Best open source SOAR platforms in 2026

Security orchestration, automation, and response (SOAR) platforms automate work across a security team's tools. Most SOCs run more than ten of them, according to a SANS survey on automation in security operations: a SIEM or data lake, EDR, cloud infrastructure, an identity provider, email security, and firewalls. A SOAR takes detections from any of those sources and runs what happens next: enrichment, triage, containment, notification, and case tracking. Proprietary products defined the category. Most have since changed hands or shape: Phantom became Splunk SOAR, Demisto became Cortex XSOAR, which Palo Alto Networks now positions behind Cortex AgentiX, TheHive went proprietary at version 5, and Catalyst was archived in July 2026. Over the same period, AI agents changed what a SOAR has to do: run an agent inside an investigation, record every tool call, and let engineers review its prompts the way they review code. Security engineers who want to own that layer rather than rent it are looking at open source.

This article ranks six open source SOAR platforms: Tracecat, n8n, Shuffle, StackStorm, DFIR-IRIS, and Cortex. Each entry covers what the platform was built for, where it fits, and the tradeoff you take on. The short version is that Tracecat is the open source SOAR for AI-native security teams. n8n suits organizations that treat security as one automation workload among many. Shuffle remains the free visual SOAR for teams willing to operate a pre-agent architecture. DFIR-IRIS, StackStorm, and Cortex are narrower tools that fit beside a SOAR.

Open source SOAR platforms ranked

The six platforms in rank order. Each entry below covers one in detail.

What counts as open source SOAR

A SOAR runs workflows across the security stack. It receives a detection from the SIEM, EDR, cloud, identity provider, or email gateway, enriches it, decides whether the alert matters, contains it when it does, notifies the right people, and tracks all of it on a case. Tracecat clears that bar. Shuffle and StackStorm run the workflow half and leave cases to another tool. In Tracecat, cases, workflows, agents, and lookup tables share one data model and sync to Git repositories your team owns.

Open source here means an OSI-approved license. Tracecat, Shuffle, and Cortex are AGPL-3.0, StackStorm is Apache-2.0, and DFIR-IRIS is LGPL-3.0. n8n's Sustainable Use License publishes the source and restricts commercial use, a combination the OSI does not classify as open source. Free community editions of Splunk SOAR and Cortex XSOAR are proprietary and belong with the excluded tools below.

Several tools that come up in the same search are not SOAR platforms: case tools such as DFIR-IRIS, enrichment engines such as Cortex and IntelOwl, SIEMs with active response such as Wazuh, and general orchestrators such as Kestra, Temporal, Airflow, and Node-RED. DFIR-IRIS and Cortex still get an entry because open source security teams run them next to a workflow engine.

Why security teams choose open source SOAR

• Vendor lock-in and per-action pricing. Proprietary SOAR licenses by action, execution, or seat. The playbooks stay in a format you cannot take with you. An open source license removes the meter, and a self-hosted deployment keeps the automation on infrastructure you control.
• Self-hosting and data residency. Alerts carry hostnames, user identities, and raw evidence that many teams cannot send to a vendor tenant. Self-hosting the control plane, not just a runner, keeps that data inside your own network boundary.
• Integrations as code. Security tooling changes faster than any vendor catalog. When a new integration is a YAML template or a Python function in a repository you control, an engineer ships it through the same review process as a detection rule.
• Agents you can inspect. An agent that quarantines a host is a privileged actor. Its prompts, tool calls, and decisions should stay in your Git, your VPC, and your audit logs, where your team can review them.

How we evaluated these platforms

• License. OSI-approved open source, source-available, or a free tier of a proprietary product.
• Execution engine and sandbox. How an action runs, what happens when a worker dies mid-workflow, and whether untrusted code gets a kernel-level sandbox or only a process or container boundary.
• Workflows, agents, cases, and tables in one platform. Whether an agent working a case can see what the workflow did and what the analyst decided.
• Custom integrations. What adding an integration takes: a file in a repository, an npm package and a restart, or a new container image.
• Git sync. Whether automation round-trips through a repository your team owns or only exports one way.
• SSO and audit logs. Whether an access-control review depends on a paid tier.
• Deployment and compliance. Self-hosting paths, managed cloud, data residency, whether air-gapped deployment is documented, and published compliance reports.
• Maintenance. GitHub stars, latest release, and last commit, from a dated snapshot in the repository table.

