// industry vertical
SOAR / incident orchestration forensics
Cortex XSOAR war room · Splunk SOAR playbook runs · Swimlane cases · Torq workflows · ServiceNow SecOps · PagerDuty bridges · indicator ledger · playbook deviation · enrichment actions · multi-platform correlation.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- cortex xsoar incident war room forensic analyzerdrop xsoar incident json export · parse war room entries + task timeline + owner · runs locally
- splunk soar playbook run forensic analyzerdrop splunk soar container/run export · parse playbook blocks + action results · runs locally
- incident response playbook deviation detectordrop soar playbook run export · detect skipped steps + manual overrides · runs locally
- multi soar playbook correlation tooldrop 2+ soar run exports · correlate incident id + shared indicators · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- swimlane case timeline forensic analyzerdrop swimlane case export · parse record events + automation + assignee · runs locally
- torq automation run log forensic analyzerdrop torq workflow run export · parse step status + integration calls · runs locally
- servicenow security incident response forensic analyzerdrop servicenow secops incident export · parse tasks + cmdb links + state · runs locally
- pagerduty incident bridge forensic analyzerdrop pagerduty incident + bridge export · parse responder timeline + conference events · runs locally
- xsoar indicator ledger forensic extractordrop xsoar indicator export · parse reputation + relationships + expiration · runs locally
- soar enrichment action forensic analyzerdrop soar enrichment task export · parse vendor queries + hit counts · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper SOAR coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.