Cortex XSOAR vs Splunk SOAR for playbook authoring and case ops

The main hire is how you author playbooks, which integrations you run, how a case is worked, where the platform is deployed, and what you maintain after each release. Automatic start rules matter, but they are one configuration after those buying criteria.

Cortex XSOAR sells Marketplace content packs, a visual playbook editor, and a War Room on the Cortex XSOAR 8 SaaS license. Splunk SOAR sells a Visual Playbook Editor, app integrations, and workbook case management on Splunk SOAR cloud, on-premises, or as the SOAR line inside Enterprise Security. Cortex AgentiX is a separate license and is not folded into the XSOAR quotas below.

The sections below put authoring and integrations first, then case handling, deployment, and maintenance, then the start-switch edge cases. License meters stay in Editions. This pair belongs with SOAR platforms: a case record plus a playbook.

	Cortex XSOAR	Splunk SOAR
Primary use case	Author and run security playbooks with Marketplace packs, investigate in a War Room, and meter the tenant yearly per user	Author and run security playbooks with apps and a Visual Playbook Editor, investigate with workbooks, and meter cloud by user account or on-premises by 24-hour events
Authoring and integrations	Visual playbook editor for code-free automation, plus 900+ prebuilt integration and automation packs and thousands of actions on the product page checked 3 Oct 2026	Visual Playbook Editor with prebuilt code blocks, plus 300+ third-party tools and 2,800+ automated actions on the product page checked 3 Oct 2026
Case handling	War Room for collaboration, ChatOps and CLI for on-the-fly investigation, auto-documentation for audit. Full users can run playbooks. Audit users can view and cannot run them	Comprehensive case management with task segmentation, assignment, and documentation. Workbooks are templates of tasks a person still completes beside the playbook
Deployment and maintenance	Cortex XSOAR 8 SaaS is the license page used here. Multi-tenant covers a main tenant and one child. Content packs and playbooks are maintained in the Marketplace and on the tenant. A July 2026 Cortex post covers XSOAR 8.15 maintenance items such as Azure Blob export	Cloud, on-premises, or hybrid on the product page. Cloud release notes carry Python runtime cuts and editor changes. An imported playbook does not keep Active, so someone re-enables it after each content move
License/pricing	Yearly per user. No public dollar on the SaaS license page. See Editions	Cloud by user account. On-premises by events in a 24-hour UTC period, or by user account. No public dollar. See Editions
Who operates it	Playbook authors, pack owners, and full users who run automations. Audit users do not operate the playbook. AgentiX operators are on a separate license if that product is purchased	Playbook authors, app owners, and analysts who run or enable playbooks. Cloud tenants also own the Python 3.13 compatibility work after the 2 September 2026 release

We read the Cortex XSOAR product page and 8 SaaS license page, the incident-type and jobs guides, and Palo Alto’s July 2026 Cortex post. We read the Splunk SOAR product page, playbook settings, cloud release notes, and the September 2026 licensed-capacity page, plus one Stack Overflow answer from February 2025. All of that was on 3 Oct 2026. We did not install either product, so this is not a hands-on benchmark. Sample panel counts on marketing pages are not license meters.

Cortex XSOAR

Splunk SOAR

Cortex XSOAR is a Palo Alto Networks product in the Cortex line. The XSOAR 8 SaaS license page was still published under that name on 3 Oct 2026. A multi-tenant example on that page still uses the part number PAN-DEMISTO-MSSP. Demisto is the earlier product name. Splunk SOAR is the name on the Splunk product page and on the cloud release notes the same day. Cisco completed the acquisition of Splunk on 18 March 2024. Those cloud notes still point at a migration guide from Splunk Phantom. Phantom is the earlier product name. The table label stays Splunk SOAR.

Editions and pricing

Neither product page published a dollar price on 3 Oct 2026. The figures below are quotas and meters from the license pages. Those pages did not publish a dollar rate. Treat a dollar figure as a quote.

