Open-source and commercial SOAR tools compared in 2026

If you’re shortlisting SOAR tools, this guide shows which ones fit your stack, your team, and your budget. It covers open-source engines you host yourself, commercial SOAR and hyperautomation platforms, and response automation built into a SIEM or XDR you may already run.

Each profile tells you who the tool suits, what it costs to run, and the main catch. We also flag licence changes that can catch you after deployment and explain how to run a proof of value. Product details are as of October 2026.

The best SOAR tools at a glance

• Heimdal Threat-hunting and Action Center (TAC). Commercial SIEM and XDR with native response. For teams that run Heimdal, or would standardise on it, and want auditable response without adding and maintaining a separate SOAR platform.
• Shuffle. An open-source visual workflow builder you can self-host, with built-in case management. It integrates with Wazuh.
• Tracecat. Open-source workflows, cases, and AI agents in one platform. It suits engineering-led teams that can absorb frequent breaking changes.
• StackStorm. Infrastructure-level remediation under a permissive Apache-2.0 licence, for SRE and SecOps teams.
• TheHive and Cortex. For CSIRTs that need structured case management and enrichment. TheHive 6.0 adds a workflow orchestrator, but only in its paid One licence, so other licences still need a separate automation engine.
• DFIR-IRIS. For teams that want incident case management under a fully open-source licence.
• Splunk SOAR. Fits Splunk Enterprise Security customers, now that SOAR sits in the ES Premier edition.
• Google Security Operations SOAR. For organisations already running Google Security Operations.
• Microsoft Sentinel automation. Suits Microsoft-centric organisations with Azure engineering skills in-house.
• Tines. For teams that want no-code automation running quickly, with workflows that extend into IT.
• Torq. For large, cloud-first SOCs that are ready to model an AI-credit bill.
• Swimlane Turbine. Regulated enterprises that need on-premises or air-gapped deployment.
• Fortinet FortiSOAR. For organisations whose estate is mostly Fortinet.
• D3 Security Morpheus. For organisations moving off Cortex XSOAR or another legacy SOAR platform that want a vendor-neutral replacement.

SOAR is now a capability inside other platforms

SOAR stands for security orchestration, automation, and response. A SOAR platform runs repeatable security incident response steps, such as enrichment, triage, containment, and notification, across your security tools and IT systems through playbooks. It adds case management, approvals, and audit trails around them.

The standalone category took shape in the mid-2010s, and larger platforms absorbed much of it through acquisitions between 2018 and 2022. Splunk bought Phantom, Palo Alto Networks bought Demisto (now Cortex XSOAR), and Google announced its Siemplify acquisition.

Several products that began as standalone SOAR platforms now ship inside a SIEM or XDR, and that’s where many buyers meet them today. D3 Security’s account of Gartner’s 2024 Hype Cycle for Security Operations says it rated SOAR “obsolete before plateau”, as syndicated by Security Boulevard in November 2024.

The automation didn’t disappear. In practice, orchestration now sits inside many SIEM and XDR platforms, and AI agents depend on it to act. On 28 October 2025, Palo Alto Networks announced Cortex AgentiX as the next generation of Cortex XSOAR. Agents are taking over more triage and investigation work, but deterministic playbooks are still the governed way to run high-impact actions, such as isolating a host or disabling an account.

Where traditional SOAR programmes fall short

In practice, the problems come less from getting automation started than from keeping it running.

Playbook decay. Integrations break when vendor APIs change, and someone has to notice, fix, and retest each one.

Forced migrations. Splunk SOAR is the clearest current example. According to Splunk’s release notes, SOAR 8.7.0 (2 September 2026) ended Python 3.9 support, and automation that isn’t compatible with Python 3.13 no longer runs. The 8.6.0 notes (4 August 2026) had flagged the change. Other SOAR vendors have transitions of their own, such as Microsoft Sentinel’s move to the Defender portal.

Open source moves the cost rather than removing it. Self-hosted SOAR swaps licence fees for engineering time spent on integration upkeep, upgrades, high availability, and playbook maintenance. A team with Python and Docker skills can make that trade work. A team without them ends up with a platform that nobody owns.