1. Tracecat: open source SOAR for AI-native security teams

Tracecat was built for AI agents and security engineers from day one. Where a traditional SOAR is a playbook engine with AI attached later, Tracecat treats agents as the scaling layer and workflows and cases as the primitives underneath them. Tracecat helps AI-native security teams build agents and automate work.

The same preset agent works across workflows, cases, and chat. An agent that enriches an alert inside a workflow picks up the resulting case with its history intact and can answer questions about it in Slack or Teams, drawing on case context and searchable table data as it goes. Lookup tables hold IoCs, assets, and allowlists that workflows and agents query. Cases are native and open source: triage alerts with custom fields, SLAs, comments, attachments, linked tables, and two-way ticket sync. Enterprise adds the agent builder and preset agents composed from reusable skills your team ships to Git, 65+ hosted MCP servers curated and maintained by Tracecat, tool approvals, case triggers, and agent mentions. Tracecat supports any LLM provider or gateway, cloud or self-hosted.

Agents, workflows, and cases sync to Git repositories your team owns. In open source, the custom registry pulls YAML action templates and Python functions from your repository, pins the commit, and loads them without an image rebuild. Enterprise Git sync exports workflows, preset agents, skills, and table schemas to GitHub, GitLab, or Bitbucket, where prompt changes are diffed, reviewed, and rolled back like code. Your repo stays the source of truth. Tracecat MCP is optimized for security automation and operations. Coding assistants can build and run workflows, agents, tables, and cases.

Underneath, Tracecat runs on Temporal durable execution with a warm worker pool. An action is a function call on a running worker rather than a container start. Retries and resumption survive worker restarts. On Kubernetes deployments, nsjail sandboxes every script and agent tool call by default, with filesystem, CPU, memory, and process caps. The public benchmark plan tests bursts of up to 10,000 concurrent actions against a small PostgreSQL deployment, as a plan rather than a published result. SSO and audit logs ship in the open source edition: SAML and OIDC with no SSO tax, plus open source audit logs of every prompt, tool call, and decision your agents make. Docker Compose and AWS Fargate via Terraform are open source. The Kubernetes Helm chart and managed Cloud, hosted in the US or EU with SOC 2 Type II, are Enterprise, along with RBAC, SCIM, and a forward deployed security engineer. Tracecat also runs fully air-gapped on Kubernetes with zero runtime internet connectivity. The air-gapped deployment guide walks through mirroring the OCI chart and every container image into an internal registry, provisioning internal PostgreSQL, Redis, S3-compatible storage, Temporal, identity, DNS, TLS, and secrets, and routing agents to self-hosted LLM inference through vLLM or Ollama. Every Tracecat feature works air-gapped. Tracecat runs air-gapped on-premises in production at commercial and federal organizations, including U.S. Army DEVCOM. Every plan includes unlimited workflows, workspaces, and cases. More than 500 deployments run across the open source and Enterprise editions, including federal and defense organizations, consumer fintech and marketplace companies, and AI-native startups.

Best for: AI-native security teams that want agents, workflows, cases, and automations as code on one platform, self-hosted, air-gapped, or in a SOC 2 Type II cloud.

2. n8n: source-available workflow automation

n8n is a general workflow automation tool with a visual, node-based editor and a large catalog of SaaS and API nodes. An analyst can wire PagerDuty to an enrichment API to Slack in an afternoon. Its AI Agent node calls tools through several model providers, with MCP Client Tool and MCP Server Trigger nodes for external tools. Those are general agents with no security skills and no case to work from.

