Buyer's Guide: Security Orchestration and Automation (SOAR) Platforms

Executive Summary

Security orchestration, automation and response (SOAR) software runs your incident response steps as playbooks. A playbook takes an alert, gathers context from other tools, opens or updates a case, and carries out response actions such as blocking an address or disabling an account, with a person approving the steps you choose. Choose a platform on two things: whether the automation should live inside the SIEM you already run or sit across all your tools, and who on your team will build and maintain the playbooks.

The products differ most in where they live. Several SIEM vendors now ship SOAR as part of the SIEM, so the automation sees the same alerts and cases the analysts work in. Separate automation platforms connect to any SIEM, endpoint, identity and ticketing tool through their own integrations. Some lead with AI agents that triage alerts before a person sees them; others lead with a visual builder or with code.

Small teams can start without a purchase. Several vendors publish a free tier with a hard limit on workflows or actions per day, and one open source platform can be run on your own servers. Use a free tier to automate one high-volume task end to end, and count how many actions it takes per day before you compare paid plans.

What Is Security Orchestration and Automation?

Security orchestration connects your security tools so that one procedure can use all of them. Security automation runs that procedure without a person doing each step. A SOAR platform does both, and records what it did in a case. CACAO defines a playbook as a workflow for security orchestration containing a set of steps (security actions) to be performed based on a logical process, which may be executed ad-hoc, periodically, or triggered by an automated or manual event or an observation.

Playbooks are not tied to one product. CACAO states that playbooks can be written by the organization, an entity external to the organization, a sharing community, or a vendor. CACAO states that shared playbooks may, even though rarely, be immediately actionable, but that most will not be immediately usable or supported in the recipient's organization due to environmental differences and will require some amount of modification to make them operational. Expect to adapt every template you download to your own tools, field names and approval rules.

Write the procedure before you automate it. CISA presents two playbooks: one for incident response and one for vulnerability response. CISA states that these playbooks provide FCEB agencies with a standard set of procedures to identify, coordinate, remediate, recover, and track successful mitigations from incidents and vulnerabilities affecting FCEB systems, data, and networks. A written procedure tells you which steps a machine can take, which need a person, and what evidence each step must leave behind. MITRE describes D3FEND as a knowledge graph of cybersecurity countermeasures. Use it to check which response actions your playbooks cover, and which they miss.

SOAR is moving into the SIEM. Splunk states that Splunk SOAR is now a native capability within Splunk Enterprise Security. Microsoft states that Microsoft Sentinel, in addition to being a SIEM system, is also a platform for security orchestration, automation, and response (SOAR). Google states that Google SecOps includes full fledged security orchestration, automation and response (SOAR) capabilities, with playbooks that automate common response actions, orchestration of over 300 tools, and an auto-documenting case wall. Rapid7 states that embedded SOAR capabilities help teams operationalize security across SOC, incident response, vulnerability remediation, and compliance workflows. If your SIEM already includes automation, price that first, then decide whether a separate platform adds enough to justify a second console.

Ownership and product names have changed. Cisco announced it completed the acquisition of Splunk. Google Cloud announced the acquisition of Siemplify, a security orchestration, automation and response (SOAR) provider. Google states that Chronicle SOAR is being rebranded to Google Security Operations (Google SecOps). Microsoft states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Ask each vendor which console, API and license your contract covers, and for how long.

SOAR overlaps with AI SOC agents. An AI SOC agent investigates an alert and proposes or takes a decision; a SOAR playbook carries out a defined procedure. Several vendors below now sell both on one platform. Decide which decisions you will let software make alone, and buy the product that lets you set that limit per playbook.

SOAR in Your SIEM, or a Separate Automation Platform?

Start with the SIEM you already run. If it includes automation rules and playbooks, those see the same incidents and entities your analysts use, and no second set of credentials or cases is needed. The limit is reach: SIEM-based automation works best on the vendor’s own data and on the tools its connectors cover.

A separate automation platform connects to every SIEM, endpoint, identity, email and ticketing tool you run, and outlives a SIEM migration. It costs a second console, a second set of integrations to maintain and a second license. Choose it when you run several detection tools, expect to change your SIEM, or want IT and security teams to share one automation tool.

Building your own from scripts and a workflow engine is possible and cheap to start. It is expensive to keep: you own every integration, the approval steps, the audit trail and the on-call rota for the scripts. An open source platform sits between the two, with integrations and a builder already written, and your team running the servers.

