Cisco ownership mean for a Splunk SOAR exit, with dated facts, read on 2026-11-03. - [Running a playbook and an agent side by side: ownership per alert category](https://aftersoar.com/features/running-a-playbook-and-an-agent-side-by-side): How to give each alert category to a playbook or an agent, using what Swimlane, D3, Torq, Mate and Splunk document about autonomy. Read on 2026-11-03. - [Sentinel playbooks after the Defender portal move](https://aftersoar.com/features/sentinel-playbooks-after-the-defender-portal-move): After 2027-03-31 Sentinel runs only in the Defender portal. What changes for automation rules and Logic Apps playbooks. Dated sources read 2026-11-03. - [What actually moves when you leave Cortex XSOAR](https://aftersoar.com/features/what-actually-moves-when-you-leave-cortex-xsoar): A SOC lead's inventory of what leaves Cortex XSOAR intact, what needs rewriting, and which lifecycle dates set your deadline. Sources read 2026-11-03. - [Words: the SOAR glossary](https://aftersoar.com/words): 35 terms from SOAR documentation, each defined in plain words with a sourced example from a named vendor's documentation. - [Dispatches: dated notes on vendor changes](https://aftersoar.com/dispatches): 12 dated notes on one vendor event each, with the source and what it changes for a buyer. Newest first. ## Words - [SOAR: a SOAR term, defined](https://aftersoar.com/words/soar): SOAR in SOAR documentation: a plain definition and a sourced example from Splunk SOAR's own material. - [Playbook: a SOAR term, defined](https://aftersoar.com/words/playbook): Playbook in SOAR documentation: a plain definition and a sourced example from Palo Alto Cortex XSOAR's own material. - [Workflow YAML: a SOAR term, defined](https://aftersoar.com/words/workflow-yaml): Workflow YAML in SOAR documentation: a plain definition and a sourced example from Torq's own material. - [Story: a SOAR term, defined](https://aftersoar.com/words/story): Story in SOAR documentation: a plain definition and a sourced example from Tines's own material. - [Content pack: a SOAR term, defined](https://aftersoar.com/words/content-pack): Content pack in SOAR documentation: a plain definition and a sourced example from Palo Alto Cortex XSOAR's own material. - [Connector: a SOAR term, defined](https://aftersoar.com/words/connector): Connector in SOAR documentation: a plain definition and a sourced example from Torq's own material. - [Trigger: a SOAR term, defined](https://aftersoar.com/words/trigger): Trigger in SOAR documentation: a plain definition and a sourced example from Microsoft Sentinel's own material. - [Automation rule: a SOAR term, defined](https://aftersoar.com/words/automation-rule): Automation rule in SOAR documentation: a plain definition and a sourced example from Microsoft Sentinel's own material. - [Case management: a SOAR term, defined](https://aftersoar.com/words/case-management): Case management in SOAR documentation: a plain definition and a sourced example from ServiceNow Security Operations's own material. - [War room: a SOAR term, defined](https://aftersoar.com/words/war-room): War room in SOAR documentation: a plain definition and a sourced example from Palo Alto Cortex XSOAR's own material. - [Approval step: a SOAR term, defined](https://aftersoar.com/words/approval-step): Approval step in SOAR documentation: a plain definition and a sourced example from Microsoft Sentinel's own material. - [Autonomy mode: a SOAR term, defined](https://aftersoar.com/words/autonomy-mode): Autonomy mode in SOAR documentation: a plain definition and a sourced example from D3 Security's own material. - [Guardrail: a SOAR term, defined](https://aftersoar.com/words/guardrail): Guardrail in SOAR documentation: a plain definition and a sourced example from Mate Security's own material. - [Gamebook: a SOAR term, defined](https://aftersoar.com/words/gamebook): Gamebook in SOAR documentation: a plain definition and a sourced example from Mate Security's own material. - [AI agent: a SOAR term, defined](https://aftersoar.com/words/ai-agent): AI agent in SOAR documentation: a plain definition and a sourced example from Splunk SOAR's own material. - [Agentic platform: a SOAR term, defined](https://aftersoar.com/words/agentic-platform): Agentic platform in SOAR documentation: a plain definition and a sourced example from Torq's own