Security Operations
SOAR tools that turn a ticket into an action (2026)
A 2026 shortlist of automation shelves that take an alert and do the next step. Public docs, not a lab bake-off.
Expertise: Security Operations · Level: Intermediate · 12 min read
An unread case is not containment.
The queue is full and the playbook is a wiki page. Someone still has to revoke the session, isolate the host, and write the note. SOAR is that hand-off. It is not a second SIEM.
Six tools. One open SOAR you can host. One event-driven pack runner. One general automator. Two legacy-platform SOARs. One commercial story builder. Public pages and licenses. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Shuffle | Open SOAR you can host | AGPL-3.0 |
| StackStorm | Event-driven packs you operate | Apache-2.0 |
| n8n | General workflows a security team already runs | Sustainable Use License |
| Splunk SOAR | Playbooks next to a Splunk SIEM | Commercial |
| Cortex XSOAR | Enterprise playbook shelf | Commercial |
| Tines | Story-based commercial workflows | Commercial |
Shuffle
Best for open SOAR you can host
Shuffle is an open security automation platform. Workflows are JSON. Apps wrap APIs. The homepage sells ‘open source SOAR’ and a cloud if you do not want to host it.
Key features
- Open workflows you can export as JSON
- App generator against OpenAPI
- Self-host or Shuffle Cloud
- Built for security queues, not marketing ops
Why we like it
This is the hidden gem. You can read the workflow. You can run it on a host you own. The AI SOC list already uses Shuffle as a row. This page is the automation shelf, not a copilot recap.
Limits
You own connectors that are not in the app store. AGPL-3.0 means network use has a share obligation. Cloud pricing is on their site and changes.
StackStorm
Best for event-driven packs you operate
StackStorm is If This Then That for infrastructure. Sensors, rules, and actions live in packs. The project is Apache-2.0. Extreme Networks still publishes the product page.
Key features
- Packs for common infra APIs
- Rules on events, not only a button
- ChatOps hooks
- You operate the cluster
Why we like it
When the trigger is a bus event and not a human clicking Run, StackStorm is the honest model. The pack format is the prove-it.
Limits
Security-specific packs are thinner than XSOAR content. You staff the box. The UI is not a SOC case system.
n8n
Best for general workflows a security team already runs
n8n is a general automator. Security teams use it because the node list already talks to Slack, Jira, and HTTP. The source is visible. The license is not OSI Apache.
Key features
- Visual editor with HTTP nodes
- Self-host or n8n Cloud
- Credentials stored in the instance
- Huge node catalog
Why we like it
It is already in the building. That is the honest reason it is on a SOAR list. Treat it as a workflow runner, not as a case manager.
Limits
The Sustainable Use License restricts offering n8n as a competing hosted product. It is not a SOC platform. You design the failure path.
Splunk SOAR
Best for playbooks next to a Splunk SIEM
Splunk SOAR is the Phantom product under the Splunk name. Playbooks sit next to the SIEM you already pay for.
Key features
- Playbook editor
- Apps for common security tools
- Case and event frames
- Splunk estate integration
Why we like it
If the SIEM is already Splunk, this is the shelf most procurement already wrote down. We list it so the open tools have a known neighbor.
Limits
Price rides the Splunk contract. Community playbooks still need your credentials and your review. We did not run a paid instance.
Cortex XSOAR
Best for enterprise playbook shelf
Cortex XSOAR is the known enterprise SOAR. Palo Alto publishes playbooks, a marketplace, and a case product.
Key features
- Playbook marketplace
- Case management
- Large integration list
- On-prem or cloud
Why we like it
This is the name a steering committee already knows. The value is content and connectors, not a novel architecture.
Limits
You buy the platform and the time to tune playbooks. Public pages do not replace a scoped demo. We did not run XSOAR.
Tines
Best for story-based commercial workflows
Tines sells stories: boxes and arrows a human can read. The homepage is security automation without a ‘you must own a SIEM’ lock.
Key features
- Story editor
- No-code HTTP and mail
- Team workbench
- Audit of what a story did
Why we like it
The story is the artifact. That is easier to review than a Python pack nobody owns. Price is commercial.
Limits
You do not get the AGPL dump. Features sit behind a sales motion. We did not run a tenant.
What the internet thinks about SOAR tools
StackStorm still shows up on HN as the event-driven pack runner people already operate. Read the thread for the resume-driven warning, not as a score.
mdekkers on Hacker News, Nov 2023: “I’ve used ST2 on and off for many years, and it blows the socks off folks at every place I introduce it.”
Prove the repo still moves
On a host you own, clone Shuffle and confirm the repo still has a LICENSE and a docker path. Do not point it at production tickets on the first run.
git ls-remote --heads https://github.com/Shuffle/Shuffle.git
# expected: refs/heads/master (or main) printed, exit 0FAQs
Does SOAR replace the SIEM?
No. SOAR acts. SIEM stores and detects. Link the SIEM alternatives list if the hole is ingest.
Is n8n a SOAR?
No. It is a general automator that security teams already run. It is on this list because that is the honest install, not because it is a case system.
Is this a scored bake-off?
No. Order is editorial. We did not install the commercial shelves in a lab.
Can I skip the open tools if I already pay for XSOAR?
You can. You still need a playbook that calls revoke and isolate. The license does not do that work.
