Splunk SOAR (Phantom)

Splunk is a well-known name in the SIEM field and, in contrast to Microsoft Sentinel, can be installed in your local infrastructure (also called on-prem) and also utilized in the cloud, using Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. Splunk can ingest data from various sources, including local environments such as servers and firewalls, and collect data from cloud infrastructure.

Splunk SIEM can create alerts based on searches for historical and real-time data.

The Splunk SOAR component is an additional service that must be configured and connected to Splunk SIEM. Those who have worked with SOAR solutions for years will mostly call Splunk SOAR Phantom, as Splunk bought Phantom SOAR back in 2018 and integrated it as an internal SOAR solution.

Splunk SOAR, the same as its SIEM solution, comes in two versions that can be installed in local infrastructure or the cloud. Splunk uses Splunk Apps to connect different sources...