Licences change after you deploy. TheHive is a clear example. A team that installed the Community edition before version 5.3 now needs an activated licence to keep write access.

Bills that are hard to forecast. Consumption charges add to licence costs. Logic Apps executions, AI credits, and Google’s Security Tokens are each metered differently.

Console fatigue. Each SOAR platform adds another console to check, another set of privileged credentials to protect, and another update cycle to track. When the SIEM, the EDR, the case tool, and the SOAR each have their own screen, one phishing investigation can touch all four.

How we think about response automation

We come at this from the detection side. In practice, phishing, suspicious sign-ins, and endpoint malware often make up much of the alert queue. If the platform that detects those threats can also contain them, from the same console and with the same audit trail, a separate orchestration layer has much less to do.

That’s the thinking behind our Threat-hunting and Action Center (TAC). We describe TAC as a SIEM and XDR product, not as SOAR. It runs native, logged response actions across our own modules, and it does not include a general-purpose playbook builder. For an estate built mostly on Heimdal, it is an alternative to adding a separate SOAR tool. For a large, mixed third-party stack, a dedicated SOAR platform is still the better fit, and the profiles below say so.

You can buy every Heimdal module in three ways:

• As a standalone point product. Any module can be bought on its own, including DNS Security, Patch and Asset Management, privileged access management, endpoint protection, Email Security, and TAC.
• As part of our unified security platform. Start with the modules you need and add more later, up to the full platform.
• As a managed service. MDR, MXDR, and Managed ITDR are for teams who want the SOC run for them rather than staffed in-house.

Patch and Asset Management is the easiest standalone example to picture. A team that already has a UEM or systems management tool it is keeping, and whose actual gap is third-party patching, patch reporting, and asset visibility, can buy Heimdal Patch and Asset Management on its own. It runs alongside the existing tool rather than replacing it. The other modules work the same way.

For teams that want the whole platform, the model is simple. One console. One agent. Modular bundles. The platform covers:

• DNS Security for network and endpoint
• Patch and Asset Management, plus Remote Desktop
• Next-Gen Antivirus and Firewall, with the Extended Threat Protection (XTP) engine
• Ransomware Encryption Protection
• Privileged access management, with PEDM, PASM, and Application Control with AppFencing™
• Email Security 365 and Email Security Advanced with Fraud Prevention
• TAC, for estate monitoring and Microsoft 365 user monitoring

Detections from every module arrive in the same place where you act on them.

Practical buyer guidance

Do you need a dedicated SOAR platform?

Signs that you probably do:

• You run a large, mixed third-party stack and need one place to orchestrate across it.
• You have people, or budget for people, who will own playbooks and connectors.
• Your workflows cross security, IT and ticketing systems such as ServiceNow or Jira.
• You need to automate multi-step work across many vendors, with governance, approvals, and rollback.

Signs that the automation you already own may be enough:

• Most of your security alerts come from one SIEM, XDR, or security platform.
• Your most frequent security workflows are phishing, compromised accounts, and endpoint containment.
• Nobody on the team has time to maintain integrations.

What to evaluate

1. Stack fit. Check whether the automation already in your SIEM, XDR, or security platform covers your top workflows. It’s often the lowest-cost path.
2. Integration coverage and maintenance. Ask who fixes connectors when a vendor changes its API, and how quickly.
3. Authoring model. No-code, low-code, or code with Git versioning.
4. Case management. Native, or paired with a separate case tool.
5. Governance. Role-based access, approvals, audit trails, and rollback.
6. AI. What the AI executes versus what it recommends, how your data is handled, and how it is priced.
7. Deployment. SaaS, on-premises, air-gapped, and where data is stored.
8. Licence reality. OSI open source, source-available, or free with an activated licence.
9. Total cost of ownership. Licence plus engineering time plus consumption charges.

SOAR options that include case management

If you want cases and automation in one product, Tracecat and Shuffle (both open source), TheHive (case and alert management), Swimlane Turbine (commercial), and Tines (as an add-on on paid plans) have native case management. DFIR-IRIS is a case management platform without an automation engine.

