SOAR
SOAR stands for security orchestration, automation and response. It is software that runs scripted steps across security tools when an alert arrives, tracks the case and records what was done. A SOAR executes logic written in advance, which is the main difference from the agent-run platforms now sold against it.
What SOAR means
The term covers three jobs. Orchestration connects tools through integrations. Automation runs steps without a person. Response tracks the incident as a case that analysts can work, assign and close.
Buyers compare SOARs on how playbooks are authored, how many integrations ship, how approvals work and how content leaves. Those questions drive most of the nine criteria After SOAR scores.
SOAR in Splunk SOAR's own words
Splunk's product page says Splunk SOAR integrates across 300+ third-party tools and supports 2,800+ automated actions, a vendor claim with no measurement date. Splunk SOAR documentation, read 2026-11-03