The tradeoff is that n8n is a SOAR only by adaptation. It has no case management of its own. Cases live in DFIR-IRIS, Jira, or TheHive, and that integration is yours to build and maintain. Git source control is available on qualifying commercial plans. A custom node is a TypeScript file plus a credentials file packaged as an npm module that loads on restart. n8n runs as a single process by default, with queue mode adding Redis and workers. Task runners isolate Code node execution in a separate process rather than a kernel-level sandbox. SSO sits on the Business and Enterprise plans. The Tracecat vs n8n comparison covers the rest row by row.

Best for: Organizations that automate across departments, treat security as one workload among many, and track cases in another tool.

3. Shuffle: legacy open source visual SOAR

Shuffle is a visual SOAR first released in 2019. Workflows are built from apps. Every app is its own Docker image, generated from an OpenAPI spec in the App Creator or written in Python against the App SDK. The backend is Go with OpenSearch as the document store, licensed AGPL-3.0, with apps, workflows, and the App SDK under MIT. Shuffle added an AI Agent action in 2025 that calls apps as MCP tools with action approvals, though the approvals do not yet notify in real time.

The architecture is where the operating cost sits. At runtime Shuffle starts one Worker container per execution and then one Docker container per app action. Shuffle's own sizing example is 110 containers per second at ten concurrent workflows. Scaling past one host means Docker Swarm or Kubernetes plus Memcached. Much of the backend, including execution preparation, validation, and parsing, sits in one Go source file: shared.go in the shuffle-shared repository runs to 39,799 lines. Shuffle Core is a no-code visual workflow builder with no case management of its own. Cases live in another tool. Shuffle Security is a separate beta project, covered under the excluded tools below. Workflows back up one way to GitHub. Nothing syncs back from a repository you own. In our assessment that combination is slow and hard to operate at volume. The open source edition is free. Cloud plans are priced by app runs, with Business and Enterprise through sales.

Best for: Teams that need a free visual SOAR and are prepared to operate a pre-agent platform themselves.

4. StackStorm: event-driven automation for infrastructure teams

StackStorm is event-driven automation for infrastructure teams, licensed Apache-2.0 under the Linux Foundation. Sensors watch external systems, rules match the triggers they emit, and actions or Orquesta workflows run in response. Everything ships as packs, Git repositories holding sensors, actions, rules, and workflows, with actions in Python or shell. The components run as microservices over RabbitMQ and MongoDB and scale by adding action runners. It installs by script, Ansible, Docker, or the stackstorm-k8s Helm chart, self-host only, with no commercial edition.

The tradeoff for security teams is scope. StackStorm has no cases, no agents, and no security content beyond community packs. Actions run as processes on the runner without a sandbox. Packs install from Git but nothing syncs back from a running deployment. LDAP and RBAC came from a retired paid edition, audit is whatever the service logs capture, and the st2web interface dates from 2016.

Best for: Infrastructure and platform teams that want event-driven remediation from sensors and rules and track incidents in another tool.

5. DFIR-IRIS: open source incident response case management

DFIR-IRIS is open source incident response case management, licensed LGPL-3.0. A case holds assets, IOCs, a timeline, evidence, notes, tasks, and alerts, with real-time war rooms for collaboration. Python IrisModules extend the core through pipeline and processor hooks. It deploys on Docker Compose, with Helm and Kustomize starting points for Kubernetes, as a web app, PostgreSQL, RabbitMQ, a worker, and NGINX. The project is community-maintained and funded through OpenCollective, with no commercial edition or hosted plan.

DFIR-IRIS is not a SOAR. It has no workflow engine and no agents. The automation around it is yours to build and the stack is yours to maintain. Modules run as RabbitMQ jobs in the worker process without a sandbox. No Git synchronization is documented.

Best for: Teams that want a free, self-hosted case and evidence system and already run automation elsewhere.

