For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
Mobile US PressList your app
Vendor dashboard

OpenSOAR

No phone app

6.2No. 2 of 19
in SOAR Software
  • Recognised40% of the score20
  • Phone app26% of the score0
  • Documented20% of the score84
  • Free plan14% of the score100
Free plan
Yes
Runs on
api, self-hosted, Web
Visit site Alternatives

Summary

OpenSOAR is an open-source, self-hosted platform for automating security alert triage, enrichment, and response with Python playbooks. Alerts can arrive through webhooks, Elasticsearch polling, or syslog; the platform can normalize payloads, extract indicators of compromise, and deduplicate them. Playbooks are asynchronous Python functions that can be tested, versioned, and run with standard Python packages. The execution engine supports parallel actions, per-action timeouts, retries, and exponential backoff. Case management can create and link incidents, assign cases, add timeline comments and observables, and show correlation suggestions. Listed integrations include Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email, with an extensible Python SDK. AI options include Claude, OpenAI, and Ollama for capabilities such as summarization, triage recommendations, playbook generation, auto-resolution, and correlation. The maker says local Ollama can be used without data leaving the network. OpenSOAR is free under the Apache 2.0 license, with no feature gates or per-action billing. It is self-hosted, its repository documents Docker Compose deployment, and its homepage labels it as currently in beta.

Who it is for

It suits SOC teams, MSSPs, incident responders, SREs, infrastructure and on-call teams, and DevOps teams seeking self-hosted alert automation. Python playbooks and case tools support teams that want to tailor triage and response workflows.

What is good

  • Free under Apache 2.0, with no feature gates.
  • Ingests alerts through webhooks, polling, and syslog.
  • Python playbooks support retries and parallel actions.
  • Local Ollama can keep data within the network.

What to know first

  • The product is currently in beta.
  • Deployment is self-hosted.

Verdict

OpenSOAR combines alert intake, Python-based automation, and case management in a self-hosted package. Its maker labels it beta, so readers should account for that status when considering it.

OpenSOAR plans and pricing

All plans
OpenSOAR Free Apache 2.0 licensed · self-hosted · no feature gates · no per-action billing opensoar.app · 30 Sept 2026

Compared on SOAR software

Free plan
Yesopensoar.app
Playbook automation
Yesopensoar.app
Alert enrichment
Yesopensoar.app
Threat intel actions
Yesopensoar.app
Case management
Yesopensoar.app
Deployment model
self_hostedopensoar.app

Facts

Purpose
OpenSOAR is an open-source platform for automating alert triage, enrichment, and response using Python playbooks.opensoar.app · 30 Sept 2026
Playbooks
Playbooks are Python async functions that can be tested, versioned, and run with standard Python packages.opensoar.app · 30 Sept 2026
Ingestion
It supports alert intake through webhooks, Elasticsearch polling, and syslog, with payload normalization, IOC extraction, and deduplication.opensoar.app · 30 Sept 2026
Execution
The async playbook engine supports parallel actions and per-action timeouts, retries, and exponential backoff.opensoar.app · 30 Sept 2026
Integrations
The maker lists Elastic Security, VirusTotal, AbuseIPDB, Slack, and Email as integrations, with an extensible Python SDK.github.com · 30 Sept 2026
AI
AI features include LLM summarization, triage recommendations, playbook generation, auto-resolve, and correlation, with Claude, OpenAI, and Ollama listed as options.github.com · 30 Sept 2026
Data control
The maker says AI triage can use local Ollama and that no data leaves the network if the user does not want it to.opensoar.app · 30 Sept 2026
Security controls
The maker lists JWT authentication, integration API keys, three core roles, and admin-managed local accounts.github.com · 30 Sept 2026
Audit
The maker says automation actions are logged with timestamps and full context, and AI decisions include logged inputs, outputs, and reasoning.opensoar.app · 30 Sept 2026
Deployment
OpenSOAR is self-hosted and its repository documents a Docker Compose deployment.github.com · 30 Sept 2026
Intended users
The maker identifies SOC teams, MSSPs, incident responders, SREs, infrastructure and on-call teams, and DevOps teams as use cases.opensoar.app · 30 Sept 2026
Support and docs
The maker provides canonical documentation covering setup, playbooks, deployment, API usage, troubleshooting, and engineering references.docs.opensoar.app · 30 Sept 2026
Notable limit
The maker's homepage labels the product as currently in beta.opensoar.app · 30 Sept 2026

Best OpenSOAR alternatives

See all 18
Tracecat No. 1 6.3 No phone appFreeSumo Logic No. 3 6.2 No phone appFreeTines No. 4 6.1 No phone appFreeMjolnir SOAR Platform No. 5 5.8 No phone appPalo Alto Networks Cortex Cloud API Security No. 6 5.8 No phone appCyware Security Orchestration and Automation No. 7 5.7 No phone app

Where it ranks on Samsung Mobile US Press

Is OpenSOAR yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenSOAR

Sources