SOAR GUIDE · LAST CHECKED SEPTEMBER 2026 · EDITORIAL ASSESSMENT
Keeping some SOAR playbooks: how to run SOAR and AI SOC together
Cyber AI Comparison team · Last checked September 2026 · Editorial assessment
What to know
Yes, you can blend them, and most teams do during a migration. Keep deterministic playbooks for fixed, audited responses; move triage and investigation of variable alerts to the AI SOC platform. Dropzone AI, 7AI and Intezer are designed to sit alongside a SOAR, and Cortex XSOAR adds agents inside playbooks.
Which playbooks should stay, and which should move?
| Keep in SOAR | Move to AI SOC |
|---|---|
| Leaver account disablement | Phishing report triage |
| Blocking a confirmed indicator across controls | Suspicious login investigation |
| Evidence collection for compliance | Endpoint alert investigation with process context |
| Notifications and ticket creation | Cloud misconfiguration alerts that need context |
Which platforms support a blended setup?
- Dropzone AI: investigates and hands response to Cortex XSOAR, Splunk SOAR, Tines, Torq and other SOARs.
- 7AI: connects to the tools you own and calls itself a force multiplier, not a replacement.
- Intezer: routes incidents to SOAR and ticketing systems.
- Cortex XSOAR with AgentiX: AI prompts and agents inside existing playbooks.
- Torq and Mate Security: replace SOAR but keep deterministic steps (Torq's deterministic workflows; Mate's Gamebooks, 'deterministic where it can').
What goes wrong in a blended setup?
Two systems acting on the same alert. Decide per alert category which system owns response, and make the other read-only for that category. Keep one case record as the source of truth, and log which system took each action.
Frequently asked questions
Can I write my own prompts to adjust agentic workflows?
On several platforms, yes: Mate says Gamebooks are written in plain language, Torq builds workflows from natural language, and Cortex AgentiX lets teams write their own prompts into playbooks.