How would a Splunk Phantom user look at/understand SIR/SOAR capabilities?

[nancym]

A large ServiceNow & Phantom customer wants to have a conversation about how the two should work together. They both have playbooks and automation capabilities. ServiceNow has the advantage of the CMDB and workflow with other teams. What else?

thank you,

Nancy

[Marc Washington · Accepted solution]

I look at ServiceNow more in implementing Incident Handling and Incident Response automation and orchestration and Phantom more to automate and orchestrate actual monitoring activities. I should add that the 2 can interact through API.