Bundled SOAR
A bundled SOAR is orchestration sold as a feature of a larger platform, such as a SIEM or an ITSM suite. It changes how the product is bought and run. The risks are a licence you cannot separate and a roadmap that follows the parent product.
What Bundled SOAR means
Buyers should ask whether the capability is included, sold as a separate subscription or only available at a higher tier. Splunk, Google and ServiceNow answer differently.
Bundling is not a defect. A team that lives in the parent console may prefer it. The point is to read the contract before the demo.
Bundled SOAR in Splunk SOAR's own words
Splunk says SOAR is now a native capability within Enterprise Security and marks a Splunk SOAR subscription as required, so the capability sits in the console and is sold separately. Splunk SOAR documentation, read 2026-11-03