Splunk SOAR VS Splunk Phantom?

[AliMaher]

Hello Everyone,

Could you please clarify the difference between the SOAR and Phantom Product?

[AliMaher]

Thanks for your support, it's really appreciated!

Can we use Splunk SOAR as standalone product and integrate with others SIEM solutions (ArcSight - Qradar - ELK - ...) or just embedded with Splunk Platform?

[thahir]

Hi @AliMaher ,

Yes, it's possible to use the Splunk SOAR as a standalone and you can do with integrations other SIEM solutions, there are prebuilds apps are available in the Splunk soar for the integration with other SIEM's.

[PickleRick]

Splunk SOAR is a completely standalone product (or a service in case of a cloud edition).

It can integrate with a huge range of products and services including various SIEM solutions.

If you want to learn more about the product and its capabilities call Splunk Sales team or your local Splunk Partner for a presentation, demo or a PoC/PoV. 

[PickleRick · Accepted solution]

Phantom used to be an independent vendor. Then Splunk acquired the company and sold the product for some time as Splunk Phantom before finally renaming it to Splunk SOAR.

So it's the same product, just the name evolved across releases.

[kiran_panchavat]

@AliMaher Splunk Phantom, renamed to Splunk SOAR, is a security orchestration, automation, and response (SOAR) solution. Phantom was a product from Splunk (or acquired by Splunk) that implements a SOAR solution. Over time, Splunk has rebranded or integrated Phantom more tightly with its broader security offerings, and now often refers to it as Splunk SOAR (i.e. Phantom is now part of Splunk’s SOAR offering)

https://docs.splunk.com/Documentation/Phantom/4.10.7/User/Intro