material. - [Intelligent routing: a SOAR term, defined](https://aftersoar.com/words/intelligent-routing): Intelligent routing in SOAR documentation: a plain definition and a sourced example from Swimlane's own material. - [Context graph: a SOAR term, defined](https://aftersoar.com/words/context-graph): Context graph in SOAR documentation: a plain definition and a sourced example from Torq's own material. - [Shadow mode: a SOAR term, defined](https://aftersoar.com/words/shadow-mode): Shadow mode in SOAR documentation: a plain definition and a sourced example from Mate Security's own material. - [Deterministic mode: a SOAR term, defined](https://aftersoar.com/words/deterministic-mode): Deterministic mode in SOAR documentation: a plain definition and a sourced example from D3 Security's own material. - [Parity report: a SOAR term, defined](https://aftersoar.com/words/parity-report): Parity report in SOAR documentation: a plain definition and a sourced example from D3 Security's own material. - [Rollback: a SOAR term, defined](https://aftersoar.com/words/rollback): Rollback in SOAR documentation: a plain definition and a sourced example from Google Security Operations's own material. - [Solution package: a SOAR term, defined](https://aftersoar.com/words/solution-package): Solution package in SOAR documentation: a plain definition and a sourced example from Swimlane's own material. - [ARM template: a SOAR term, defined](https://aftersoar.com/words/arm-template): ARM template in SOAR documentation: a plain definition and a sourced example from Microsoft Sentinel's own material. - [Logic Apps playbook: a SOAR term, defined](https://aftersoar.com/words/logic-app-playbook): Logic Apps playbook in SOAR documentation: a plain definition and a sourced example from Microsoft Sentinel's own material. - [Bundled SOAR: a SOAR term, defined](https://aftersoar.com/words/bundled-soar): Bundled SOAR in SOAR documentation: a plain definition and a sourced example from Splunk SOAR's own material. - [End-of-life: a SOAR term, defined](https://aftersoar.com/words/end-of-life): End-of-life in SOAR documentation: a plain definition and a sourced example from Palo Alto Cortex XSOAR's own material. - [Data residency: a SOAR term, defined](https://aftersoar.com/words/data-residency): Data residency in SOAR documentation: a plain definition and a sourced example from Google Security Operations's own material. - [Air-gapped: a SOAR term, defined](https://aftersoar.com/words/air-gapped): Air-gapped in SOAR documentation: a plain definition and a sourced example from Palo Alto Cortex XSOAR's own material. - [Integration count: a SOAR term, defined](https://aftersoar.com/words/integration-count): Integration count in SOAR documentation: a plain definition and a sourced example from Cyware's own material. - [Self-healing integration: a SOAR term, defined](https://aftersoar.com/words/self-healing-integration): Self-healing integration in SOAR documentation: a plain definition and a sourced example from D3 Security's own material. - [MCP server: a SOAR term, defined](https://aftersoar.com/words/mcp-server): MCP server in SOAR documentation: a plain definition and a sourced example from Tines's own material. - [AI playbook builder: a SOAR term, defined](https://aftersoar.com/words/ai-playbook-builder): AI playbook builder in SOAR documentation: a plain definition and a sourced example from Cyware's own material. - [Per-alert pricing: a SOAR term, defined](https://aftersoar.com/words/per-alert-pricing): Per-alert pricing in SOAR documentation: a plain definition and a sourced example from D3 Security's own material. - [Case playbook: a SOAR term, defined](https://aftersoar.com/words/case-playbook): Case playbook in SOAR documentation: a plain definition and a sourced example from Google Security Operations's own material. ## Dispatches - [Mate Labs publishes the Blue City benchmark, without Mate in it](https://aftersoar.com/dispatches/mate-blue-city-benchmark-published): It is a published method for testing agents, and it tests other agents. Mate's AI row does not change, and the accuracy figures stay unscored. - [XSOAR 8.11 reaches end-of-life on 2026-11-13](https://aftersoar.com/dispatches/xsoar-8-11-end-of-life-2026-11-13): Pin your version against the page and write the date down. A team that cannot keep pace with a quarterly cycle