Best open source SOAR platforms in 2026

Best open source SOAR platforms for AI-native security teams

Security orchestration, automation, and response (SOAR) platforms connect security tools and automate work such as alert triage, enrichment, and response. Open source platforms let teams inspect the code and run the software on their own infrastructure. The table below compares six tools across capabilities, licensing, and deployment.

Team fit is an assessment of intended audience based on product scope, not evidence of existing customers.

This article compares six open source SOAR platforms: Tracecat, n8n, Shuffle, StackStorm, DFIR-IRIS, and Cortex. Each entry explains what the platform was built for, where it fits, and what you give up by choosing it.

What counts as open source SOAR

A SOAR runs workflows across the security stack. It receives a detection from the SIEM, EDR, cloud, identity provider, or email gateway, enriches it, decides whether the alert matters, contains it when it does, notifies the right people, and tracks all of it on a case. Tracecat clears that bar. Shuffle and StackStorm run the workflow half and leave cases to another tool. Tracecat runs workflows, agents, and cases in one platform. Tracecat Enterprise syncs workflows, agent presets, skills, table schemas, and case configuration to GitHub, GitLab, or Bitbucket, in a repository your team owns.

Open source here means an OSI-approved license. Tracecat, Shuffle, and Cortex are AGPL-3.0, StackStorm is Apache-2.0, and DFIR-IRIS is LGPL-3.0. n8n's Sustainable Use License publishes the source and restricts commercial use, a combination the OSI does not classify as open source. Splunk SOAR's free Community Edition is proprietary and belongs with the excluded tools below.

Several tools that come up in the same search are not SOAR platforms: case tools such as DFIR-IRIS, enrichment engines such as Cortex and IntelOwl, SIEMs with active response such as Wazuh, and general orchestrators such as Kestra, Temporal, Airflow, and Node-RED. DFIR-IRIS and Cortex still get an entry because open source security teams run them next to a workflow engine.

Why security teams choose open source SOAR

Most SOCs run more than ten security tools, according to a SANS survey on automation in security operations. A SOAR coordinates work across those tools, including the SIEM, EDR, cloud infrastructure, identity provider, and email security. Teams evaluating open source options want control over how that work runs and how they can adapt it as their tools change.

• Vendor lock-in and per-action pricing. Proprietary SOAR licenses by action, execution, or seat. The playbooks stay in a format you cannot take with you. An open source license removes the meter, and a self-hosted deployment keeps the automation on infrastructure you control.
• Self-hosting and data residency. Alerts carry hostnames, user identities, and raw evidence that many teams cannot send to a vendor tenant. Self-hosting the control plane, not just a runner, keeps that data inside your own network boundary.
• Integrations as code. Security tooling changes faster than any vendor catalog. When a new integration is a YAML template or a Python function in a repository you control, an engineer ships it through the same review process as a detection rule.
• Agents you can inspect. An agent that quarantines a host is a privileged actor. Its prompts, tool calls, and decisions should stay in your Git, your VPC, and your audit logs, where your team can review them.

How we evaluated these platforms

• License. OSI-approved open source, source-available, or a free tier of a proprietary product.
• Execution engine and sandbox. How an action runs, what happens when a worker dies mid-workflow, and whether untrusted code gets a kernel-level sandbox or only a process or container boundary.
• Workflows, agents, cases, and tables in one platform. Whether an agent working a case can see what the workflow did and what the analyst decided.
• Custom integrations. What adding an integration takes: a file in a repository, an npm package and a restart, or a new container image.
• Git sync. Whether automation round-trips through a repository your team owns or only exports one way.
• SSO and audit logs. Whether an access-control review depends on a paid tier.
• Deployment and compliance. Self-hosting paths, managed cloud, data residency, whether air-gapped deployment is documented, and published compliance reports.
• Maintenance. GitHub stars, latest release, and last commit, from a dated snapshot in the repository table.

1. Tracecat: agentic automation platform for security teams

Tracecat is the agentic automation platform for security teams. Agents, workflows, cases, tables, 500+ integrations, and 50+ hosted MCP servers ship in one platform that teams use as a SOAR replacement.

