D3 SOAR vs RunbookAI

D3 Smart SOAR automates security operations workflows and incident response as SaaS hosted by D3 or on-premises software. Its Event Pipeline normalizes, deduplicates, triages, and enriches alerts; D3 claims this can reduce events requiring human attention by up to 99%. A codeless playbook editor, ready-made library, and reusable automation blocks support response workflows. Smart SOAR integrates with hundreds of tools across SIEM, EDR, NDR, TIP, and ITSM categories. D3 says it will build missing integrations free of charge. Threat-intelligence reputation results enrich incidents and contribute to an overall risk score. Existing playbooks and integrations cover phishing, ransomware, and password resets. Full multi-tenancy supports managed security service providers and managed detection and response firms. The platform includes event triggers, scheduled runs, approval steps, incident integrations, and audit logs. D3’s customer-success program describes implementation planning, training, integration optimization, technical documentation, and Customer Success Manager support. Pricing is on request, with a demo request offered.

RunbookAI is a self-hosted, MIT-licensed incident-response tool for investigating production problems. Its workflow collects incident context, ranks hypotheses, checks them against infrastructure, identifies a root cause, and recommends remediation. Users can ask natural-language questions across AWS, Kubernetes, and CloudWatch, then execute step-by-step runbooks. Queries are read-only by default; every mutating action needs explicit human approval. Investigations record hypotheses, evidence, proposed actions, approval decisions, and execution results in a local audit trail. RunbookAI indexes knowledge from local files, Confluence, and Google Drive. Documented integrations include AWS, Kubernetes, PagerDuty, OpsGenie, Slack, and Claude Code. A self-hosted shared knowledge server exposes runbooks, postmortems, and known issues through REST and an MCP endpoint for Claude Code. CLI mode is available, with no hosted service or control plane. The maker says it runs inside your infrastructure, sends no telemetry, and sends model requests directly to the configured provider without proxying or storing prompts. Requirements include Bun 1.0+ or Node.js 20+ and an Anthropic API key for Claude.