In short: Splunk SOAR is the security orchestration, automation and response platform from Splunk, a Cisco company. It runs playbooks that enrich alerts, query tools and take response actions through apps and connectors, with case management for analysts. It is sold standalone, in the cloud or on premises, and is built natively into Splunk Enterprise Security Premier.
What is Splunk SOAR?
A typical phishing or malware alert needs the same ten steps every time: look up the sender, detonate the attachment, check the URL reputation, find who else received it, check the endpoint, and so on. Splunk SOAR (formerly Splunk Phantom) automates those steps. It receives an event from a SIEM, an email inbox, an XDR or any tool with an API, runs a playbook against it and records everything it did in a case.
Splunk describes hundreds of third-party tool integrations and thousands of supported automated actions. The aim is not to remove analysts but to give them a pre-investigated case with the evidence already gathered.
Typical first uses include phishing triage, enriching endpoint and firewall alerts with reputation and asset data, checking suspicious sign-ins against identity tools, and routine tasks such as disabling a leaver's accounts or blocking a list of indicators across several controls at once. Because every action is logged in the case, SOAR also gives you a consistent audit trail of who did what during an incident.
How Splunk SOAR works
- Playbooks: automated workflows assembled from prebuilt blocks in the visual playbook editor, with custom code where needed, and prebuilt playbooks that draw on the MITRE ATT&CK and D3FEND frameworks
- Apps and connectors: packaged integrations that let playbooks run actions such as 'lookup IP', 'detonate file', 'block domain' or 'disable user' on security, IT and cloud tools
- Case management: events become cases with tasks, assignments, notes, evidence and an audit trail, so analysts can split the work and document the response
- Human approval steps: playbooks can pause for an analyst to approve high-impact actions, such as isolating a server
- Deployment choices: Splunk SOAR runs in the cloud, on premises or in a hybrid model
Splunk SOAR and Cisco security
SOAR becomes more valuable the more tools it can act on, and the Cisco portfolio offers plenty of them:
- Cisco XDR: Cisco says incidents verified by XDR's Instant Attack Verification can run prebuilt playbooks in Splunk SOAR, with or without a human in the loop
- Splunk Enterprise Security: in ES Premier, SOAR is a native capability, and ES 8.6 added a Guided Response agent that runs SOAR actions or playbooks on findings and an Automation Builder agent that turns plain-language ideas into tested playbooks
- Cisco Secure products: where a supported SOAR app exists, playbooks can act on Cisco tools, for example isolating a host through Secure Endpoint, blocking a destination at the firewall or DNS layer, or changing a device's access through Cisco ISE
- Splunk Attack Analyzer: SOAR can send files and URLs for automated analysis and act on the verdict, without you building complex detonation playbooks yourself
We check each app's current version and support status on Splunkbase before designing a playbook around it.
Standalone SOAR or SOAR inside ES Premier?
| Standalone Splunk SOAR | SOAR in Splunk ES Premier | |
|---|---|---|
| How you buy it | Its own subscription | Included in the Premier edition of Splunk Enterprise Security |
| Event sources | Any SIEM, XDR, mailbox or tool with an API | Native to ES findings and investigations, plus other sources |
| Analyst experience | SOAR's own case interface | Automation and response plans inside the ES analyst workflow |
| Best for | Organisations using another SIEM or XDR-first teams | Teams standardising on Splunk ES |
If you already run, or plan to run, Splunk Enterprise Security, Premier is usually the simpler route. If your detection comes from Cisco XDR or another SIEM, standalone SOAR is the better fit.
Start with a few high-value playbooks
The most common SOAR failure is trying to automate everything at once. We recommend starting small:
- Pick two or three high-volume, low-judgement workflows: phishing triage, malware alert enrichment and suspicious sign-in checks are good first candidates
- Write down the manual steps your analysts take today, and which tools each step touches
- Automate enrichment first: lookups and evidence gathering carry little risk and save the most time
- Add response with approval: introduce containment actions behind an analyst approval step
- Measure and tune: track how often each playbook runs, how often analysts override it and where it fails, then remove the approval step only where you trust the outcome
- Expand gradually to more use cases and integrations
How we help
We map your current alert handling, choose between standalone SOAR and ES Premier, connect your Cisco and third-party tools, build and test the first playbooks with your team and document how to maintain them. Ask us for a quote. Contact us using the form.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Splunk SOAR used for?
Splunk SOAR automates the repetitive parts of security investigations and response. Playbooks enrich alerts, query security and IT tools, and take actions such as blocking domains or isolating devices, while case management records the work.
Is Splunk SOAR the same as Splunk Phantom?
Yes. Splunk acquired Phantom in 2018 and the product is now Splunk SOAR.
Is Splunk SOAR included in Splunk Enterprise Security?
SOAR is built natively into the Premier edition of Splunk Enterprise Security. It is also sold as a standalone product that works with other SIEMs and XDR platforms.
Does Splunk SOAR integrate with Cisco XDR?
Yes. Cisco says incidents verified by Cisco XDR can run prebuilt playbooks in Splunk SOAR for response, with or without an analyst approving each step.
Can Splunk SOAR run on premises?
Yes. Splunk says SOAR can be deployed in the cloud, on premises or in a hybrid model.