How do you evaluate Security Orchestration and Automation (SOAR) Platforms?

Start with integrations, and count actions rather than connectors. Palo Alto Networks lists 900+ prebuilt integration and automation packs, 1,000s of security actions for DIY playbooks, and a visual playbook editor for code-free automation. Splunk states that Splunk SOAR orchestrates your security stack by connecting with 300+ third-party tools and supporting 2,800+ automated actions. Torq lists 300 pre-built integrations and 4,000+ pre-built steps in the Torq AI SOC Platform. Rapid7 states that with over 300 plugins, Automation (InsightConnect) makes it easy to integrate your tools. For each tool you own, ask which actions the integration can take, which it can only read, and who updates it when the tool’s API changes.

Then decide who builds playbooks. Splunk states that Splunk SOAR's Visual Playbook Editor simplifies the playbook creation process by allowing you to assemble custom workflows with prebuilt code blocks. Swimlane describes Turbine Canvas as a low-code playbook and agent building studio. Rapid7 states that Automation (InsightConnect) combines a purpose-built security workflow automation platform with a user-friendly, no-code workflow builder. Google describes Google Security Operations SOAR as an automation platform designed to help organizations streamline and accelerate threat detection, investigation, and response. Tines defines stories as a collection of interconnected actions working towards a singular mission that can be automated, analogous to playbooks, use-cases, or workflows. A visual builder lets analysts change a playbook; a code-driven one gives engineers version control and tests. Ask to see a playbook changed, tested and rolled back during the trial.

Keep a person on the actions that can do harm. Rapid7 states that human decision steps pause your workflow until a member of your team provides expert input. Torq offers agentic response, either completely autonomously or with human-on-the-loop oversight. Swimlane states that the intelligent routing layer in Swimlane AI SOC acts as a dispatcher, routing alerts to deterministic playbooks, AI-assisted investigations or fully agentic investigations. Write down which actions run alone, which wait for approval, and who approves out of hours.

Cases and records come next. Palo Alto Networks lists a virtual war room for incident investigation and collaboration, ChatOps and CLI for on-the-fly investigation, and auto-documentation for knowledge sharing and audit reporting. Torq states that Case Management is native to the Torq platform, with evidence, timelines, and case summaries. Microsoft Sentinel uses automation rules to manage incident handling automation from a central location, and the rules can automatically tag, assign, or close incidents without a playbook. The case should show every automated step, its input and its result, so an auditor can follow what happened without asking the engineer.

Deployment and tenancy close the list. Splunk SOAR can be deployed via the cloud, on-premises or hybrid. Tines lists Paid editions with unlimited workflows, flexible deploy options and bring your own AI model. If you must keep data on your own servers, or you serve several clients, confirm the deployment model and tenant separation in writing before the trial.

Vendors in Security Orchestration and Automation (SOAR) Platforms

Representative vendors include Google Security Operations / Chronicle SOAR, Microsoft Sentinel, Palo Alto Cortex XSOAR, Rapid7 InsightConnect (Automation), Splunk SOAR, now Cisco, Swimlane Turbine, Tines and Torq. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The approaches below follow two questions: where does the automation live, and who is expected to build the playbooks? Those answers separate the products more than integration counts do.

One approach is a SOAR platform sold on its own, with a large content library. Palo Alto Networks lists 900+ prebuilt integration and automation packs, 1,000s of security actions for DIY playbooks, and a visual playbook editor for code-free automation. Palo Alto Networks lists a virtual war room for incident investigation and collaboration, ChatOps and CLI for on-the-fly investigation, and auto-documentation for knowledge sharing and audit reporting. Palo Alto Networks states that it partners with hundreds of Managed Service Providers worldwide to offer security automation as a service.

Two SIEM vendors now ship SOAR inside the SIEM. Splunk states that Splunk SOAR is now a native capability within Splunk Enterprise Security. Splunk SOAR can be deployed via the cloud, on-premises or hybrid. Cisco announced it completed the acquisition of Splunk. Google describes Google Security Operations SOAR as an automation platform designed to help organizations streamline and accelerate threat detection, investigation, and response. Google's Standard package includes the core capabilities for data ingestion, threat detection, investigation and response with 12 months hot data retention, full access to 700+ parsers and 300+ SOAR integrations and 1 environment with remote agent. Google states that Chronicle SOAR is being rebranded to Google Security Operations (Google SecOps).

