Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Head-to-head · Security Orchestration, Automation, and Response Software

Cortex XSOAR vs Splunk SOAR

  • Updated Oct 2026
  • Both researched from official sources
  • 2 checks side by side
Higher score Cortex XSOAR #1 in Security Orchestration, Automation, and Response Software 9.3/10 Pricing on request ✓ 0 of 4 features Visit Cortex XSOAR
Splunk SOAR #2 in Security Orchestration, Automation, and Response Software 9.2/10 Free plan Free plan✓ 1 of 4 features Visit Splunk SOAR

Cortex XSOAR leads on 0 checks, Splunk SOAR on 0, and 2 are even. Who comes out ahead on the 2 yes/no, price and count checks where we have data for both products. The editor score weighs everything else too.

Our verdict

  • Highest scoreCortex XSOAR · 9.3/10
  • Free planonly Splunk SOAR
  • Most featuresSplunk SOAR · 1 of 4

Cortex XSOAR scores higher on our rubric for security orchestration, automation, and response software: 9.3 against 9.2 out of 10; our editors rank them #1 and #2.

Cortex XSOAR is the better fit for large SOCs needing mature, full-featured orchestration. Splunk SOAR is the better fit for security teams coordinating existing tools.

  • Cortex XSOAR fits best

    Large SOCs needing mature, full-featured orchestration

  • Splunk SOAR fits best

    Security teams coordinating existing tools

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature Cortex XSOAR 9.3/10 Visit ↗ Splunk SOAR 9.2/10 Visit ↗
At a glance
Editor score 9.3 9.2
Ranking #1 in Security Orchestration, Automation, and Response Software #2 in Security Orchestration, Automation, and Response Software
Best for Large SOCs needing mature, full-featured orchestration Security teams coordinating existing tools
Pricing model Paid Free plan + paid
Starting price — —
Free plan Not checked yet ✓ (best)
Free trial — —
Deployment Cloud, Self-hosted Cloud, Self-hosted
Platforms Web Web
Integrations 5 integrations 350+ integrations
Features Cortex XSOAR 0/4 · Splunk SOAR 1/4
Case management Not checked yet ✓ (best)
SIEM integration Not checked yet Not checked yet
Threat intelligence Not checked yet Not checked yet
Endpoint response Not checked yet Not checked yet
Specs
Deployment Not checked yet Not checked yet
Playbook builder Not checked yet Not checked yet
Included connectors Not checked yet Not checked yet
Our review
Pros
  • Visual playbooks automate enrichment, investigation and response workflows
  • Case management includes collaboration, war rooms and audit reporting
  • Integrates SIEM, network security, threat intelligence and Cortex tools
  • Free edition includes over 100 playbooks and up to 100 actions daily
  • Connects with 350+ tools and supports 2,800+ automated actions
  • Combines case management, threat intelligence and alert enrichment
Cons
  • Pricing requires contacting sales
  • SaaS incident retention defaults to six months
  • The documented Enterprise mobile app has reached end of life
  • Free edition is capped at 100 actions per day
  • Paid edition pricing is quote-based
  • Its focus is coordinating security tools, not replacing them
Our verdict

Cortex XSOAR is a security orchestration, automation and response platform from Palo Alto Networks for security operations teams. It combines incident and case management, process-driven playbooks, investigation war rooms, threat…

Read the review →

Security operations teams use Splunk SOAR to coordinate security and IT tools, automate triage and response workflows, enrich investigations with threat intelligence, and manage investigative cases. It is aimed at mid-market and enterprise…

Read the review →
  1. Cortex XSOARSecurity Orchestration, Automation, and Response Software 9.3Pricing on request
  2. Splunk SOARSecurity Orchestration, Automation, and Response Software 9.2Free plan

Strengths and trade-offs

  • Cortex XSOAR — where it wins

    • Visual playbooks automate enrichment, investigation and response workflows
    • Case management includes collaboration, war rooms and audit reporting
    • Integrates SIEM, network security, threat intelligence and Cortex tools

    Where it doesn't

    • Pricing requires contacting sales
    • SaaS incident retention defaults to six months
    • The documented Enterprise mobile app has reached end of life

  • Splunk SOAR — where it wins

    • Free edition includes over 100 playbooks and up to 100 actions daily
    • Connects with 350+ tools and supports 2,800+ automated actions
    • Combines case management, threat intelligence and alert enrichment

    Where it doesn't

    • Free edition is capped at 100 actions per day
    • Paid edition pricing is quote-based
    • Its focus is coordinating security tools, not replacing them

More comparisons

All security orchestration, automation, and response software comparisons → · Full ranking →

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Last updated · How we research and update