Splunk SOAR (Cisco)
6.68 of 10 on the nine published rows. 3rd of 12 covered, 3rd of 14 scored. SOAR. Scores read 3 November 2026.
Splunk SOAR (Cisco) is a SOAR platform sold in cloud, on-prem and hybrid forms, with a vendor-claimed 300+ third-party tools and 2,800+ actions. Cisco owns it, and Splunk calls it native inside Enterprise Security but licensed separately. Release notes add agents that build playbooks and connectors. They do not decide cases.
What it is
Splunk SOAR (Cisco) is the orchestration product from Splunk, owned by Cisco since the deal closed on 2024-03-18 (SiliconANGLE, read 2026-11-03). Splunk's product page says SOAR is now a native capability within Splunk Enterprise Security and marks a Splunk SOAR subscription as required, and it publishes no price. Cloud release notes add an Automation Builder agent in 8.6.0 and a Connector Builder Agent in 8.7.0, dated 2026-09-02. The agents need Splunk Enterprise Security 8.6 or later and run in Cloud only.
The playbook artefact is Python. The Visual Playbook Editor generates the code, and the classic editor was removed in 6.4.0. A playbook is downloaded as a JSON file. Import takes a .tgz archive, creates a new playbook, and works into the same or a higher Splunk SOAR version and the same editor type (Splunk help pages, read 2026-11-03). The page does not explain how the JSON export relates to the .tgz archive, and no importer from another vendor is documented.
The vendor describes itself this way: Splunk SOAR is a security orchestration and automation platform. It automates security tasks and connects to third-party tools. The product page says it runs in the cloud, on-premises or hybrid. splunk.com, read 2026-11-03 (vendor claim)
How Splunk SOAR (Cisco) scores
Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.
| Row | Score | Weight | Part | Reason and source |
|---|---|---|---|---|
| Playbook authoring model | 8.0 | 14 | 1.12 | Release notes show the classic visual editor was removed in 6.4.0 (2025-02-20) and playbooks are now built in the modern editor with Python; classic playbooks must be converted to edit them visually. help.splunk.com, read 2026-11-03 |
| Integration count and depth documented | 8.0 | 14 | 1.12 | Splunk's blog states 300+ third-party tools and 2,800+ automated actions (vendor claim; read through a search summary, page not opened). splunk.com, read 2026-11-03 (vendor claim) (search summary only) |
| Case management and collaboration | 6.0 | 8 | 0.48 | Microsoft's mapping table lists Splunk containers and cases as the incident and case objects. Collaboration features were not read on a Splunk page. Re-read pending. learn.microsoft.com, read 2026-11-03 |
| Approvals and human-in-the-loop controls | 5.0 | 12 | 0.60 | Approval before actions is documented per a third-party reading of Splunk pages; the Splunk documentation page was not opened. Re-read pending. splunk.com, read 2026-11-03 (search summary only) |
| Agentic or AI features that are documented | 8.0 | 12 | 0.96 | Release notes: Automation Builder agent in 8.6.0 (understands playbooks, builds playbooks), Connector Builder Agent added in 8.7.0 (2026-09-02). Cloud only and needs Splunk Enterprise Security 8.6 or later. The agents build automation; they do not decide cases. help.splunk.com, read 2026-11-03 |
| Hosting and data residency options | 8.0 | 8 | 0.64 | Cloud, on-prem and hybrid per Splunk material; 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions not read. help.splunk.com, read 2026-11-03 |
| Pricing model and transparency | 4.0 | 8 | 0.32 | No price published. Splunk states a SOAR subscription is required in addition to Enterprise Security for orchestration inside ES, so the licence is separate. splunk.com, read 2026-11-03 (search summary only) |
| Migration tooling and import or export formats | 6.0 | 14 | 0.84 | Splunk's help pages, read 2026-11-03, name the formats: a playbook downloads as a JSON file and imports as a .tgz archive, the on-prem to Cloud path says to convert playbooks to Python 3 first, and no export to another SOAR is documented, though Microsoft publishes a concept map from Splunk SOAR to Sentinel. help.splunk.com, read 2026-11-03; learn.microsoft.com, read 2026-11-03 |
| Ownership stability | 6.0 | 10 | 0.60 | Owned by Cisco since the Splunk deal (closing date 2024-03-18 per D3, a competitor). Splunk now describes SOAR as a native capability within Enterprise Security but licensed separately. No end-of-sale notice found. Python 3.9 support ends with the September 2026 release. splunk.com, read 2026-11-03 (vendor claim) (search summary only); help.splunk.com, read 2026-11-03 (vendor claim) (search summary only) |
| Total | 6.68 | 100 | 6.68 | Band 2 on the card; totals within 0.25 are a band, not a ladder. |
Where Splunk SOAR (Cisco) is strong
- Release notes state what the new agents do and where they run: the Automation Builder agent understands and builds playbooks, the Connector Builder Agent arrived in 8.7.0 on 2026-09-02, both are Cloud only and need Enterprise Security 8.6 or later. The agents build automation and do not decide cases. help.splunk.com, read 2026-11-03
