Skip to content
AI Cyber Compare

Side by side

Splunk SOAR vs Tines: facts side by side

The short answer

Both Splunk SOAR and Tines are SOAR products. Splunk SOAR adds AI inside SOAR, while Tines replaces SOAR. Splunk SOAR documents a published integration count; Tines documents a published pricing unit or tiers. We do not name a winner: which fits depends on your team, and the fit finder can order them by your answers.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.

How do Splunk SOAR and Tines differ at a glance?

FactSplunk SOARTines
Primary modelSOARSOAR
Also reaches intoSIEM copilotAI SOC analyst
Position on SOARAdds AI inside SOARReplaces SOAR
Integrations300+ third-party tools and 2,800+ automated actions.Not published
DeploymentCloud, on-premises or hybrid.Shared stack, self-hosted or hybrid; Tines says AI features are available wherever Tines is deployed.
PricingNot publishedFree edition: unlimited users and connectors, 3 live workflows, one-time $50 AI allowance. Paid editions: contact sales; startup program discounts.
ComplianceNot reviewedNot reviewed
FundingNot in our sources$125M Series C at a $1.125B valuation, announced 11 February 2025.

Who carries each stage?

Splunk SOAR

Work strip for Splunk SOAR: Triage, rules you write; Investigate, rules you write; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateRules you writeRespondRules you writeTuneYour analystsNights and weekendsRules you write

Tines

Work strip for Tines: Triage, AI agent; Investigate, shared; Respond, shared; Tune, your analysts; Nights and weekends, not described.TriageAI agentInvestigateSharedRespondSharedTuneYour analystsNights and weekendsNot described
  • Your analysts
  • Rules you write
  • AI agent
  • Provider's analysts
  • Shared
  • Not described

Stages where they differ:

  • Triage: Splunk SOAR rules you write, Tines AI agent
  • Investigate: Splunk SOAR rules you write, Tines shared
  • Respond: Splunk SOAR rules you write, Tines shared
  • Nights and weekends: Splunk SOAR rules you write, Tines not described

Which capabilities does each document?

CapabilitySplunk SOARTinesDifference
Integration count publishedDocumentedNot describedDiffers
Pricing unit or tiers publishedNot describedDocumentedDiffers
Runs response actions itselfDocumentedDocumented
Approval or sign-off before actionsDocumentedDocumented
Can act alone on some casesDocumentedDocumented
Translates existing SOAR playbooksNot describedNot described
Optional service where the vendor's people work the queueNot describedNot described
Multi-tenant or MSSP offeringNot describedNot described
On-premises, hybrid or your own cloud tenantDocumentedDocumented
Single-tenant optionNot describedNot described
Data residency optionNot describedNot described

What are the strengths and limits of each?

Splunk SOAR

Strengths

  • Broad action library and the widest deployment choice here: cloud, on-premises or hybrid.
  • The natural fit for teams whose SIEM is Splunk Enterprise Security.

Limits

  • The AI capabilities sit in Enterprise Security; SOAR on its own is playbook-driven.
  • Prices are not published.

Tines

Strengths

  • Self-hosted and hybrid deployment, with AI available wherever Tines runs.
  • A free edition with published limits, so a team can build before talking to sales.

Limits

  • No prebuilt AI SOC analyst is described; your team designs the investigation logic.
  • No integration count, and paid editions have no public price.

When would you choose Splunk SOAR, and when Tines?

Choose Splunk SOAR if you need:

  • a published integration count
  • Broad action library and the widest deployment choice here: cloud, on-premises or hybrid.

Choose Tines if you need:

  • a published pricing unit or tiers
  • Self-hosted and hybrid deployment, with AI available wherever Tines runs.

What does each vendor say about its own results?

Splunk SOAR

No vendor figures were collected for Splunk SOAR.

Tines

No vendor figures were collected for Tines.

Asked often about this page

Which is better, Splunk SOAR or Tines?

We do not rank vendors. Splunk SOAR documents a published integration count and Tines documents a published pricing unit or tiers. The fit finder orders vendors by the needs your answers imply.

Do Splunk SOAR and Tines publish pricing?

Tines publishes tiers or a pricing unit; Splunk SOAR does not publish pricing on its own site. Neither publishes a paid list price there.

Can Splunk SOAR and Tines be used together?

Our sources do not describe an integration between Splunk SOAR and Tines. Ask both vendors before planning to run them together.

Read next

Fit finderOrder vendors by the needs your answers imply.Which modelThe decision guide for all four models.Splunk SOAR profileSplunk's SOAR, now a native capability inside Splunk Enterprise Security.Tines profileA workflow platform for AI agents, apps and automation that positions itself as a modern SOAR, with an AI SOC use case built from workflows.