A SOAR (security orchestration, automation, and response) tool is a security automation platform that responds to threat alerts, such as phishing reports, malware detections, or suspicious logins. It plugs into the tools that raise those alerts, usually a SIEM or an EDR tool. From there, security teams write a playbook for each alert type, outlining exactly what should happen.
When an alert fires, the tool runs the matching playbook. It gathers details about the IP address, user, or device involved, then takes action by blocking the IP, isolating the device, or locking the account. For riskier steps, the playbook can pause and wait for an analyst's approval.
Security teams adopted SOAR because their SIEMs were generating more alerts than analysts could handle. Most of those alerts require the same handful of steps each time, making them easy to automate.
Playbooks break down when an alert doesn't fit a pattern someone planned for. A new kind of attack won't match the rules in the playbook, so an analyst has to investigate by hand. That means pulling records from the SIEM, the EDR tool, and the login system to piece together what happened.
A SIEM collects log data from servers, firewalls, cloud services, and applications, then raises alerts.
A SOAR tool responds to those alerts by running playbooks.
In practice, the security team writes detection rules in the SIEM. When an event matches a rule, the SOAR tool picks up the alert and runs the playbook the team wrote for it. Most SOCs run both.
The SOAR acts only on data the SIEM holds, so a log source the team never ingested stays invisible to both. Agentic SOC platforms combine the two jobs, searching log data directly and using AI agents to investigate and respond, all within one platform.
The seven platforms in this guide fall into two groups:
Disclosure. Strike48 publishes this guide, and we include our own platform on the list. We scored every platform on the same criteria and explain our methodology after the comparison tables.
Each platform has a full entry below with key features, strengths, watch-outs, pricing, and reviews.
Strike48 is an agentic log intelligence platform from Devo Technology, launched in January 2026. It runs on the log analytics infrastructure Devo has built for Fortune 500 companies over more than a decade. Strike48 calls it the first platform of its kind.
Key features.
Strengths. Agents can search every log source before they start an investigation. In early deployments, MTTD dropped below eight minutes. Agents also found active phishing campaigns that the customer's existing SIEM had missed, then wrote and tested new alert rules so the same attack wouldn't work twice.
Strike48 gives each agent a narrow job to limit hallucinations, the cases where an AI invents a wrong answer. Its agentic AI SOC architecture runs routine steps, such as looking up an IP address, as fixed scripts, so they give the same result every time and leave a record.
Watch-outs. Agents can still reason incorrectly, which is why Strike48 routes high-impact actions to an analyst for approval. With no third-party reviews yet, buyers have to judge the platform on demos and early deployment results. On-premises and air-gapped deployments take weeks.
Pricing. Strike48 doesn't list prices publicly. Buyers get a quote through a demo-led sales process.
Reviews. Strike48 has no G2 or Gartner Peer Insights reviews yet, which fits its January 2026 launch.
Tines is a no-code security workflow automation platform founded in Dublin in 2018. Its customers include Canva, Databricks, Elastic, Intercom, Kayak, and McKesson. Analysts build Stories, Tines's name for playbooks, by chaining actions on a visual canvas.
Key features.
Strengths. The free Community Edition lets a team test a phishing triage story before procurement gets involved.
Watch-outs. Practitioners in a Reddit comparison thread point out that no-code doesn't mean no skill. Building a story with lots of branching and proper error handling still takes real engineering know-how. Tines doesn't store logs itself, so its stories can only work with data the connected SIEM and EDR already hold.
Pricing. According to Tines's published pricing page, the free Community Edition includes one builder seat and a limited number of stories. The Starter Edition costs about $500 per month, billed annually, and the sales team quotes Business and Enterprise tiers.
Reviews. G2 rates Tines 4.7/5 (430 reviews), checked in early 2026.
Torq is a SOC automation platform founded in 2020 by Ofer Smadari, Leonid Belkind, and Eldad Livni. In its HyperSOC platform, teams build workflows and assign tasks to AI agents, which execute them across connected tools and report back. Torq designed the platform to process very large numbers of alerts quickly.
Key features.
Strengths. Torq logs everything its agents do, and analysts can step in and undo an agent's action. Customers such as T-Mobile, Chipotle, and Blackstone run Torq at enterprise scale.
Watch-outs. G2 reviewers cite a steep initial learning curve, complex pricing with high enterprise entry costs, and workflows stacked inside other workflows that are hard to troubleshoot. Torq's agents work with whatever the connected SIEM and EDR collect, so anything those tools miss stays out of reach.