- Deployment is documented as cloud, on-prem or hybrid, and 8.6.0 adds FIPS 140-3 for FedRAMP Cloud. Regions were not read. The product page states 300+ third-party tools and 2,800+ automated actions, a vendor claim. help.splunk.com, read 2026-11-03
- Playbooks are Python code generated by the visual editor, so engineers can review them as code, and export and import are documented as JSON download and .tgz upload with a source control repository set on import. help.splunk.com, read 2026-11-03
Where Splunk SOAR (Cisco) is behind
- Splunk calls SOAR a native capability within Enterprise Security but says a Splunk SOAR subscription is required, so the licence is separate and no price is published. No end-of-sale notice was found on the pages read. splunk.com, read 2026-11-03
- The only documented migration path is on-prem to Cloud, and it starts with converting playbooks and custom functions to Python 3. No export to another SOAR product was found. Microsoft publishes a concept map from Splunk SOAR to Sentinel, but it is a map and not a converter. help.splunk.com, read 2026-11-03
- Splunk SOAR on-prem 8.7.0, generally available on 2026-09-02, drops support for Python 3.9. Playbooks created in 6.4.0 and later are not backward compatible with earlier versions. help.splunk.com, read 2026-11-03
A fact only Splunk SOAR (Cisco) has
Splunk SOAR removed its classic visual editor in version 6.4.0, so classic playbooks still run but must be converted to the modern mode before anyone can edit them visually. help.splunk.com, read 2026-11-03
Pricing as published
Subscription. The Splunk pricing page lists Splunk SOAR with a 'Get a quote' button and no price. The product page marks a Splunk SOAR subscription as required. splunk.com, read 2026-11-04
Ownership and funding
Cisco closed its acquisition of Splunk on 2024-03-18 for about $28 billion, at $157 per share in cash. siliconangle.com, read 2026-11-03
Named customers
Recent releases
- 2026-09-02 Splunk SOAR (On-premises) 8.7.0 general availability. Drops support for Python 3.9. help.splunk.com, read 2026-11-03 (vendor claim)
- 2025-11-06 Splunk SOAR (Cloud) release 7.1.0. Adds a Python update required tab for code not migrated and automatic updates to the Visual Playbook Editor and asset configuration pages. help.splunk.com, read 2026-11-04 (vendor claim)
Claims Splunk SOAR (Cisco) makes about itself
These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.
| Claim | Grade | Source |
|---|---|---|
| Tide detects and responds to threats 5x faster with Splunk SOAR | C | splunk.com, read 2026-11-04 (vendor claim) |
What the public pages did not say
- Release date for 8.6.0 conflicts across pages (cloud notes July 21, 2026; on-premises notes August 4, 2026). Found in search snippets, not opened, and not recorded as releases.
- Cloud versus on-premises feature parity not checked.
- Whether SOAR is included with an Enterprise Security subscription: only a competitor page (D3 Security) addresses this, so it is not recorded.
- Splunkbase shows 367 results for the SOAR filter but does not label them as SOAR apps; the app count is unconfirmed.
- No price is published; the pricing page offers a quote and a free trial. Trial length and limits were not read.
- No end-of-sale or end-of-life notice for Splunk SOAR was found in Cisco or Splunk pages and a news search on 2026-11-04. The product page's claim that SOAR is native in Enterprise Security carries no date.
Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.
Who should shortlist Splunk SOAR (Cisco)
- You run Splunk Enterprise Security and want orchestration in the same console, and you accept a separate SOAR subscription.
- Your team writes Python and wants playbooks that exist as reviewable Python code.
- You need on-prem or hybrid hosting, or a FedRAMP cloud option with FIPS 140-3, and can plan around Python version changes.
Verdict. Splunk SOAR (Cisco) is third of 14 scored at 6.68, in a band with Torq (6.77) and D3 Security (6.67), pulled down by pricing and a separate licence; it documents a JSON export and a .tgz import but no export to another SOAR.
Moving playbooks out of Splunk SOAR (Cisco)
Splunk SOAR (Cisco) is a source row in the portability matrix: 29 of 70 cells have a documented path. Source format: JSON playbook export and .tgz import (help.splunk.com, read 2026-11-03). The switching guide is Leaving Splunk SOAR (Cisco).
Splunk SOAR (Cisco) against the other eleven
- BlinkOps v Splunk SOAR (Cisco)
- Cyware v Splunk SOAR (Cisco)
- D3 Security v Splunk SOAR (Cisco)
- Google Security Operations v Splunk SOAR (Cisco)
- Mate Security v Splunk SOAR (Cisco)
- Microsoft Sentinel v Splunk SOAR (Cisco)
- Palo Alto Cortex XSOAR v Splunk SOAR (Cisco)
- ServiceNow Security Operations v Splunk SOAR (Cisco)
- Splunk SOAR (Cisco) v Swimlane (Turbine)
- Splunk SOAR (Cisco) v Tines
- Splunk SOAR (Cisco) v Torq
Alternatives to Splunk SOAR (Cisco), ordered by the rubric.