SOAR Automation

[sankar_admin]

we have Splunk ES for security monitoring & ITSI for system monitoring. Now alerts and incidents are manual process it consumes lot of time due to involving different teams. 

so incident management we are using BMC helix, now i am planning to implement SOAR platform to reduce human error & resolution time.

my question is

1. SOAR platform configuration Prerequisites (single & multi-site)

2.  security & non-security PoC's using SOAR.

3. compatibility matrix SOAR platform with different vendors.

Much Appreciated if anyone share your knowledge & guidance.

[VatsalJagani]

@sankar_admin - This document below should help. But in general, you have two options: SOAR on Cloud and SOAR On-prem.

https://help.splunk.com/en/splunk-soar

Regarding compatibility matrixs with other ventors there are many SOAR Connectors available on Splunkbase. - https://splunkbase.splunk.com/apps?page=1&sortBy=popular&product=soar 

I hope this helps!!! Kindly upvote if it does!!!