Splunk SOAR (Cisco) vs Tines
Splunk SOAR (Cisco) is a Cisco-owned SOAR product sold alone or with Splunk Enterprise Security. Tines is a no-code workflow platform with a Cases add-on and an AI SOC page. They split on published time-to-contain evidence, where the rubric reads Splunk SOAR (Cisco) as partial and Tines as not documented on the pages read on 2026-11-03.
0.17points apart
The difference that decides it
On published time-to-contain evidence, Splunk SOAR (Cisco) offers customer claims only, such as Tide responding in minutes instead of hours, with no method, while Tines publishes no MTTR or containment figure. splunk.com, read
8criteria
Rubric side by side
| Criterion | Weight | Splunk SOAR (Cisco) | Tines | Gap, first minus second |
|---|---|---|---|---|
| Native containment coverage (19 and 22 of 25 actions) | 25 | 7.7 | 8.6 | -0.9 |
| Published time-to-contain evidence with method | 15 | 5.5 | 3.0 | +2.5 |
| Approval, rollback and blast-radius controls documented | 15 | 3.0 | 3.5 | -0.5 |
| Explanation and audit trail | 15 | 4.0 | 5.0 | -1.0 |
| Integration depth documented | 10 | 8.5 | 6.5 | +2.0 |
| Detection-to-response coupling | 8 | 6.0 | 6.5 | -0.5 |
| Pricing transparency | 6 | 4.5 | 5.5 | -1.0 |
| Deployment and data handling | 6 | 6.5 | 4.0 | +2.5 |
| Total | 100 | 5.79 | 5.62 | 0.17 |
Full reasons and sources for every score are on the profiles of Splunk SOAR (Cisco) and Tines.
3.0 : 3.5approval score each
Approval and rollback controls
Splunk SOAR (Cisco). No approval, rollback or blast-radius control is stated on the page read. splunk.com, read
Tines. The product page says Agents enable "autonomous workflow activity and user interaction" but states no approval step, rollback or scope limit. tines.com, read
19 : 22actions of 25
Containment coverage by domain
| Domain | Splunk SOAR (Cisco) | Tines |
|---|---|---|
| EDR | 6 of 6 | 6 of 6 |
| Identity | 4 of 5 | 5 of 5 |
| 3 of 5 | 4 of 5 | |
| Cloud | 3 of 5 | 4 of 5 |
| Network | 3 of 4 | 3 of 4 |
| All five | 19 of 25 | 22 of 25 |
Published time to contain: Splunk SOAR (Cisco), no published figure; Tines, no published figure.
5buyer types
Verdict by buyer type
- regulated financial
- Neither separates itself on published approval and audit detail. Splunk SOAR (Cisco) states neither approval controls nor an audit trail on the pages read; Tines states neither an approval step nor an audit log on the pages read. Ask both for the control documentation in writing.
- lean team
- Tines is easier to size up before a call: it publishes a free edition with 3 live workflows. Splunk SOAR (Cisco) offers a free trial with no credit card but no price list.
- MSSP
- Neither Splunk SOAR (Cisco) nor Tines states MSSP terms on the pages read. Ask both for multitenant approval settings and per-client audit exports.
- Microsoft estate
- Only Tines says anything specific: it lists Microsoft and Microsoft Teams in its story library. Splunk SOAR (Cisco) states no Microsoft-specific detail on the pages read.
- CrowdStrike estate
- Only Tines says anything specific: it lists CrowdStrike in its story library. Splunk SOAR (Cisco) states no CrowdStrike-specific detail on the pages read.
When to pick each
Pick Splunk SOAR (Cisco) when connector count and breadth matter most, because it states 2,800+ automated actions and 300+ third-party tools, a tool count and an action count.
Pick Tines when detection and response should arrive in one product, because it accepts automated webhook notifications and does not mention a SIEM.
Read dates are on each source link. See also Splunk SOAR (Cisco) alternatives and Tines alternatives, or the buyer-type rankings.