• Agents that work your cases. A Tracecat agent is a reusable preset with versioned skills, tools, and MCP servers. The same preset runs in workflows, chat, and cases. Any tool can wait for a person's approval.
• Driven from your coding assistant. Tracecat MCP exposes more than 100 tools. Your team drives the entire platform through prompts in Claude Code or ChatGPT Codex.
• Automation as code. Tracecat Enterprise syncs workflows, agent presets, skills, table schemas, and case configuration with a GitHub, GitLab, or Bitbucket repository your team owns. A push opens a pull request.
• Custom registry. Integrations are Python packages or YAML templates in your own Git repository, pinned to a commit with promote and rollback. New actions load without an image rebuild.
• Durable execution. Every workflow and agent run is persisted step by step on Temporal. Mixed queues keep fast actions and long-running agents apart. Tracecat is sized for more than 22 million actions a day, with KEDA autoscaling on Kubernetes.
• Sandboxed by default. nsjail restricts the resources available to scripts, custom actions, and agent tool calls without a container per run. It is on by default on Kubernetes.
• Self-hosted, air-gapped, or Cloud. Open source self-hosts on Docker Compose or AWS Fargate. Enterprise adds a Kubernetes Helm chart and a managed cloud in the US or EU. The air-gapped deployment guide covers production Kubernetes, including self-hosted LLM inference.
• Free edition with cases. The AGPL-3.0 edition has unlimited workflows, agents, and cases, plus SSO, built-in roles, and organization audit logs. Cases include comments, attachments, tags, and custom fields.

Best for: Enterprise and AI-native security teams that want to build their own security agents, workflows, and custom cases at production scale, with automation as code in a Git repository they own, self-hosted, air-gapped, or in a SOC 2 Type II cloud.

2. n8n: source-available workflow automation

n8n is a general-purpose workflow automation tool for every department, with a visual, node-based editor. Of the roughly 2,300 integrations n8n lists, 66 are in its cybersecurity category. Its agents run as AI Agent nodes inside workflows or in a standalone Agent Builder, in preview since September 2026. Those are general agents with no security skills and no case to work from.

The tradeoff is that n8n is a SOAR only by adaptation. It has no case management of its own. Cases live in DFIR-IRIS, Jira, or TheHive, and that integration is yours to build and maintain. Git source control is limited to the Business and Enterprise plans and does not commit agents. Every paid plan, self-hosted included, is metered by workflow executions. A custom node is a TypeScript file plus a credentials file packaged as an npm module that loads on restart. n8n runs as a single process by default, with queue mode adding Redis and workers. Task runners isolate Code node execution in a separate process rather than a kernel-level sandbox. SSO sits on the Business and Enterprise plans. The Tracecat vs n8n comparison covers the rest row by row.

Best for: Organizations that automate across departments, treat security as one workload among many, and track cases in another tool.

3. Shuffle: legacy open source visual SOAR

Shuffle is a visual SOAR first released in 2019. Workflows are built from apps. Every app is its own Docker image, generated from an OpenAPI spec in the App Creator or written in Python against the App SDK. The backend is Go with OpenSearch as the document store, licensed AGPL-3.0, with apps, workflows, and the App SDK under MIT. Shuffle added an AI Agent action in 2025 that calls apps as MCP tools with action approvals, though the approvals do not yet notify in real time.

The architecture is where the operating cost sits. At runtime Shuffle starts one Worker container per execution and then one Docker container per app action. Shuffle's own sizing example is 110 containers per second at ten concurrent workflows. Scaling past one host means Docker Swarm or Kubernetes plus Memcached. Much of the backend, including execution preparation, validation, and parsing, sits in one Go source file: shared.go in the shuffle-shared repository runs to 39,799 lines. Shuffle Core is a no-code visual workflow builder with no case management of its own. Cases live in another tool. Shuffle Security is a separate beta project, covered under the excluded tools below. Workflows back up one way to GitHub. Nothing syncs back from a repository you own. In our assessment that combination is slow and hard to operate at volume. The open source edition is free. Cloud plans are priced by app runs, with Business and Enterprise through sales.

Best for: Teams that need a free visual SOAR and are prepared to operate a pre-agent platform themselves.

4. StackStorm: event-driven automation for infrastructure teams

StackStorm is event-driven automation for infrastructure teams, licensed Apache-2.0 under the Linux Foundation. Sensors watch external systems, rules match the triggers they emit, and actions or Orquesta workflows run in response. Everything ships as packs, Git repositories holding sensors, actions, rules, and workflows, with actions in Python or shell. The components run as microservices over RabbitMQ and MongoDB and scale by adding action runners. It installs by script, Ansible, Docker, or the stackstorm-k8s Helm chart, self-host only, with no commercial edition.

The tradeoff for security teams is scope. StackStorm has no cases, no agents, and no security content beyond community packs. Actions run as processes on the runner without a sandbox. Packs install from Git but nothing syncs back from a running deployment. LDAP and RBAC came from a retired paid edition, audit is whatever the service logs capture, and the st2web interface dates from 2016.

Best for: Infrastructure and platform teams that want event-driven remediation from sensors and rules and track incidents in another tool.

5. DFIR-IRIS: open source incident response case management

DFIR-IRIS is open source incident response case management, licensed LGPL-3.0. A case holds assets, IOCs, a timeline, evidence, notes, tasks, and alerts, with real-time war rooms for collaboration. Python IrisModules extend the core through pipeline and processor hooks. It deploys on Docker Compose, with Helm and Kustomize starting points for Kubernetes, as a web app, PostgreSQL, RabbitMQ, a worker, and NGINX. The project is community-maintained and funded through OpenCollective, with no commercial edition or hosted plan.

