Best open source SOAR platforms in 2026

Best open source SOAR platforms for AI-native security teams

Security orchestration, automation, and response (SOAR) platforms connect security tools and automate work such as alert triage, enrichment, and response. Open source platforms let teams inspect the code and run the software on their own infrastructure. The table below compares six tools across capabilities, licensing, and deployment.

This article compares six open source SOAR platforms: Tracecat, n8n, Shuffle, StackStorm, DFIR-IRIS, and Cortex. Each entry explains what the platform was built for, where it fits, and what you give up by choosing it. Tracecat is the best open source SOAR platform for security teams that want agents, workflows, and case management in an AI-native platform they can self-host. n8n suits general business automation, while Shuffle suits teams that want a free visual SOAR and are prepared to operate it themselves.

What counts as open source SOAR

A SOAR runs workflows across the security stack. It receives a detection from the SIEM, EDR, cloud, identity provider, or email gateway, enriches it, decides whether the alert matters, contains it when it does, notifies the right people, and tracks all of it on a case. Tracecat clears that bar. Shuffle and StackStorm run the workflow half and leave cases to another tool. In Tracecat, cases, workflows, agents, and lookup tables share one data model. Enterprise workspace Git sync stores that automation in repositories your team owns.

Open source here means an OSI-approved license. Tracecat, Shuffle, and Cortex are AGPL-3.0, StackStorm is Apache-2.0, and DFIR-IRIS is LGPL-3.0. n8n's Sustainable Use License publishes the source and restricts commercial use, a combination the OSI does not classify as open source. Free community editions of Splunk SOAR and Cortex XSOAR are proprietary and belong with the excluded tools below.

Several tools that come up in the same search are not SOAR platforms: case tools such as DFIR-IRIS, enrichment engines such as Cortex and IntelOwl, SIEMs with active response such as Wazuh, and general orchestrators such as Kestra, Temporal, Airflow, and Node-RED. DFIR-IRIS and Cortex still get an entry because open source security teams run them next to a workflow engine.

Why security teams choose open source SOAR

Most SOCs run more than ten security tools, according to a SANS survey on automation in security operations. A SOAR coordinates work across those tools, including the SIEM, EDR, cloud infrastructure, identity provider, and email security. Teams evaluating open source options want control over how that work runs and how they can adapt it as their tools change.

• Vendor lock-in and per-action pricing. Proprietary SOAR licenses by action, execution, or seat. The playbooks stay in a format you cannot take with you. An open source license removes the meter, and a self-hosted deployment keeps the automation on infrastructure you control.
• Self-hosting and data residency. Alerts carry hostnames, user identities, and raw evidence that many teams cannot send to a vendor tenant. Self-hosting the control plane, not just a runner, keeps that data inside your own network boundary.
• Integrations as code. Security tooling changes faster than any vendor catalog. When a new integration is a YAML template or a Python function in a repository you control, an engineer ships it through the same review process as a detection rule.
• Agents you can inspect. An agent that quarantines a host is a privileged actor. Its prompts, tool calls, and decisions should stay in your Git, your VPC, and your audit logs, where your team can review them.

How we evaluated these platforms

• License. OSI-approved open source, source-available, or a free tier of a proprietary product.
• Execution engine and sandbox. How an action runs, what happens when a worker dies mid-workflow, and whether untrusted code gets a kernel-level sandbox or only a process or container boundary.
• Workflows, agents, cases, and tables in one platform. Whether an agent working a case can see what the workflow did and what the analyst decided.
• Custom integrations. What adding an integration takes: a file in a repository, an npm package and a restart, or a new container image.
• Git sync. Whether automation round-trips through a repository your team owns or only exports one way.
• SSO and audit logs. Whether an access-control review depends on a paid tier.
• Deployment and compliance. Self-hosting paths, managed cloud, data residency, whether air-gapped deployment is documented, and published compliance reports.
• Maintenance. GitHub stars, latest release, and last commit, from a dated snapshot in the repository table.

1. Tracecat: open source SOAR for AI-native security teams

Tracecat is an open source SOAR built for security teams that want agents, workflows, and case management in the same platform. Traditional SOAR products center on predefined playbooks and add AI to individual steps. Tracecat uses agents for investigations that require judgment and workflows for response paths the team wants to run the same way every time.

Tracecat's open source edition includes the tools to build agents, give them reusable skills, and connect them to security systems through MCP. Those agents work across workflows and cases: an agent that enriches an alert can continue investigating the resulting case with the earlier findings available.

Enterprise workspace Git sync exports workflows, preset agents, skills, table schemas, and case configuration to GitHub, GitLab, or Bitbucket, where changes are diffed, reviewed, and rolled back like code. Your repo stays the source of truth. In open source, the custom registry pulls YAML action templates and Python functions from your repository, pins the commit, and loads them without an image rebuild. Tracecat MCP is optimized for security automation and operations. Coding assistants can build and run workflows, agents, tables, and cases.