has a reason to price a move now. - [Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed](https://aftersoar.com/dispatches/sentinel-leaves-azure-portal-2027-03-31): Sentinel owners have a dated project. Test timing-sensitive automation in Defender now, and decide whether a second automation product is worth the cost. - [ThreatConnect's domain now redirects to Dataminr](https://aftersoar.com/dispatches/threatconnect-domain-redirects-to-dataminr): If you run ThreatConnect Playbooks, ask Dataminr in writing about support, roadmap and the product name, and keep an export of your playbooks. - [Google updates its SecOps playbooks screen documentation](https://aftersoar.com/dispatches/google-secops-playbook-docs-updated): The ZIP is a staging-to-production format, not a way out. If you audit playbook runs from exported data, confirm the case playbooks are in it. - [Torq says IDC named it a Leader in its AI SOC MarketScape](https://aftersoar.com/dispatches/torq-named-leader-idc-marketscape-ai-soc): Torq's scores do not change. If an analyst report decides your shortlist, ask for the report and check how many of its inputs the vendors supplied. - [Mate publishes CPR, its gate for autonomous actions](https://aftersoar.com/dispatches/mate-publishes-cpr-gate-for-autonomous-actions): Mate's approvals row stays at 8.5 for documented controls. The 97 percent figure is not scored, and CPR is described, not independently tested. - [Google SecOps curated rules move to the GTI_IOC feed](https://aftersoar.com/dispatches/google-secops-curated-rules-legacy-feeds): It changes the input to your playbooks, not the playbooks. Review custom rules before the next release cycle. - [Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent](https://aftersoar.com/dispatches/splunk-soar-8-7-0-drops-python-3-9): Any custom function written for Python 3.9 needs conversion before you upgrade. The agent features are Cloud only, so an on-prem team does not get them by upgrading. - [Mate Gamebooks reach general availability](https://aftersoar.com/dispatches/mate-gamebooks-generally-available): Mate's authoring row scores 7.0 as partial, and its migration row 6.0. General availability makes the product testable, and it does not make the migration claim checkable. Ask which source formats it reads. - [Microsoft updates its Splunk SOAR to Sentinel migration guide](https://aftersoar.com/dispatches/microsoft-updates-splunk-soar-to-sentinel-guide): A Splunk SOAR team that already runs Sentinel gets a free checklist of equivalents. Budget the work as a rework of each playbook, and use the map to size it. - [ServiceNow press report puts a Tier 2 SOC AI Specialist in December](https://aftersoar.com/dispatches/servicenow-tier-2-ai-specialist-due-december): ServiceNow's AI row stays at 7.0 on the rubric, which scores documented features, and a scheduled feature is not one. Ask for limits and a release date in writing before you count it. ## Questions and the masthead - [Questions about SOAR platforms and switching](https://aftersoar.com/faq): 30 questions on choosing, renewing and leaving a SOAR, answered in plain words with the rubric behind each answer. - [About After SOAR](https://aftersoar.com/about): What After SOAR is, how a page is made, who publishes it and what the site does not cover. - [Editorial policy](https://aftersoar.com/editorial-policy): How scores are set, how vendors can send corrections, and why a vendor cannot pay to change a score. - [Corrections log](https://aftersoar.com/corrections): A dated log of every correction to After SOAR, starting with first publication on 2026-11-04. - [Contact the editor](https://aftersoar.com/contact): Write to editor@aftersoar.com with corrections, vendor responses or questions about a score. - [Privacy](https://aftersoar.com/privacy): What the host analytics collects, that the site sets no cookies and how to ask a question about data. - [Terms of use](https://aftersoar.com/terms): The terms for using After SOAR pages and the CC BY 4.0 dataset, and the limits of what the pages promise. ## Files - [Dataset, CSV](https://aftersoar.com/data/aftersoar-portability.csv): portability matrix, one row per source, target and playbook type - [Dataset, JSON](https://aftersoar.com/data/aftersoar-portability.json): the same, as JSON - [Feed](https://aftersoar.com/feed.xml): dispatches as RSS