Splunk SOAR (Cisco)
Splunk SOAR, owned by Cisco, publishes 2,800+ automated actions across 300+ third-party tools and deploys in the cloud, on premises or hybrid. It places sixth of 14 at 5.79, with 19 of 25 containment actions documented. The product page states no approval, rollback or audit trail, and customer claims have no method.
What Splunk SOAR (Cisco) is
Splunk SOAR is a security orchestration and automation platform that automates tasks and connects to third-party tools. Cisco closed its acquisition of Splunk on 2024-03-18 (siliconangle.com, read 2026-11-03).
Playbooks are built in a Visual Playbook Editor that needs no code, and the Python Editor tab shows the Python the visual playbook generates (help.splunk.com, read 2026-11-04). The product page says SOAR is a native capability within Splunk Enterprise Security, and a Splunk SOAR subscription is required.
vendor claim Splunk SOAR is a security orchestration and automation platform. It automates security tasks and connects to third-party tools. The product page says it runs in the cloud, on-premises or hybrid. splunk.com, read
Products named: Splunk SOAR.
Ownership. Cisco closed its acquisition of Splunk on 2024-03-18 for about $28 billion, at $157 per share in cash. siliconangle.com, read
no figureon the pages read
Published time to contain
No figure on time to contain, or on any adjacent response metric, was found for Splunk SOAR (Cisco) on the pages read. Page returned 404 on the read date.
19 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Splunk SOAR (Cisco) documents 19 as native or partner on the pages read: 18 native, 1 partner, 0 custom step only, 6 not documented. Coverage share is 76 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Splunk SOAR (Cisco)19 of 25 documented | Splunk SOAR (Cisco): Require MFA re-enrolment, not documented | Splunk SOAR (Cisco): Quarantine a delivered message, not documented | Splunk SOAR (Cisco): Pull from quarantine, not documented | Splunk SOAR (Cisco): Revoke cloud session, not documented | Splunk SOAR (Cisco): Revoke OAuth app consent, not documented | Splunk SOAR (Cisco): Add to a threat list on the NDR, not documented | |||||||||||||||||||
Basis: Action lists in the README of each Splunk SOAR connector repository (the source of the Splunkbase app page). Publisher field read as native when 'Splunk', partner when another vendor. Read 2026-11-03.
Limits: Gmail, Google Workspace, Proofpoint action apps and Vectra were not found in the connector organisation under the names tried.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.79rank 6 of 14
Rubric scores
Splunk SOAR (Cisco) is in a band with Cyware (6.11), Google Security Operations (6.09), Palo Alto Cortex XSOAR (5.91), Swimlane (Turbine) (5.84), Torq (5.74), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 7.7 | 1.925 | documented. 19 of 25 containment actions documented as native or partner (76 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 5.5 | 0.825 | partial. Customer claims only: Tide "minutes to respond ... compared to hours previously" and "up to 95% of incident responses automated", no method; the 7-minute figure is detection, not containment. vendor claim splunk.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 3.0 | 0.450 | not documented. No approval, rollback or blast-radius control is stated on the page read. splunk.com, read |
| Explanation and audit trail | 15 | 4.0 | 0.600 | not documented. Page names "Comprehensive case management" but describes no audit trail or per-action record. splunk.com, read |
| Integration depth documented | 10 | 8.5 | 0.850 | documented. Page states "2,800+ automated actions" and "300+ third-party tools", both a tool count and an action count. vendor claim splunk.com, read |
| Detection-to-response coupling | 8 | 6.0 | 0.480 | partial. Page says SOAR consolidates "alerts and data from the various tools in your environment" and that Enterprise Security integration needs a Splunk SOAR subscription; whether a SIEM is required is not stated. splunk.com, read |
| Pricing transparency | 6 | 4.5 | 0.270 | not documented. No prices; a free trial with no credit card is offered. splunk.com, read |
| Deployment and data handling | 6 | 6.5 | 0.390 | partial. Page says deployment is "via the cloud, on-premises or hybrid"; data handling, retention and residency are not stated. splunk.com, read |