Tracecat runs workflows and agents on Temporal, which preserves execution state across retries and worker restarts. Actions run in existing workers rather than starting a container for each step. On Kubernetes deployments, nsjail restricts the resources available to scripts and agent tool calls.

The open source edition supports self-hosting through Docker Compose or AWS Fargate. Enterprise adds Kubernetes deployment and managed Cloud in the US or EU. Teams that require an air-gapped environment can run Tracecat on Kubernetes with self-hosted models; the deployment guide explains how to provision the required services and images.

SSO and organization audit logs are included in open source. Enterprise adds controls such as custom roles, SCIM, and workspace Git sync. Every plan includes unlimited workflows, cases, and agents.

Best for: AI-native security teams that want agents, workflows, cases, and automations as code on one platform, self-hosted, air-gapped, or in a SOC 2 Type II cloud.

2. n8n: source-available workflow automation

n8n is a general workflow automation tool with a visual, node-based editor and a large catalog of SaaS and API nodes. An analyst can wire PagerDuty to an enrichment API to Slack in an afternoon. Its AI Agent node calls tools through several model providers, with MCP Client Tool and MCP Server Trigger nodes for external tools. Those are general agents with no security skills and no case to work from.

The tradeoff is that n8n is a SOAR only by adaptation. It has no case management of its own. Cases live in DFIR-IRIS, Jira, or TheHive, and that integration is yours to build and maintain. Git source control is available on qualifying commercial plans. A custom node is a TypeScript file plus a credentials file packaged as an npm module that loads on restart. n8n runs as a single process by default, with queue mode adding Redis and workers. Task runners isolate Code node execution in a separate process rather than a kernel-level sandbox. SSO sits on the Business and Enterprise plans. The Tracecat vs n8n comparison covers the rest row by row.

Best for: Organizations that automate across departments, treat security as one workload among many, and track cases in another tool.

3. Shuffle: legacy open source visual SOAR

Shuffle is a visual SOAR first released in 2019. Workflows are built from apps. Every app is its own Docker image, generated from an OpenAPI spec in the App Creator or written in Python against the App SDK. The backend is Go with OpenSearch as the document store, licensed AGPL-3.0, with apps, workflows, and the App SDK under MIT. Shuffle added an AI Agent action in 2025 that calls apps as MCP tools with action approvals, though the approvals do not yet notify in real time.

The architecture is where the operating cost sits. At runtime Shuffle starts one Worker container per execution and then one Docker container per app action. Shuffle's own sizing example is 110 containers per second at ten concurrent workflows. Scaling past one host means Docker Swarm or Kubernetes plus Memcached. Much of the backend, including execution preparation, validation, and parsing, sits in one Go source file: shared.go in the shuffle-shared repository runs to 39,799 lines. Shuffle Core is a no-code visual workflow builder with no case management of its own. Cases live in another tool. Shuffle Security is a separate beta project, covered under the excluded tools below. Workflows back up one way to GitHub. Nothing syncs back from a repository you own. In our assessment that combination is slow and hard to operate at volume. The open source edition is free. Cloud plans are priced by app runs, with Business and Enterprise through sales.

Best for: Teams that need a free visual SOAR and are prepared to operate a pre-agent platform themselves.

4. StackStorm: event-driven automation for infrastructure teams

StackStorm is event-driven automation for infrastructure teams, licensed Apache-2.0 under the Linux Foundation. Sensors watch external systems, rules match the triggers they emit, and actions or Orquesta workflows run in response. Everything ships as packs, Git repositories holding sensors, actions, rules, and workflows, with actions in Python or shell. The components run as microservices over RabbitMQ and MongoDB and scale by adding action runners. It installs by script, Ansible, Docker, or the stackstorm-k8s Helm chart, self-host only, with no commercial edition.

The tradeoff for security teams is scope. StackStorm has no cases, no agents, and no security content beyond community packs. Actions run as processes on the runner without a sandbox. Packs install from Git but nothing syncs back from a running deployment. LDAP and RBAC came from a retired paid edition, audit is whatever the service logs capture, and the st2web interface dates from 2016.

Best for: Infrastructure and platform teams that want event-driven remediation from sensors and rules and track incidents in another tool.

5. DFIR-IRIS: open source incident response case management

DFIR-IRIS is open source incident response case management, licensed LGPL-3.0. A case holds assets, IOCs, a timeline, evidence, notes, tasks, and alerts, with real-time war rooms for collaboration. Python IrisModules extend the core through pipeline and processor hooks. It deploys on Docker Compose, with Helm and Kustomize starting points for Kubernetes, as a web app, PostgreSQL, RabbitMQ, a worker, and NGINX. The project is community-maintained and funded through OpenCollective, with no commercial edition or hosted plan.

