Hi everyone,
I've been trying to wrap my head around the SOAR landscape for our small security team. We're using a couple of open-source tools for other things (like Osquery for endpoint visibility), and I was hoping to find something similar for automation and orchestration to tie our alerts together.
But whenever I search for "open source SOAR," I keep running into projects that seem... abandoned? Or they've pivoted to a commercial-only model. It feels like the big names are all enterprise platforms with price tags that are way out of our reach for now.
So my question is pretty basic: is there a decent, currently-maintained open-source SOAR option anymore? Or has the space completely moved to commercial vendors? I'm not looking for something with every bell and whistle, just a core framework we could build on to automate some of our basic alert triage and response steps.
If the answer is "it's all commercial now," that's okay—I just want to know so I can stop going down rabbit holes. Any guidance from folks who've been through this evaluation would be super appreciated 😅