OpenSOAR vs Tines
OpenSOAR
opensoar.app
Tines
tines.comSide by side
| Figure | OpenSOAR | Tines |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 5 |
| Spec score · Security Orchestration, Automation, and Response Software | 8.5 (#1) | 8.2 (#3) |
| Spec score · SOAR Software | 8.6 (#1) | 8.3 (#3) |
| Case management | OpenSOAR links alerts to incidents, assigns cases, records timeline comments, stores observables and offers correlation suggestions. | Cases provides automation-first incident management with records, dashboards, runbooks, collaboration, and audit trails. |
| Deployment | OpenSOAR is self-hosted and its repository documents a Docker Compose deployment. | Tines 3B can run self-hosted, on-premises, or in a hybrid deployment. |
| Integrations | The maker lists Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email as integrations, with an extensible Python SDK. | Tines says Stories can connect to any service that exposes an API, including internal tools and niche systems. |
| Intended users | The maker identifies SOC teams, MSSPs, incident responders, SREs, infrastructure and on-call teams, and DevOps teams as use cases. | Tines 3B is for builders across business teams, with Security and IT responsible for governing the work. |
| Licence | OpenSOAR is released under the Apache 2.0 license. | Tines commercial terms grant a limited, non-exclusive, non-transferable subscription license, so the product is not open source. |
| Security controls | The maker lists JWT authentication, integration API keys, three core roles, and admin-managed local accounts. | Security features include configurable session timeout, SSO/SAML on all plans, data-retention controls, audit logs, and team-based resource separation. |
| Self-hosting | The documented default deployment uses Docker Compose with API, worker, migration, PostgreSQL, Redis and UI services. | Tines offers self-hosted deployments and hybrid cloud deployments using tunnels. |
| What it does | OpenSOAR automates security-alert triage, enrichment and response with Python playbooks. | Tines Stories lets teams build, run, and monitor automated workflows for security, IT, and other operations. |
Plans
Tines
- Free editionFree
- Business EditionPrice not published
- Enterprise EditionPrice not published
- Explore (Free edition)Free
- Paid editionsPriced on request
In their own words
OpenSOAR
OpenSOAR is an open-source platform for automating security alert handling with Python playbooks. It accepts alerts through webhooks, Elasticsearch polling, and syslog, then can normalize their data, extract indicators of compromise, and remove duplicates. Playbooks are asynchronous Python functions that teams can test, version, and run with standard Python packages. The execution engine supports parallel actions, timeouts, retries, and exponential backoff. For incident work, OpenSOAR can create and link cases, assign them, add comments and observables to timelines, and surface correlation suggestions. Listed integrations include Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email; a Python SDK can be extended. AI options include Claude, OpenAI, and Ollama for tasks such as summarization, triage recommendations, playbook generation, and correlation. The maker says local Ollama can keep AI triage data within the network. OpenSOAR is self-hosted, with Docker Compose deployment documented, and is available on the web and through an API. The free plan is free, with no feature gates or per-action billing. The homepage labels the product beta.
Tines
Tines 3B is an AI-native platform for building, running and monitoring AI agents, apps and automated workflows. Builders can create processes with natural language, code, Git integration and branching, including conditional logic and webhook triggers. The platform supports connected LLM chat, AI skills and coding assistants such as Claude Code or Codex. Tines says it can connect to any API or Model Context Protocol service, rather than relying only on a fixed catalogue of integrations. Each workflow step runs in an isolated sandbox; connector credentials are supplied at runtime rather than exposed to builders or stored in code. Deployment options include self-hosted, on-premises and hybrid setups. Monitoring covers AI spend, access, duplicate work, workflow savings, frontend routes and package dependencies. The platform is intended for business-team builders, with Security and IT governing the work. Tines states it maintains SOC 2 Type II compliance and undergoes annual audits. Its Free edition costs nothing and permits three live workflows.