What SOAR will not fix

• Detection quality. Automation runs bad alerts through the queue faster too.
• Missing telemetry. A playbook can’t enrich or contain activity that nothing is monitoring.
• An undefined process. If the team can’t describe how it handles a reported phishing email today, a playbook will automate the confusion.
• Ownership. Someone still has to approve high-impact actions and keep the playbooks current.

Where implementation breaks

• Connector upkeep after vendor API changes.
• Fear that an automated action will disrupt production. Buyers ask for approvals, dry runs, rollback, and limits on how much a single action can affect.
• AI agents acting without explainability or an audit trail.
• High availability, backups, and upgrades for self-hosted platforms.

How to run a proof of value

Pick three to five workflows your team handles every week. Common choices are:

• Phishing triage
• IOC enrichment and blocking
• Compromised-account response
• Ransomware containment
• Vulnerability-to-ticket automation

Measure analyst minutes saved per workflow and the integration effort each platform needed to get there. Record which actions ran automatically, which needed approval, and what the audit log captured. If an AI agent is involved, check what it executed against what it only recommended, and how each run is billed. In practice, many security teams lean on peer reviews and practitioner communities at the shortlisting stage, so use them to pick candidates and the proof of value to decide.

Open-source SOAR and case management engines

The table below summarises licences and maintenance as of October 2026.

Shuffle

Shuffle is open-source security automation that its maintainers describe as built “for and by the security professionals”, with managed security service providers (MSSPs) in mind. You can self-host it or run it in the cloud, and it’s listed on the AWS Marketplace.

Its OpenAPI-based app creator builds connectors from an API specification, and a large set of premade apps ships with it. Organisation and sub-organisation controls are built in. Wazuh documents a built-in Shuffle integration. Built-in incident and case management is included in the self-hosted version, and self-hosting needs Docker skills.

Pricing. Free to self-host under its open-source licences.

Best for. SOCs that want a free visual workflow builder that works with Wazuh.

Tracecat

Tracecat is an agentic security automation platform with an AGPL core and a commercial Enterprise Edition. According to Tracecat’s README and pricing page, the open-source tier includes:

• Unlimited workflows, cases, and agents
• More than 100 prebuilt connectors
• SSO without a paid upgrade
• Exportable audit logs

It runs on Temporal for durable execution, and development is very active. The trade-off is churn. Tracecat is a young project with frequent breaking changes, and release 1.1.0 on 9 October 2026 listed eight. Multi-tenancy, fine-grained RBAC and ABAC, Git sync, and Slack or Teams approval channels are paid-tier features, while basic approvals and the agent inbox are in the open-source tier. Tracecat documents air-gapped operation, but its pricing page lists air-gapped deployment as an Enterprise feature, so confirm before you commit.

Pricing. The open-source tier is free. The Enterprise Edition is a paid licence.

Best for. Engineering-led teams that want modern self-hosted SOAR with case management and AI agents in one platform.

StackStorm

StackStorm is mature event-driven automation and a Linux Foundation project. It has a permissive Apache-2.0 licence, stable releases (v3.9.0 shipped in January 2026) and a large catalogue of integration packs. It fits infrastructure-level remediation well.

It is general-purpose event-driven automation rather than a SOC-specific tool.

Pricing. Free.

Best for. SRE and SecOps teams automating infrastructure response.

TheHive and Cortex (StrangeBee)

TheHive and Cortex were for years the best-known open-source incident response stack. Today the pairing is a licence-gated TheHive with an AGPL-licensed Cortex. TheHive has a mature model for cases, alerts, and observables. Cortex adds analyzers for enrichment and responders for actions, and it integrates with MISP.

TheHive Community requires you to request and activate a free licence, and it becomes read-only without one, according to StrangeBee’s licence documentation. Advanced capabilities sit in the paid Gold and Platinum tiers. TheHive 6.0, released on 20 October 2026, adds a paid One tier that includes TheHive Flow, a workflow orchestrator.

Pricing. Community licence is free, on-premises only. Gold, Platinum, and One are paid tiers.

Best for. CSIRTs that need structured case management, paired with Shuffle or Tracecat for orchestration.