DFIR-IRIS is not a SOAR. It has no workflow engine and no agents. The automation around it is yours to build and the stack is yours to maintain. Modules run as RabbitMQ jobs in the worker process without a sandbox. No Git synchronization is documented.

Best for: Teams that want a free, self-hosted case and evidence system and already run automation elsewhere.

6. Cortex: observable analysis and response engine

Cortex is the observable analysis and response engine from TheHive Project, licensed AGPL-3.0. You submit an observable and Cortex runs analyzers against it and responders in reply. Analyzers and responders are scripts in the Cortex-Analyzers repository, each running as a process or a Docker image. Cortex ships as a Docker image or as deb and rpm packages and requires Elasticsearch.

Cortex is not a SOAR. It has no workflow builder, no cases, and no agents; its job is to feed observables and results to TheHive or another case tool. That dependency is the tradeoff. TheHive went proprietary at version 5. StrangeBee states that versions 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. Cortex itself remains free, while StrangeBee sells TheHive 5 licenses.

Best for: Teams that want a free analyzer and responder engine beside a SOAR or beside TheHive and can run the job workers themselves.

Open source SOAR platforms at a glance

The entries above say which edition each deployment option in the first table belongs to.

Repository activity is one quick check on whether a project will still be maintained when you need a fix. The figures are a snapshot of the GitHub API taken on September 12, 2026.

The last table compares the three workflow engines on the capabilities a SOAR needs.

n8n sends cases to another tool. Shuffle Core has no built-in case management. It can back up workflows to GitHub, but it does not sync changes back from the repository. Its incident workspace is a separate beta repository. See the FAQ for why one data model for cases, workflows, and agents matters.

Tools we excluded

• TheHive 5. TheHive has been proprietary since version 5. StrangeBee states that TheHive 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. See the TheHive repository.
• Catalyst. The owner archived the repository on July 18, 2026. See the Catalyst repository.
• WALKOFF. NSA Cybersecurity built WALKOFF; development stopped years ago. See the WALKOFF repository.
• Wazuh. Wazuh is a GPL-2.0 SIEM and XDR with an active response feature, not a SOAR: it has no workflow builder and no case management. See the active response docs.
• IntelOwl. IntelOwl is an AGPL-3.0 enrichment platform with no workflows or cases; it sits beside a SOAR rather than replacing one. See the IntelOwl repository.
• Shuffle Security. A separate repository from Shuffle Core, described by Shuffle as a beta security operations frontend for incidents, host monitoring, vulnerabilities, and AI-driven response. It was created in January 2026 and has 11 stars. The repository has no license file. This article evaluates Shuffle Core only. See the Shuffle Security repository.
• Splunk SOAR Community Edition and Cortex XSOAR Community Edition. Both are free to run and proprietary: Splunk caps its community edition at 100 actions per day, XSOAR is full-featured for 30 days, then 166 executions per day, and neither gives you the source. See Splunk SOAR.
• Kestra, Temporal, Airflow, and Node-RED. General-purpose orchestrators; a team using one supplies the security integrations, case system, and operating model itself. Tracecat runs on Temporal as its execution engine. See Temporal.

Choosing an open source SOAR

For AI-native security teams

If your team intends to put agents into triage, enrichment, and response, choose Tracecat. Scale security work with agents, workflows, and cases you own. Start with the open source edition on Docker Compose or AWS Fargate; the agent builder, preset agents, reusable skills, hosted MCP catalog, cases, custom registry, Tracecat MCP, SSO, and organization audit logs are all included. Move to Enterprise for multi-tenant workspaces, workspace Git sync, RBAC, advanced cases, agent mentions in case comments and chat, the Kubernetes Helm chart, managed Cloud, or a forward deployed security engineer. See pricing or talk to us.

For teams that already run n8n

Keep n8n for business automation and add Tracecat for security cases and agents. n8n handles cross-department SaaS workflows well. It has no case record for an analyst and an agent to share, and no security skills for its agents. Tracecat brings 500+ integrations across SIEM, EDR, MDM, IdP, and more to the security side. Read the Tracecat vs n8n comparison before deciding which workloads move.

For case management without automation

If you only need a case and evidence system today, DFIR-IRIS is the free option built for that job: assets, IOCs, timelines, and war rooms in a self-hosted stack. Tracecat's open source cases are the alternative when you expect to add automation later, since custom fields, SLAs, comments, attachments, and two-way ticket sync sit on the platform the workflows and agents will run on. Start with cases, add workflows for the repeatable paths, and bring in agents where the backlog builds.