6. Cortex: observable analysis and response engine

Cortex is the observable analysis and response engine from TheHive Project, licensed AGPL-3.0. You submit an observable and Cortex runs analyzers against it and responders in reply. Analyzers and responders are scripts in the Cortex-Analyzers repository, each running as a process or a Docker image. Cortex ships as a Docker image or as deb and rpm packages and requires Elasticsearch.

Cortex is not a SOAR. It has no workflow builder, no cases, and no agents; its job is to feed observables and results to TheHive or another case tool. That dependency is the tradeoff. TheHive went proprietary at version 5. StrangeBee states that versions 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. Cortex itself remains free, while StrangeBee sells TheHive 5 licenses.

Best for: Teams that want a free analyzer and responder engine beside a SOAR or beside TheHive and can run the job workers themselves.

Open source SOAR platforms at a glance

The entries above say which edition each deployment option in the first table belongs to.

Repository activity is one quick check on whether a project will still be maintained when you need a fix. The figures are a snapshot of the GitHub API taken on September 12, 2026.

The last table compares the three workflow engines on the capabilities a SOAR needs.

n8n sends cases to another tool. Shuffle Core has no cases and no path to Git. Its incident workspace is a separate beta repository. See the FAQ for why one data model for cases, workflows, and agents matters.

Tools we excluded

• TheHive 5. TheHive has been proprietary since version 5. StrangeBee states that TheHive 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. See the TheHive repository.
• Catalyst. The owner archived the repository on July 18, 2026. See the Catalyst repository.
• WALKOFF. NSA Cybersecurity built WALKOFF; development stopped years ago. See the WALKOFF repository.
• Wazuh. Wazuh is a GPL-2.0 SIEM and XDR with an active response feature, not a SOAR: it has no workflow builder and no case management. See the active response docs.
• IntelOwl. IntelOwl is an AGPL-3.0 enrichment platform with no workflows or cases; it sits beside a SOAR rather than replacing one. See the IntelOwl repository.
• Shuffle Security. A separate repository from Shuffle Core, described by Shuffle as a beta security operations frontend for incidents, host monitoring, vulnerabilities, and AI-driven response. It was created in January 2026 and has 11 stars. The repository has no license file. This article evaluates Shuffle Core only. See the Shuffle Security repository.
• Splunk SOAR Community Edition and Cortex XSOAR Community Edition. Both are free to run and proprietary: Splunk caps its community edition at 100 actions per day, XSOAR is full-featured for 30 days, then 166 executions per day, and neither gives you the source. See Splunk SOAR.
• Kestra, Temporal, Airflow, and Node-RED. General-purpose orchestrators; a team using one supplies the security integrations, case system, and operating model itself. Tracecat runs on Temporal as its execution engine. See Temporal.

Choosing an open source SOAR

For AI-native security teams

If your team intends to put agents into triage, enrichment, and response, choose Tracecat. Scale security work with agents, workflows, and cases you own. Start with the open source edition on Docker Compose or AWS Fargate; cases, the custom registry, Tracecat MCP, SSO, and audit logs are all included. Move to Enterprise for preset agents shared across the team, Git sync for the whole workspace, the Kubernetes Helm chart including air-gapped deployment, or managed Cloud with a forward deployed security engineer. See pricing or talk to us.

For teams that already run n8n

Keep n8n for business automation and add Tracecat for security cases and agents. n8n handles cross-department SaaS workflows well. It has no case record for an analyst and an agent to share, and no security skills for its agents. Tracecat brings 500+ integrations across SIEM, EDR, MDM, IdP, and more to the security side. Read the Tracecat vs n8n comparison before deciding which workloads move.

For case management without automation

If you only need a case and evidence system today, DFIR-IRIS is the free option built for that job: assets, IOCs, timelines, and war rooms in a self-hosted stack. Tracecat's open source cases are the alternative when you expect to add automation later, since custom fields, SLAs, comments, attachments, linked tables, and two-way ticket sync sit on the platform the workflows and agents will run on. Start with cases, add workflows for the repeatable paths, and bring in agents where the backlog builds.