DFIR-IRIS

DFIR-IRIS is open-source, collaborative incident case management under the LGPL-3.0 licence. It helps responders share technical details during investigations, and it’s actively released (v2.4.29 in August 2026). It isn’t an automation engine, so it needs Shuffle, Tracecat or similar alongside it for playbooks.

Pricing. Free.

Best for. Teams that want a fully open-source alternative to TheHive for case management.

n8n (source-available)

n8n is general-purpose workflow automation that some security teams adopt for its large community and connector catalogue. It isn’t OSI open source. The Sustainable Use License restricts certain commercial uses.

Best for. Teams that already use n8n for IT automation and want to extend it to simple security workflows.

Wazuh active response

Wazuh is an open-source SIEM and XDR platform, mostly under GPLv2. Its active response feature runs response scripts built into the platform. Wazuh documents a Shuffle integration.

Best for. Wazuh users who want basic automated containment before adding a separate orchestration layer.

We left out MozDef, Catalyst, and Kansa. Mozilla archived MozDef in November 2021, Catalyst’s owner archived it on 18 July 2026, and Kansa has had no commits since November 2022.

Commercial SOAR and hyperautomation

Splunk SOAR (Cisco)

Splunk SOAR is the orchestration layer for Splunk Enterprise Security, and as of ES 8.2 it is bundled in the ES Premier edition. It has native ES integration, a large app library, and the flexibility of Python.

Existing customers had to move automation from Python 3.9 to 3.13 with the September 2026 release.

Pricing. Included in the ES Premier edition. Contact Splunk for other licensing.

Best for. Splunk ES customers.

Google Security Operations SOAR (formerly Siemplify)

According to Google, SOAR is included in all three Google Security Operations packages. The agentic SOC layer is billed separately in Security Tokens. It’s unified with the Google SecOps SIEM. Most of its advantages apply to teams already on Google Security Operations.

Pricing. Included in Google Security Operations packages. Agentic capabilities are billed in Security Tokens.

Best for. Google SecOps and Chronicle customers.

Microsoft Sentinel automation

Sentinel automation combines automation rules with playbooks built as Azure Logic Apps workflows. It integrates deeply with Microsoft 365, Entra, and Defender, and the Logic Apps connector catalogue is large.

Costs are spread across Sentinel ingestion and Logic Apps executions. Microsoft states that the Azure portal experience for Sentinel will be unsupported after 31 March 2027, with Sentinel available only in the Defender portal. As of October 2026, Microsoft’s transition guidance notes that manually running a playbook on an alert or entity isn’t yet supported in the Defender portal. Microsoft also began rolling out Security Copilot inclusion for Microsoft 365 E5 customers on 18 November 2025.

Pricing. Consumption-based, through Sentinel ingestion and Logic Apps executions.

Best for. Microsoft-centric organisations.

Tines

Tines is no-code workflow automation for security and IT. Tines lists G2 Fall 2026 badges including Leader and Best Usability. Its native Cases feature is an add-on on paid plans.

Pricing. As of October 2026, the free tier is limited to three live workflows. Tines’ pricing page doesn’t list paid-tier prices.

Best for. Teams that want fast time-to-value and automation that extends into IT.

Torq

Torq positions itself around hyperautomation and the agentic SOC, and announced SOC Brain in July 2026, after introducing HyperAgents in 2025.

Torq’s pricing includes an AI-credit consumption model that buyers need to model carefully before signing.

Pricing. Includes AI-credit consumption charges.

Best for. Large, cloud-first SOCs.

Swimlane Turbine

Swimlane Turbine is an enterprise low-code AI automation platform. It supports on-premises and air-gapped deployment, has governance features and native case management, and expanded its AI agents in January 2026.

Pricing. Contact Swimlane.

Best for. Regulated enterprises.

Fortinet FortiSOAR

FortiSOAR is Fortinet’s SOAR product. It supports on-premises, public cloud, and Fortinet-hosted (FortiCloud) deployment, and Fortinet lists more than 700 API connections.

Pricing. Contact Fortinet.

Best for. Fortinet-heavy organisations.

