Torq AI SOC Platform

We are primarily using Torq for phishing alert handling, which means we are getting the alert data from Splunk and then using that data to pull back the phishing emails and their attachments, detonate those in various sandboxes, and then collate all that data up into an incident for the security team. We have a couple of workflows in that vein. We handle phishing, malware detections, and AI use cases in a similar manner, and we are also doing a lot of data syncs between our various vulnerability platforms. We are using Torq for that, and eventually we will be using it for case management, but that is currently in the works.

Regarding Torq's Identity AI, we have not really gotten to use it a whole lot because of the nature of the transition project that we are currently working on, so I do not have a lot to say about it.

We are actually using Torq to automate triage, investigation, and remediation actions across multiple attack surfaces like endpoint, identity, cloud, and IT right now. Outside of the piecemeal automations we have, which encompass all three of those different security domains, the new case management workflow ecosystem we are building out is exactly that.

Torq has changed the day-to-day experience for my security analysts and me by saving literally thousands of man-hours per month since we have implemented some of these use cases. The analysts now have a lot more free time to do their work.

My favorite thing about Torq thus far is the ease of use. Once you get over the initial learning curve, which for me was not that bad, it is a very simple platform with a lot of drag and drop tools. It is flexible enough that I could use Python if I needed to, and logically, it is a clean editor that makes a lot of sense for me and is just simple and intuitive.

What I dislike about it is that because my background is primarily in Python, the platform itself can run on Python scripts, and when those fail, it is really easy for me to figure out what is going on. The underlying code being run by the platform for all of the built-in parts of the built-in automations that you can create uses Go, which is a different programming language, and the way it displays errors within the platform when something goes wrong is not as intuitive for me to debug or do a traceback on. That would be the biggest issue I have with it. Sometimes when it spits out an error, it is either because I am not familiar with Go or the platform itself just is not giving me enough to usually go off of.

The comparison of Torq's unified platform approach to SOC automation and case management to any other experiences managing multiple point solutions across the stack is a loaded one. The automation side is really great. However, the case management piece, due to the platform being an automation-first tool, lacks real robust out-of-the-box case templates or good solutions for creating those without spending a lot of time doing development work, which makes the overall experience poor, honestly. In a previous life, I managed Phantom, Phantom SOAR, Splunk SOAR, whatever you want to call it, and another tool called IBM Resilient, which was our external ticketing system. That tool itself had pre-made case templates you could use. Out-of-the-box, you could get the integration going between the two platforms, and it was relatively simple. With Torq, you have to build everything from scratch, and I wish it had a little bit more of a case management feature that was a bit more developed.

I have been working with it for just over a year now, since we did our demo with them and got access.

I have not really noticed any issues with stability. The UI can be a little laggy at times, but I do not think that is really the platform. I think it might just be the implementation at Marriott. We have never had an outage, so I can at least say we have not had that happen. Any lag I think is usually client-side, not server-side.

Torq seems to be very scalable. There are some limitations with the platform in terms of how many workflows you can run. There is only so many that you are allowed to run in the system before pricing starts becoming an issue, and that can be a little frustrating, but the actual platform itself seems to scale very well.

I have contacted their technical support, and that is usually what I am doing when I am reporting bugs.

If I were to put them on a scale from one to ten, I would give them a ten. They are fantastic.

The quality and speed of the support from Torq are very much on top of their game. You put in a ticket, and you usually hear something back within an hour. If it is a big bug, we have got dedicated resources from Torq that we can reach out to directly. Even if it is something as simple as asking how to do something in an automation and it is just not working, they will usually get back to me about that. They are very attentive and very much on top of making sure we have all the resources that we need to do what we need to do.

I have used Splunk SOAR as an alternative that I can compare Torq to.

Comparing Torq and Splunk SOAR is tough because it is not exactly an apples-to-apples comparison. Overall, I would still say I probably prefer Torq. There are things I like more about Splunk SOAR, like that it is entirely Python-based, so I feel a lot more comfortable writing custom code in there. However, the way that it handles certain data objects requires designing from a different angle in both tools, and I feel like Torq's angle is a little more intuitive.

