Commercial Cybersecurity Tools: SOAR & Automation
← Back to Commercial Cybersecurity Tools Hub | Full Commercial Catalog | Main Atlas
This category contains 7 documented tools. It focuses on capabilities used for incident playbook execution, enrichment automation, and response task orchestration. Use this section when building shortlists, comparing operational tradeoffs, and mapping controls to detection/response ownership.
Category Evaluation Checklist
- Coverage depth against your highest-priority threats and compliance obligations.
- Operational overhead for deployment, tuning, and long-term maintenance.
- Signal quality versus analyst workload and false-positive pressure.
- Integration fit with SIEM, ticketing, identity, cloud, and engineering workflows.
- Governance readiness including auditability, ownership clarity, and change control.
Jump by Name
Letter B
This letter section contains 1 tools.
BlinkOps
- Website: https://www.blinkops.com/
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: BlinkOps is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: Security automation platform for building and running cross-tool remediation and investigation workflows.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Letter C
This letter section contains 1 tools.
Cortex XSOAR
- Website: https://www.paloaltonetworks.com/cortex/cortex-xsoar
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: Cortex XSOAR is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: Security orchestration and automation platform for incident response runbooks and SOC case workflows.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Letter D
This letter section contains 1 tools.
D3 Security
- Website: https://d3security.com/
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: D3 Security is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: SOAR platform with case management, investigation playbooks, and response orchestration.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Letter S
This letter section contains 2 tools.
Splunk SOAR
- Website: https://www.splunk.com/en_us/products/splunk-soar.html
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: Splunk SOAR is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: Playbook-driven automation for triage, enrichment, and containment activities across security tools.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Swimlane
- Website: https://swimlane.com/
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: Swimlane is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: SOAR and automation platform for orchestrating detections, enrichments, and response tasks.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Letter T
This letter section contains 2 tools.
Tines
- Website: https://www.tines.com/
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: Tines is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: No-code and low-code automation platform used by security teams for incident response and process automation.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.
Torq
- Website: https://torq.io/
- Model: Commercial
- Category: SOAR & Automation
- Source Lists: Curated List
What it does: Torq is used in soar & automation programs to support incident playbook execution, enrichment automation, and response task orchestration. Source summaries describe it as: Hyperautomation platform for SOC and security operations workflows with orchestration and AI-assisted actions.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As a commercial offering, teams usually evaluate contractual support boundaries, roadmap transparency, and integration depth for enterprise operations. Related source context: SOAR & Automation.