Defensys SOAR Platform vs OpenSOAR

Defensys SOAR Platform gathers security incident data from multiple sources into a central database for analysis and investigation, then supports response with workflows and playbooks. Playbooks can run specified actions automatically or use manual and mixed decision-making. The platform provides dynamic playbooks, ready-to-use scripts, adjustable workflows, and security-tool orchestration. SOC teams get shared case workspaces, task assignment, role and data access controls, chat, and commenting. Central storage covers incident data, evidence, documents, communications, and attachments. Teams can configure incident descriptions, templates, catalogs, access rules, and graphical playbooks. Defensys lists built-in integrations with commonly adopted security tools and systems, plus an open API and email connector for custom integrations. Reporting includes maps, relationship views, scheduled predefined or custom reports, and incident metrics. Real-time sharing can send selected incident data to partners, experts, communities, and public CERTs, with controls for recipients and data volume. The platform is available through web and API access. Defensys describes it for internal Security Operations Centers across banking, government, oil and gas, energy, metallurgy, and industry. Pricing is on request.

OpenSOAR is an open-source platform for automating security alert handling with Python playbooks. It accepts alerts through webhooks, Elasticsearch polling, and syslog, then can normalize their data, extract indicators of compromise, and remove duplicates. Playbooks are asynchronous Python functions that teams can test, version, and run with standard Python packages. The execution engine supports parallel actions, timeouts, retries, and exponential backoff. For incident work, OpenSOAR can create and link cases, assign them, add comments and observables to timelines, and surface correlation suggestions. Listed integrations include Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email; a Python SDK can be extended. AI options include Claude, OpenAI, and Ollama for tasks such as summarization, triage recommendations, playbook generation, and correlation. The maker says local Ollama can keep AI triage data within the network. OpenSOAR is self-hosted, with Docker Compose deployment documented, and is available on the web and through an API. The free plan is free, with no feature gates or per-action billing. The homepage labels the product beta.