D3 Security Morpheus

D3 positions Morpheus as AI-driven, vendor-neutral SOAR. D3 states that Morpheus has more than 800 integrations and, per customer-reported production data (July 2026), investigates up to 95% of alerts at L1 and L2 depth in under two minutes. Those are vendor figures, and independent benchmarks are scarce. D3 runs a migration programme for Cortex XSOAR customers approaching renewal, with no migration charge during an overlap window.

Pricing. Contact D3 Security.

Best for. Organisations migrating off legacy SOAR that want vendor neutrality.

Platform-native response

Heimdal Threat-hunting and Action Center (TAC)

TAC is our SIEM and XDR console with native response built in. Like every Heimdal module, you can buy it on its own, as part of our unified platform, or as part of a managed service. It’s commercial software, not open source.

TAC gives real-time visibility across networks, endpoints, cloud environments, email, and Microsoft 365 users, with built-in user and entity behaviour analytics (UEBA) and our Extended Threat Protection (XTP) engine. The response side has four parts:

• Action Center for estate monitoring. One-click remediation with pre-built commands to scan, quarantine, isolate, or block.
• User Action Center for Microsoft 365. Log out compromised users and revoke sessions or access. Actions are driven by user risk scores built from Login Anomaly Detection, Email Security, and Ransomware Encryption Protection signals.
• Always-on action pane. A persistent widget that summarises risk scores and notifications and opens the Action Center, where actions are logged and audit history is kept.
• Pre-configured workflows. Heimdal says these let teams address security gaps with minimal training.

XTP detections are classified against MITRE ATT&CK using curated detection rules, and enrichment draws on MITRE ATT&CK, OPSWAT, and Sigma rules. Login Anomaly Detection raises alerts for impossible travel, unusual logins, anonymised IPs, and suspicious browsers. Our platform integrates with RMM and PSA tools such as ConnectWise, HaloPSA, and Datto Autotask for ticket automation. TAC also ingests external firewall alerts, including Cisco Meraki, as correlated XDR signals.

AI Wingman is our AI layer across the platform, delivered in phases. AI Wingman Triage uses multi-agent systems to help teams assess suspicious indicators and validate incidents, and it is the phase planned for TAC. AI Wingman SOC is planned for TAC with MXDR. Both are separate from the AI and machine learning already live in Predictive DNS and email fraud prevention.

If you would rather not staff the console yourself, Heimdal MXDR adds a 24×7 SOC and incident response on top of TAC.

TAC has limits. We do not market TAC as SOAR. It has no vendor-agnostic playbook builder and no third-party action marketplace. Its strength is native, auditable response across our own modules, with no separate SOAR platform to integrate and maintain. If you need orchestration across a large, mixed third-party stack, pair a dedicated SOAR or hyperautomation platform with your detection tools.

On independent coverage, we are referenced in Gartner’s Endpoint Protection coverage (May 2026), and we are named as a representative vendor in Gartner’s Market Overview for Workspace Cybersecurity Platforms.

Our MITRE ATT&CK technique coverage is published on the Tidal Cyber Registry, so you can review it and add it to your proof-of-concept scorecard.

We serve over 20,000 companies.

Pricing. Use our pricing calculator to get an indicative estimate on the page and by email once you choose modules and enter your endpoint and server counts and business contact details. The calculator gives no estimate above 5,000 endpoints.

Best for. Mid-market teams that run Heimdal, or would standardise on it, and want response automation without a SOAR engineering programme.

AI SOC agents

A separate group of products focuses on autonomous triage and investigation. It includes Dropzone AI, Prophet Security, Simbian, Microsoft Security Copilot agents, and Google’s agentic SOC capabilities. Their scope differs. Some focus on investigation and verdicts, while others also take containment actions, so check which actions each product runs itself and which it only recommends. Performance figures in this segment are largely vendor-stated. Prophet Security, for instance, claimed a 96% reduction in false positives in July 2025. Treat numbers like that as unaudited until you see them in your own proof of value. Adoption is still early.

Open-source tools that SOAR orchestrates

These projects are data sources or action targets for an orchestration engine, not orchestration engines themselves. Most are open source, but Security Onion is source-available under the Elastic License 2.0.

