Hey everyone,
I've been deep in the weeds lately evaluating SOAR options for my workplace, and I keep circling back to the same core dilemma: how do you balance the power of a full-blown commercial suite against the flexibility of a more open, scriptable platform? Our specific scenario is a 200-user finance firm (think wealth management, not high-frequency trading) where we've already built a decent amount of internal tooling in Python for data reconciliation, reporting, and even some light compliance alerting.
We're now looking to mature our security operations. The primary drivers are automating our IR playbooks for phishing and suspicious logins, enriching alerts from our SIEM (we're on Sentinel), and tying everything into our Jira Service Desk for ticket management. The big kicker, and why I'm posting here, is that our team is adamant about preserving and extending our Python automation—we have a library of custom scripts for querying internal APIs, formatting reports for regulators, and doing weird, finance-specific data lookups that no off-the-shelf product would ever support.
So, my question for the community: what's the best SOAR platform for an environment like this? I'm less interested in raw out-of-the-box playbook counts and more in:
* **Python-native flexibility:** Can we literally write actions and integrations as Python modules? How sandboxed is the environment? Can we import our internal libraries?
* **Finance-relevant connectors:** Solid integrations with Office 365, Azure AD, Sentinel, and core banking/finance tools are a must. Bonus points for niche things like SWIFT or Bloomberg terminals.
* **Total Cost of Ownership:** With 200 users, we're not a giant enterprise, but we have stringent compliance needs (FINRA, SEC). We need audit trails, role-based access, and proper logging. The pricing models for some SOARs seem geared for massive SOCs; we need something that scales reasonably.
* **Developer experience:** Is the playbook editor a clunky flowchart or can we work in code (YAML, Python)? How's the testing and debugging workflow?
I've been playing with a few. **Phantom (now Splunk SOAR)** feels robust but can be heavy, and its "apps" sometimes feel like a walled garden. **TheHive** (open source) is intriguing for its Cortex playbooks, but I'm worried about the maintenance overhead and whether it's "enterprise-ready" enough for our auditors. **Shuffle** has caught my eye for being so code-forward, and **Tines** is often praised for its simplicity, though I'm unsure about its Python depth.
Has anyone walked this path—specifically in a regulated, mid-sized finance environment with a strong desire to keep Python at the heart of automation? I'd love to compare notes on the nitty-gritty, like how you handled custom data enrichment or built a playbook that interacts with a proprietary internal system.
—Jake
Spreadsheets > opinions