	Cortex XSOAR	Splunk SOAR
How you buy it now	Cortex XSOAR 8 SaaS: Starter (case management and playbook automation), Threat Intel Management, or Enterprise (SOAR plus threat intel). Multi-year terms exist. A development tenant is a separate license and is not capped at the production user count. Multi-tenant covers a main tenant and one child tenant	Splunk SOAR cloud, Splunk SOAR on-premises, or the SOAR line inside Splunk Enterprise Security. The product page captured 3 Oct 2026 offers a free trial. The capture does not say how many days that trial lasts
Public price (3 Oct 2026)	No dollar amount on the SaaS license page. The license is yearly per user. Extending incident retention is an add-on, also without a public dollar	No dollar amount on the September 2026 licensed-capacity page. Cloud is metered by user account. On-premises is metered by events in a 24-hour UTC period, or by user account. One account cannot be logged in by two people at once. Inside Enterprise Security, the SOAR line is metered per playbook run, with a stated maximum of 250,000 runs a day
What the count includes	On the SaaS page: Starter keeps 180 days of incident history, unlimited incident-triggered automations, and 5 active feeds at 100 indicators per fetch. Threat intel library detail is not in Starter. Threat Intel Management keeps 30 days of history and 166 incident-triggered automations a day, with unlimited feeds. Enterprise keeps 180 days, unlimited incident-triggered automations, and unlimited feeds. A feed counts against the quota when Fetches Indicators is selected, even if that integration instance is disabled. Full users can run playbooks. Audit users cannot	A standalone Splunk SOAR account is a person, not a playbook run. The 250,000-a-day figure applies to the Enterprise Security editions’ SOAR line. The standalone cloud meter counts accounts. The sample panel on the product page (440 playbooks, 594 actions) is not either meter
Main buying consideration	How many full users must be allowed to run a playbook, and is the tenant Starter, Threat Intel Management with a 166-a-day automation quota, or Enterprise?	Are you buying standalone Splunk SOAR by accounts or by the 24-hour event count, or are you buying playbook runs inside Enterprise Security?

Palo Alto’s 28 October 2025 announcement called Cortex AgentiX the next generation of Cortex XSOAR, and the 25 February 2026 Cortex post describes a standalone AgentiX platform for XSOAR customers. An AgentiX license page was also live on 3 Oct 2026, with its own included users and yearly compute units. Those units are not the Cortex XSOAR 8 SaaS quotas above. Confirm which name is on the order form.

Authoring and integrations

	Cortex XSOAR	Splunk SOAR
How you author	Product page: visual playbook editor for code-free automation, plus DIY playbooks built from security actions. Start from prebuilt packs when you cannot code	Product page: Visual Playbook Editor assembles workflows from prebuilt code blocks, with editing options for people who do write code
Integration library	900+ prebuilt integration and automation packs, and thousands of actions, on the Cortex XSOAR product page checked 3 Oct 2026. Marketplace is where packs are found for the stack you already run	300+ third-party tools and 2,800+ automated actions on the Splunk SOAR product page checked 3 Oct 2026. Apps connect the playbook to the tools you keep
What those counts are not	Pack and action counts are product-page library size. They are not Starter, Threat Intel Management, or Enterprise automation quotas	Tool and action counts are product-page library size. The sample Executed Playbooks and Actions panel figures are not the cloud account meter or the 24-hour event meter
Main buying consideration	Will your authors live in the visual editor and Marketplace packs, and is the missing action something you will build?	Will your authors live in the Visual Playbook Editor and apps, and is the missing action something you will build?

Library size is a starting catalog. A missing action is still a build or a skip on either side.