DFIR-IRIS is not a SOAR. It has no workflow engine and no agents. The automation around it is yours to build and the stack is yours to maintain. Modules run as RabbitMQ jobs in the worker process without a sandbox. No Git synchronization is documented.

Best for: Teams that want a free, self-hosted case and evidence system and already run automation elsewhere.

6. Cortex: observable analysis and response engine

Cortex is the observable analysis and response engine from TheHive Project, licensed AGPL-3.0. You submit an observable and Cortex runs analyzers against it and responders in reply. Analyzers and responders are scripts in the Cortex-Analyzers repository, each running as a process or a Docker image. Cortex ships as a Docker image or as deb and rpm packages and requires Elasticsearch.

Cortex is not a SOAR. It has no workflow builder, no cases, and no agents; its job is to feed observables and results to TheHive or another case tool. That dependency is the tradeoff. TheHive went proprietary at version 5. StrangeBee states that versions 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. Cortex itself remains free, while StrangeBee sells TheHive 5 licenses.

Best for: Teams that want a free analyzer and responder engine beside a SOAR or beside TheHive and can run the job workers themselves.

Open source SOAR platforms at a glance

The entries above say which edition each deployment option in the first table belongs to.

Repository activity is one quick check on whether a project will still be maintained when you need a fix. The figures are a snapshot of the GitHub API taken on September 12, 2026.

The last table compares the three workflow engines on the capabilities a SOAR needs.

n8n sends cases to another tool. Shuffle Core has no built-in case management. It can back up workflows to GitHub, but it does not sync changes back from the repository. Its incident workspace is a separate beta repository. See the FAQ for why one data model for cases, workflows, and agents matters.

Tools we excluded

• TheHive 5. TheHive has been proprietary since version 5. StrangeBee states that TheHive 3 and 4 have not been maintained, distributed, or publicly accessible since 2023. See the TheHive repository.
• Catalyst. The owner archived the repository on July 18, 2026. See the Catalyst repository.
• WALKOFF. NSA Cybersecurity built WALKOFF; development stopped years ago. See the WALKOFF repository.
• Wazuh. Wazuh is a GPL-2.0 SIEM and XDR with an active response feature, not a SOAR: it has no workflow builder and no case management. See the active response docs.
• IntelOwl. IntelOwl is an AGPL-3.0 enrichment platform with no workflows or cases; it sits beside a SOAR rather than replacing one. See the IntelOwl repository.
• Shuffle Security. A separate repository from Shuffle Core, described by Shuffle as a beta security operations frontend for incidents, host monitoring, vulnerabilities, and AI-driven response. It was created in January 2026 and has 11 stars. The repository has no license file. This article evaluates Shuffle Core only. See the Shuffle Security repository.
• Splunk SOAR Community Edition. It is free to run and proprietary: Splunk caps it at 100 actions per day and does not give you the source. Palo Alto no longer offers a Cortex XSOAR Community Edition. See Splunk SOAR. Proprietary SOAR platforms are compared in our top 10 SOAR platforms ranking.
• Kestra, Temporal, Airflow, and Node-RED. General-purpose orchestrators; a team using one supplies the security integrations, case system, and operating model itself. Tracecat runs on Temporal as its execution engine. See Temporal.

Choosing an open source SOAR

For AI-native security teams

If your team intends to put agents into triage, enrichment, and response, choose Tracecat. Its agents work the same cases and tables as your analysts, with every workflow and agent run persisted step by step on Temporal. Start with the single-tenant open source edition on Docker Compose or AWS Fargate. The free edition has unlimited workflows, agents, and cases, plus SSO, built-in roles, and organization audit logs. Agent presets, skills, human-in-the-loop agent approvals, tables, the hosted MCP catalog, the custom registry, and Tracecat MCP are included. Move to Enterprise for workspace Git sync to a repository your team owns, multi-tenant workspaces, custom roles, advanced case management, agent mentions in case comments and chat, the Kubernetes Helm chart, managed cloud, or a forward deployed security engineer. See pricing or talk to us.

For teams that already run n8n

Keep n8n for business automation and add Tracecat for security cases and agents. n8n is built for cross-department SaaS workflows. It has no case record for an analyst and an agent to share, and no security skills for its agents. Tracecat brings 500+ integrations across SIEM, EDR, MDM, IdP, and more to the security side. Read the Tracecat vs n8n comparison before deciding which workloads move.

For case management without automation

If you only need a case and evidence system today, DFIR-IRIS is the free option built for that job: assets, IOCs, timelines, and war rooms in a self-hosted stack. Tracecat is the alternative when you expect to add automation later. Tracecat open source includes cases with comments, attachments, tags, and custom fields. Workflows and agents open and update the same case record your analysts work in. Start with cases, add workflows for the repeatable paths, and bring in agents where the backlog builds.