Does Splunk SOAR operate in the cloud, or just on-premises?
SOAR can operate on Premises, that is called "Splunk SOAR (On-premises)"https://docs.splunk.com/Documentation/Phantom/5.0.1/PhantomIsNowSOAR/SplunkPhantomisnowSplunkSOAR
or in Splunk Cloud Environment, that is called "Splunk SOAR (Cloud) Service"
https://docs.splunk.com/Documentation/SOAR/current/ServiceDescription/SplunkSOARService
Even when the binaries tend to be the same, in the Cloud environment, versions are released more often and some of them will become onPremises version as well.
The answer is right on the main Splunk SOAR website. You can host on-prem or use Splunk's hosted cloud offering.
