Tines vs Splunk SOAR: Which security automation platform in 2026?

Tines vs Splunk SOAR in 2026

Tines and Splunk SOAR (formerly Splunk Phantom, acquired by Splunk in 2018 and now part of Cisco following the Splunk acquisition that closed in 2024) are both established security automation platforms, but they take materially different approaches to building and operating playbooks. As of April 2026, organizations choosing between the two typically evaluate three dimensions: SIEM integration depth, authoring model, and total cost of ownership.

Authoring Model

Tines uses a no-code visual builder composed of six Action primitives (HTTP Request, Send Email, IMAP, Trigger, Event Transform, Webhook). Playbooks, called Stories, are built by connecting Actions with event flow. Analysts who know target system APIs can build end-to-end workflows without writing scripts.

Splunk SOAR uses a Python-based playbook runtime and ships with a large catalog of prebuilt apps (over 350 as of April 2026) that wrap vendor APIs. Playbook authors typically combine visual playbook design with Python blocks for custom logic. Teams with Python expertise can build more complex branching and data transformations natively; teams without Python experience face a steeper learning curve than Tines.

SIEM and Ecosystem Integration

Splunk SOAR integrates deeply with Splunk Enterprise and Splunk Cloud, including native bidirectional sync of notable events, adaptive response actions, and shared asset models. Organizations that already run Splunk as their primary SIEM gain operational benefit from this integration that Tines does not match natively.

Tines integrates with Splunk via HTTP API (search, alert retrieval, indexing) and works equally well with Microsoft Sentinel, Google Chronicle, Elastic Security, and any SIEM with a REST API. For SIEM-agnostic environments or multi-SIEM deployments, Tines has fewer tie-ins.

Deployment and Ownership

Tines is primarily SaaS; on-premises and tenant-isolated options are available for regulated customers. Splunk SOAR is offered as SaaS (Splunk SOAR Cloud) or on-premises (Splunk SOAR On-Premises), which appeals to organizations with strict data residency or air-gapped requirements.

As of the Cisco-Splunk deal close in 2024, Splunk SOAR roadmap and licensing decisions fall under Cisco. Customers evaluating Splunk SOAR should factor the post-acquisition roadmap into their decision.

Pricing

Tines pricing starts at approximately $35,000 per year for a Team plan as of April 2026, with Enterprise deployments quoted based on Story volume and users. Splunk SOAR pricing is workflow-action-based and typically runs higher for equivalent automation volumes, with Enterprise deployments frequently exceeding $100,000 per year. Both vendors offer free or community tiers for evaluation.

When to Choose Each

Choose Tines when the SOC values fast playbook authoring, wants a SIEM-agnostic automation layer, and prefers a SaaS-first deployment. Choose Splunk SOAR when the organization already runs Splunk as its primary SIEM and wants the tightest possible integration with notable events, adaptive response, and Splunk's asset and identity frameworks.