| Total | 100 | 5.79 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Splunk SOAR (Cisco) is strong
- Vendor claim: the product page states 2,800+ automated actions and 300+ third-party tools. The page gives both counts together. splunk.com, read
- The page says deployment is via the cloud, on premises or hybrid. Data handling, retention and residency are not stated. splunk.com, read
- In Splunk Enterprise Security 8, SOAR users can run playbooks and actions from the Analyst Queue, and a Response Plan feature defines phases and tasks inside an investigation, according to a Splunk community post. community.splunk.com, read
Where Splunk SOAR (Cisco) is behind
- Time-to-contain evidence: customer claims only. Tide says minutes to respond compared with hours before, and up to 95 percent of incident responses automated, with no method. A 7-minute figure on the page is detection, not containment, and the linked Tide story title says 5x faster. splunk.com, read
- No approval, rollback or blast-radius control is stated on the page read, so the page does not tell a reader how a bad automated action is gated or undone. splunk.com, read
- The page names case management but describes no audit trail or per-action record. It also states no price, and offers a quote and a free trial whose limits were not read. splunk.com, read
What only Splunk SOAR (Cisco) has
Splunk SOAR Cloud release 7.1.0 on 2025-11-06 added a Python update required tab on the Playbooks, Apps and Custom Function pages that lists code that could not be migrated. help.splunk.com, read
nonelisted
Pricing as published
vendor claim Subscription. The Splunk pricing page lists Splunk SOAR with a 'Get a quote' button and no price. The product page marks a Splunk SOAR subscription as required. splunk.com, read
Trial or free tier. The Splunk pricing page links a Splunk SOAR free trial (splunk.com/en_us/download/soar-free-trial.html). Trial length and limits were not read. splunk.com, read
Integrations. 300 published as a count. vendor claim splunk.com, read
2names on its pages
Named customers
Customers below are names on Splunk SOAR (Cisco)'s own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- Tide, Novuna. splunk.com, read
2dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-09-02 | Splunk SOAR (On-premises) 8.7.0 general availability. Drops support for Python 3.9. | vendor claim help.splunk.com, read |
| 2025-11-06 | Splunk SOAR (Cloud) release 7.1.0. Adds a Python update required tab for code not migrated and automatic updates to the Visual Playbook Editor and asset configuration pages. | vendor claim help.splunk.com, read |
1graded
Claims Splunk SOAR (Cisco) makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Tide detects and responds to threats 5x faster with Splunk SOAR | one customer (Tide). Measured by vendor. | C | vendor claim splunk.com, read |
Who should shortlist Splunk SOAR (Cisco)
- You run Splunk Enterprise Security and want SOAR inside the same analyst workflow.
- You want a published action count to check against your own list in a pilot.
- You need cloud, on-premises or hybrid deployment and a free trial before you talk to sales.
Splunk SOAR (Cisco) places 6th of 14 at a total of 5.79, with 19 of 25 containment actions documented. A broad action library, with 19 of 25 containment actions documented and a choice of cloud, on-premises or hybrid deployment. Approval, rollback and audit trail are not stated on the product page. It shares a band with Cyware, Google Security Operations, Palo Alto Cortex XSOAR, Swimlane, Torq and Tines, so the order inside it is not settled by the evidence.
The same platform under other weights
- Regulated financial: 8th of 14, total 5.37.
- Lean team: 4th of 14, total 5.84.
- MSSP: 3rd of 14, total 6.02.
- Microsoft estate: 6th of 14, total 5.81.
- CrowdStrike estate: 6th of 14, total 5.89.
Compare Splunk SOAR (Cisco)
- Splunk SOAR (Cisco) alternatives: 3 gaps and 5 platforms that answer them.
- Splunk SOAR (Cisco) against Swimlane (Turbine), totals 5.79 and 5.84.
- Splunk SOAR (Cisco) against Torq, totals 5.79 and 5.74.
- Splunk SOAR (Cisco) against Palo Alto Cortex XSOAR, totals 5.79 and 5.91.
- Splunk SOAR (Cisco) against Tines, totals 5.79 and 5.62.
Facts on this page were read 2026-11-03 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.