Pricing. Torq sells custom enterprise contracts with no public list price. Its AWS Marketplace listing shows 12-month contract tiers (Essential, Enterprise, Elite), starting at roughly $450,000 per year.
Reviews. Reviewers on Torq's G2 profile mostly discuss how much automation can handle and how well it scales as volume grows. This guide couldn't confirm an aggregate star rating.
Cortex XSOAR is Palo Alto Networks' enterprise SOAR platform. It started as Demisto, which the company acquired in March 2019, and it integrates with Cortex XDR and other Palo Alto products. Some customers run it across more than 65,000 devices.
Key features.
Strengths. G2 reviewers point to deep customization, the size of the integration catalog, and the depth of task automation for incident response. Teams already using Cortex XDR can skip most of the setup, because the two products connect out of the box.
Watch-outs. A mature deployment takes several quarters, and per-user licensing puts XSOAR near the top of this list's cost range. Complex playbooks also leave the team with many automations to maintain, and each one needs to be updated whenever a connected tool changes how it works.
Pricing. Palo Alto Networks licenses XSOAR on a per-user, per-year basis and offers a free Community Edition for small-scale, non-commercial use, according to its Cortex XSOAR licensing documentation. According to UnderDefense's Palo Alto pricing guide, the Enterprise list price is around $250,000 per year.
Reviews. Third-party comparison sites report an XSOAR rating of about 4.6/5 on G2 (28 reviews) as of early 2026.
Splunk SOAR started life as Phantom, which Splunk bought in 2018 and later renamed. It's built to work closely with Splunk's other products, so it fits teams that already use Splunk as their SIEM.
Key features.
Strengths. Reviewers highlight the depth of the automation, the number of tools it connects to, and a community playbook library built up over years. In a Splunk shop, analysts see the alert, the underlying log data, and the response steps in one platform.
Watch-outs. Comparisec's vendor review found that pricing by data volume is the complaint G2 and Gartner reviewers raise most often, and that cost climbs steeply as data grows. The playbooks act only on what the team can afford to ingest into Splunk.
Teams weighing that cost can compare Splunk competitors.
Pricing. According to Splunk's published pricing page, Splunk prices by ingest volume and sells SOAR as an add-on to Splunk Enterprise Security.
Vendr's Splunk cost data puts Splunk Cloud Platform ingestion at roughly $150 to $225 per GB per day. Self-hosted Splunk Enterprise costs roughly $1,800 to $2,700 per year for each gigabyte of data taken in per day, depending on volume and contract length.
Reviews. Gartner Peer Insights rates Splunk SOAR 4.2/5 (88 ratings), checked in early 2026. Third-party sites give it a G2 rating of about 4.4/5.
Swimlane Turbine is a low-code automation platform built for large SOCs, managed security service providers (MSSPs), and regulated industries such as banking and federal government.
Key features.
Strengths. Reviewers say teams can customize most workflows in the low-code builder and write custom code where templates run out. Financial services and federal teams get on-premises and hybrid deployments, plus audit-ready reporting, in the same product.
Watch-outs. Swimlane doesn't publish prices, so buyers have to go through sales to compare total cost. Swimlane charges by how many automated actions run per day, so costs climb as teams automate more. Teams should forecast that before expanding.
Pricing. According to Swimlane's enterprise pricing datasheet, Swimlane offers a tiered subscription priced based on the number of playbook actions run per day, with no charges for data volume or seats. Contract terms vary by scale and deployment option.
Reviews. G2 rates Swimlane 4.5/5 (45 reviews), checked in early 2026. RFP.wiki's comparison reports a Gartner Peer Insights rating of nearly 4.8/5, but this guide couldn't confirm it directly.
Prophet Security bills itself as an AI SOC analyst. It takes the alerts a team's existing tools produce and autonomously triages and investigates them. Its agents pull details about the user, device, and alert from connected tools such as the SIEM, EDR, and identity provider.
Prophet also sells products for threat hunting and detection engineering.
Key features.
Strengths. Prophet publishes outcomes in its case studies, including 6.3 analyst-years reclaimed at J.B. Poindexter & Co and a 5x increase in SOC efficiency at Zip. IDC named it one of the leading agentic SOC providers.
Watch-outs. Prophet doesn't store logs or search them where they live. Its agents only see the alerts existing SIEM and EDR tools send them, so they can't reach log sources those tools never collected. Its Gartner rating also rests on just nine reviews.
Pricing. Prophet quotes custom pricing based on usage and investigation volume. A third-party benchmark puts entry pricing at around $50,000 per year, and TrustRadius shows no public tier details.
Reviews. Gartner Peer Insights rates Prophet 4.9/5 (based on 9 ratings), as of early 2026.