Case handling

	Cortex XSOAR	Splunk SOAR
Where the case is worked	War Room for investigation and collaboration, with ChatOps and CLI for on-the-fly work, and auto-documentation for knowledge sharing and audit reporting	Case management with task segmentation, assignment, and documentation. Workbooks are templates of tasks, notes, and owners beside the playbook
What a person still does	Full users run commands and playbooks. Audit users read the incident, dashboards, and reports, and cannot run playbooks. If only audit users watch the queue, the case waits	Filling in a workbook does not run a playbook. A prompt block stops the playbook until someone answers, including a person without a Splunk SOAR login when the release notes allow that path
Threat intel on the case	Indicator processing and scoring, mapping external threats to incidents, and Unit 42 intel on the product page. Threat Intel Management and Enterprise are the license editions that carry TIM quotas	Investigation panel prioritization plus Splunk Threat Research Team insights on the product page. Cisco Talos reputation actions were added on cloud in release 6.4.0. Enrichment is not a second case system
Main buying consideration	Do you need War Room collaboration with a full-user meter, knowing audit users cannot press Run?	Do you need workbook tasking beside automated playbooks, knowing a prompt can leave the case open while the playbook waits?

That answer is an authoring edge case after the case model above. A Job is time-triggered or feed-triggered and opens its own incident with a chosen playbook. A task inside a playbook runs only because that playbook is already going.

Deployment and maintenance

	Cortex XSOAR	Splunk SOAR
Where it runs	Cortex XSOAR 8 SaaS is the license surface used on this page. Multi-tenant covers a main tenant and one child; more children need more licenses. A development tenant is a separate license	Cloud, on-premises, or hybrid on the product page. SOAR capabilities can also sit inside Splunk Enterprise Security when a SOAR subscription is present
What you maintain	Content packs, playbooks, incident types, and Jobs on the tenant. July 2026 Cortex post: XSOAR 8.15 adds Azure Blob export of incident data, War Room entries, and attachments, plus continuous Strata Logging authentication	Splunk SOAR (Cloud) 8.7.0, GA 2 September 2026, stops executing playbooks, custom functions, and apps that are not compatible with Python 3.13. Classic visual editor removed as of 6.4.0 (20 February 2025); classic playbooks still run, visual edit needs modern conversion
License that is not this column	Cortex AgentiX has its own Base/Enterprise license page with included users and yearly compute units. Those units are not the Cortex XSOAR 8 SaaS quotas in Editions	Inside Enterprise Security, the SOAR line meters playbook runs (max 250,000 per day on the licensed-capacity page). That is not the standalone cloud user-account meter
Main buying consideration	Will you staff SaaS tenant operations and pack updates on the XSOAR license, with AgentiX only if that separate order exists?	Will you staff cloud, on-premises, or ES-integrated SOAR, including Python 3.13 compatibility before the next cloud cut?

Maintenance is release work and content ownership. It is not the same question as which automatic start switch you flip.

What starts the playbook

After authoring, case handling, and deployment, the start switch is the remaining configuration. It is one edge case, not the whole comparison.

	Cortex XSOAR	Splunk SOAR
Automatic start	Run playbook automatically on an incident type, for an event an integration or the REST API classified. Hand-opened or playbook-created incidents skip classification until someone sets the type and runs the playbook	Active on, plus Artifact created, or a person moving the container into Resolved. An automation user, an app, or another playbook resolving the container does not start that playbook
What an import keeps	The incident-type guide does not say Run playbook automatically survives a content move. Check the destination type before you count on ingest	Run automatically when, Logging, Active, and Safe Mode do not persist on export. Safe Mode does not cover child playbooks. Draft cannot be Active
Main buying consideration	After packs and War Room, will the incidents you care about arrive through an integration or the API?	After apps and workbooks, who turns Active on after import, and are playbooks already on Python 3.13?

Choose Cortex XSOAR when you will staff Marketplace packs, a visual playbook editor, and War Room case work on the Cortex XSOAR 8 SaaS yearly per-user license, with AgentiX only as a separate order if required. Choose Splunk SOAR when you will staff Visual Playbook Editor apps, workbook case handling, and cloud user accounts or an on-premises 24-hour event meter. Settle authoring, integrations, case handling, deployment, and maintenance before you treat one start-switch edge case as the decision.