The third approach builds automation from two parts. Microsoft Sentinel uses automation rules to manage incident handling automation from a central location, and the rules can automatically tag, assign, or close incidents without a playbook. In Microsoft Sentinel, playbooks are based on workflows built in Azure Logic Apps. Microsoft states that Azure Logic Apps creates separate resources, so additional charges might apply. Microsoft states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal.

Another approach is a general workflow platform that security teams use for SOAR. For SOAR, Tines lists deterministic playbooks for controlled responses and fast remediation. Tines defines stories as a collection of interconnected actions working towards a singular mission that can be automated, analogous to playbooks, use-cases, or workflows. Tines states that it connects to the tools your team already runs on, and to any other system you can reach on a network, from APIs and MCP servers to webpages and databases.

One approach leads with AI agents. Torq describes its product as the AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. Torq states that Torq Hyperautomation simplifies, unifies, and accelerates workflow automation at scale using integrations with your security stack. Torq offers agentic response, either completely autonomously or with human-on-the-loop oversight.

Another pairs low-code playbooks with case management and AI routing. Swimlane states that Swimlane Turbine combines agentic AI with deterministic security automation, giving teams one platform to run their own detections, investigate alerts, orchestrate response, and automate workflows at enterprise scale. Swimlane describes Turbine Canvas as a low-code playbook and agent building studio. Swimlane states that the intelligent routing layer in Swimlane AI SOC acts as a dispatcher, routing alerts to deterministic playbooks, AI-assisted investigations or fully agentic investigations.

The last approach sells automation as part of a security suite. Rapid7's documentation names the product Automation (InsightConnect) and describes it as a SOAR (security orchestration, automation, and response) solution. Rapid7 states that Automation (InsightConnect) combines a purpose-built security workflow automation platform with a user-friendly, no-code workflow builder. Rapid7 states that embedded SOAR capabilities help teams operationalize security across SOC, incident response, vulnerability remediation, and compliance workflows.

These are the eight products the guide evaluated before this edition, kept so that every badge stays valid, and placed in seven approaches that were written before any product was assigned; two SIEM vendors share one. No row is for sale. The field is wider, including open source projects and SOAR from managed service providers, and any vendor can make its own case in the Spotlight below.

Which SOAR Tools Are Affordable for Small Security Teams?

Three of the vendors named here publish a free way to start, each with a hard limit. Tines lists a Free edition for experimenting with intelligent workflows, with unlimited users, spaces, and connectors, 3 live workflows and a one time $50 AI allowance. Splunk states that you can take up to 100 actions/day in the Splunk SOAR free community edition. Shuffle states that you can start automating for free, and lists Free / month for 2k App Runs. Shuffle offers free plans on Shuffle Cloud or onPrem. Shuffle describes itself as an open source automation platform, built for and by the security professionals. Shuffle itself is licensed under AGPLv3. A free tier suits one or two playbooks. Count the actions or runs your first playbook uses in a busy week before you rely on one.

Inside a SIEM, automation is priced with the SIEM. Google Security Operations is available in packages and based on ingestion. Google's Standard package includes the core capabilities for data ingestion, threat detection, investigation and response with 12 months hot data retention, full access to 700+ parsers and 300+ SOAR integrations and 1 environment with remote agent. Microsoft offers up to 5 MB of free Microsoft Sentinel data ingestion daily per user for key security logs. Microsoft states that Azure Logic Apps creates separate resources, so additional charges might apply. Ask for the cost of the automation runs on their own, so you can compare it with a separate platform.

For paid plans, the pages cited here give units and options rather than prices. Tines lists Paid editions with unlimited workflows, flexible deploy options and bring your own AI model. Swimlane states that most customers find their plan within its tiered enterprise and MSSP pricing options. Swimlane offers a custom plan or user-based pricing through its sales team. Ask every vendor which unit it counts: users, workflows, actions, runs or ingested data. Then price the same three playbooks at your expected alert volume for three years.

The license is rarely the largest cost. Building integrations, writing playbooks and fixing them when tools change take engineering time every month. Put that time in the comparison, and ask each vendor what its professional services charge to build the first playbooks.

Rollout: the First 90 Days

Automate procedures you already follow. Pick two that run many times a week and that analysts agree on, and do not add a third until both run without help.

What should you ask vendors about Security Orchestration and Automation (SOAR) Platforms?

Ask each vendor to answer in writing and to run one of your procedures live.

Related Resources