• Velociraptor. Digital forensics and incident response (DFIR) for endpoints, using the Velociraptor Query Language (VQL) to collect artifacts and hunt across machines.
• GRR Rapid Response. Remote live forensics for Windows, Linux, and macOS.
• Security Onion. A Linux distribution for network security monitoring, log management, and threat hunting.
• Arkime. Full packet capture and search, with sessions indexed in OpenSearch or Elasticsearch.
• PRADS. Passive asset and service detection from network traffic.
• Sigma. A vendor-neutral format for detection rules that converts to SIEM-specific queries.

Our guides to incident response, DFIR, and SIEM cover how these fit into a response process.

Which option fits your situation

The choice between SOAR tools depends less on feature lists than on who will maintain the playbooks a year from now.

• You have Python and DevOps skills and a small licence budget. Start with Shuffle or Tracecat, and add TheHive or DFIR-IRIS if you need case management. Budget engineering time for upgrades and connector fixes.
• Your automation is mostly infrastructure remediation. StackStorm’s Apache-2.0 licence and integration packs suit that work.
• You have standardised on one SIEM or XDR vendor. Test the native automation first. That means Cortex XSOAR or AgentiX for Palo Alto Networks, Splunk SOAR for Splunk ES, Google Security Operations SOAR for Google SecOps, Sentinel automation for Microsoft, and FortiSOAR for Fortinet.
• You have no automation engineers and need results this quarter. Tines has a free tier you can test with real workflows before you talk to sales.
• You work in a regulated or air-gapped environment. Swimlane Turbine supports on-premises and air-gapped deployment, and Tracecat documents air-gapped operation, although its pricing page lists it as an Enterprise feature, so confirm what the open-source tier includes.
• You are migrating off a legacy SOAR platform. Compare D3 Morpheus, which runs a migration programme for Cortex XSOAR customers, and check whether the automation in your current SIEM or XDR already covers your five most frequent workflows.
• You run Heimdal, or plan to consolidate on it. TAC gives you logged, one-click response across endpoints and Microsoft 365 users without a separate SOAR platform, and MXDR adds a 24×7 SOC if you want the console run for you.

Frequently asked questions

Are free SOAR tools really free?

The licence may cost nothing, but running the platform does not. Self-hosted options shift the cost to engineering time for integrations, upgrades, high availability, and playbook maintenance. Check the licence as well. n8n is source-available rather than open source, and TheHive Community needs an activated licence from version 5.3.

Is SOAR dead?

The standalone category is shrinking, but the capability is not. Orchestration and automation now sit inside many SIEM and XDR platforms, and they are the execution layer that AI SOC agents rely on to take governed actions.

Is TheHive still open source?

TheHive 5 is proprietary software with a free Community licence for on-premises use. From version 5.3, the interface becomes read-only without an activated StrangeBee licence. Cortex, its companion analysis engine, remains AGPL-3.0.

Do AI SOC agents replace playbooks?

Not yet. Agents are taking on more triage and investigation, but deterministic workflows are still how many teams govern high-impact actions such as isolating hosts or disabling accounts. Some AI SOC products rely on SOAR, EDR, or identity tools to execute the response.

Is Heimdal TAC a SOAR platform?

We describe TAC as a SIEM and XDR product with native response, not as SOAR. It runs one-click, logged actions across our modules and Microsoft 365 users, but it has no general-purpose playbook builder or third-party action marketplace. For a Heimdal-based estate, it is an alternative to adding a separate SOAR platform.

How much does Heimdal cost?

Choose your modules, then enter your endpoint and server counts and business contact details in our pricing calculator to get an indicative estimate on the page and by email. The calculator gives no estimate above 5,000 endpoints. Every module can be bought on its own, as part of the unified platform, or as a managed service.

If you liked this article, follow us on LinkedIn, Reddit, X, Facebook, and Youtube.

Newsletter

If you liked this post, you will enjoy our newsletter.

Get cybersecurity updates you'll actually want to read directly in your inbox.

I agree to have the submitted data processed by Heimdal Security according to the Privacy Policy

Madalina Popovici

Cybersecurity Writer & Digital PR Manager

Madalina joined Heimdal as a blog author and still writes for the blog today, turning tricky security topics into smart, easy reads. These days, she’s also the company’s Digital PR, with 10+ years of PR and content experience.