IBM's SOAR platform, formerly Resilient, licensed per authorized user and deployed on premises as a virtual machine or on OpenShift. Pages here cover replacing it with self-hosted Shuffle or Tracecat.
Comparing IBM QRadar SOAR with self-hosted Shuffle: Playbook Designer against Shuffle workflows, IBM's integration framework against Shuffle apps, case management, per-user licensing against Shuffle's AGPLv3 and MIT split, and the operating effort of each on your own infrastructure.
IBM QRadar SOAR against Tracecat for SOCs that use SOAR mainly as a case system with automation: incident cases and tasks, playbooks and AI agents, deployment on VMs, OpenShift or Kubernetes, and which Tracecat features need its paid edition.
Moving from IBM QRadar SOAR to Shuffle: inventorying playbooks, functions and app integrations, rebuilding automation as Shuffle workflows, deciding where incident records and tasks will live, and cutting over alert sources from QRadar SIEM or other tools.
Moving IBM QRadar SOAR incidents, tasks and playbooks to Tracecat: mapping incident types and fields to Tracecat cases, rewriting Python functions as custom actions, rebuilding playbooks as workflows, and keeping closed cases available for audits.
Cost of ownership by component: QRadar SOAR licenses per Authorized User with annual Subscription and Support, plus the VM or OpenShift platform it runs on, against Shuffle's open-source edition, servers, migration work and the people who maintain workflows.
IBM supports each on-premises QRadar SOAR version for at least twelve months from general availability, so virtual appliance and stand-alone sites upgrade regularly. This page weighs that upgrade cycle and its OpenShift option against moving playbooks to a self-hosted open-source platform.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.