The tables below compare the platforms on the points buyers care about most. Feature lists all run into hundreds of integrations and look more alike every year, so buyers learn more from how each platform is built and how it charges.
Strike48's team evaluated each platform on the sources and criteria below.
This list isn't ranked. Each entry has a Best for line, and that's the line to measure against a team's own setup. A platform built around Palo Alto Networks makes sense for a Cortex shop, but it won't help a team whose investigations keep stalling because the logs aren't there to begin with.
The list covers seven commercial platforms across both architectures. The guide leaves out open-source projects like Shuffle, StackStorm, and TheHive, as well as AI SOC products that primarily run on top of a team's existing tools as an investigation add-on or managed service (Dropzone AI and 7AI, for example).
Strike48's own entry uses the same fields as every other entry, including a watch-out and a plain statement that it has no third-party reviews yet.
Traditional SOAR can only act on data it reaches through its connections to other tools. Those tools are mostly SIEMs and EDRs, which hold whatever the ingestion budget allowed. Teams had to decide which logs to pay for before they knew which ones would matter.
Any log source they cut to save money became a blind spot.
In May 2026, Strike48 surveyed 100 security leaders. Of those leaders, 84% said their current tools can't access all their log data for investigations.
Sixty-five percent had seen at least one investigation stall because their tools couldn't reach the system where the data was stored.
Eighty percent said the cost of keeping data live and searchable is painful or a major budget concern.
Strike48 flips this around. It starts by making all of a team's logs searchable. Federated search reads logs where they already live and only translates them when a query needs them, so keeping every source becomes affordable.
Agents then investigate across every source. When a task has a fixed answer, such as blocking a known-bad IP, an agent calls a playbook to do it.
Analysts can now search log sources the SIEM never collected, while existing playbooks keep handling the repetitive work they do well.
A SOC should pick its architecture based on what it needs to accomplish in the next 12 months.
Teams optimizing existing workflows, such as phishing response, user offboarding, or case management, are a good fit for a classic SOAR. These tools connect to a wide range of other tools, come with extensive playbook libraries, and make it easy to add another simple, predictable automation.
If investigations keep stalling because the SIEM never collected the right logs, fix log coverage first. Strike48 handles that through federated search. Prophet makes more sense when the logs are already in good shape, and the problem is keeping up with the alerts.
Many SOCs run both. Their analysts keep a traditional SOAR, where playbooks handle the work reliably, and add an agentic platform for investigations where the playbook approach has reached its limits.
Strike48's team reviews each buyer's current detection and response stack. In the session, the team shows which data sources the buyer's tools can't reach and where agents would change the workload.
Each session includes a live agent demonstration and an open Q&A, where security teams can ask what “agentic” means in practice.
SOAR playbooks remain the most reliable option for repetitive automation tasks, and teams will continue to use them. Investigation and triage differ because each step depends on what the previous step revealed.
An agent picks each next step based on the evidence, while a playbook follows only the branches its author wrote. That makes agents a better fit for investigation when they can search every relevant log source.
Implementation time depends on the platform. On no-code platforms like Tines, teams put their first playbooks live in about a week. A mature deployment of an enterprise SOAR like Cortex XSOAR takes several quarters.
On agentic platforms, most of the setup involves connecting log sources and configuring agents, so teams write fewer playbooks. On Strike48, shared SaaS deployments go live in minutes and Smart Collection covers about 80% of log sources in under a day. On-premises and air-gapped deployments take weeks.
Splunk Enterprise Security, Splunk's core security product, is a SIEM. Splunk SOAR, formerly Phantom, is a separate SOAR product that Splunk sells alongside Enterprise Security.
When buyers mention “Splunk” in a SOAR evaluation, they mean the pair working together. Enterprise Security produces the alerts, and Splunk SOAR runs the response playbooks.
SOAR licenses range from free community tiers to six-figure annual enterprise contracts, and the pricing model matters as much as the list price. Per-user and seat-based costs grow with headcount, ingest-based costs grow with data volume, and action-based costs grow with the number of automations a team runs.
Buyers should also budget for integration maintenance, playbook authoring time, and the SIEM ingestion that feeds the SOAR. Each adds a recurring cost outside the subscription.
Strike48 is an agentic log intelligence platform that uses AI agents to investigate and respond to alerts, which covers the same ground as a SOAR tool. The difference is that its agents can search every log source a team has without first copying the data into a new system, and each agent sticks to one narrow task. Teams can keep running classic playbooks for simple, predictable tasks alongside Strike48.
Juan Del Rio is the Distribution & Enablement Coordinator at Strike48