Addressing the specific challenges to our SOC that led us to consider changes before implementing Torq is an odd situation because I was not very involved in that decision. I am just dedicated to development work on this platform, but I do not work for the SOC. They are more or less my customer in a way. I think the primary driver was budgetary concerns, as well as issues with ServiceNow. We have a ServiceNow team managing a lot of this, and our SOC wanted more flexibility and a little bit more control over when they could make changes to their case management or their automations. I am pretty sure that was the main driver—putting some of that ownership back into our security teams, with me being their primary technical resource for it.

The initial deployment was super easy. Because Torq is a SaaS solution, there is not a lot that goes into it. They basically spin it up for you and then hand you the keys, essentially. That portion of it was like maybe a day, and there were some internal activities that had to happen for setting up things like SSO on our side. That was not difficult. It is just a big corporation, so it takes time to get all the different teams to do what they need to do.

I saw the benefits of Torq almost immediately after we deployed it because we transitioned our already existing SOAR workflows from Phantom. Pretty much anything that was running in Phantom is now running in Torq as of day one, so it was immediate savings.

I would not be the right person to ask about my opinion on the pricing. That would be my manager.

Torq's abilities compared to other tools I have looked at are similar in that they all do a lot of the same things. I would say all SOAR platforms are kind of the same, at least in essence, in what they are trying to achieve. What differentiates them really is ease of use, and I would say Torq is probably the easiest one that I have gotten to use so far.

In my current field overall, I have been working in SOAR automation and software development specifically for roughly six years.

I have never really done any maintenance myself. That is all being taken care of by the Torq developers. The only thing I have really helped out with in that regard is bug fix type things where I catch an actual platform bug and then report it.

I do not know what measurable security outcomes matter most to our leadership team. I do not really talk to management all that much. I code for them and let them worry about the KPIs and other matters.

Overall, I would give Torq a score of nine out of ten. I think it is fantastic. There are some headaches that come with the platform, and the case management part does have issues, but as a SOAR platform, I think it is fantastic. I give Torq a rating of nine out of ten.

My main use case for Torq is the automation of cyber security processes through a SOAR platform and APIs.

A main example of how I use Torq for automation would be a classic one: opening of a security incident in an ITSM, bidirectional synchronization, enrichment, and auto-remediation based on closure of the incident. Everything is automated.

I use Torq for automation of triage, investigation, and remediation actions across multiple attack surfaces such as endpoint, identity, cloud, or IT. It automates the investigation with enrichment such as logs. I do not dive deeper into remediation actions, but they are present, and it automates triage, for example, for phishing incidents. It helps tremendously to have those kinds of data. Its abilities compared to other tools were evaluated through an RFP where we compared multiple tools, and Torq was literally the one, the outsider that stood out, and we chose it. As a technical team, we chose Torq compared to the one that we were using before. We did not start from scratch, as we already had a baseline, and we were searching for a tool that would bring something new to the table with the already existing technical tools that we had, but would bring new innovation and new capabilities. That was the objective, and Torq answered that.

One of the best features of Torq, I would highlight two main ones. The first one is the capability of transforming an action that you develop yourself, such as an HTTP request that you develop yourself, and make it available as a custom action to all of the other members of the team that you have, which in a sense increases the scalability of the tool and lets the tool be available for people that don't really know the specifics of APIs, HTTP requests, and just know how to click and drop some actions and want to do their small playbooks. Torq is, in a sense, a tool that is ever-evolving based on the usage that you do with it.

The second one is the look and feel is quite good, and it would be all the AI initiatives that are inside the tool. I can feel that Torq and the company that is behind it are pushing forward what SOAR is, not letting it stale in its current state, and they're pushing it further to make SOAR a new tool in itself by leveraging AI, making it the center of what a SOC is and what incident response is.

The custom action feature in Torq has helped my team tremendously. For example, SharePoint HTTP requests were quite difficult in one of our scenarios. You only have to do the job once of scraping the documentation, understanding how it works, developing the HTTP request by yourself, and then you can save them, put a meaningful description, and add some dynamic fields that the next person that will use that will find much easier than understanding how the logic is and how the documentation is. For the SharePoint example, it has helped tremendously to deliver automation quickly around SharePoint, CSV file upload, and other related tasks.

Torq has impacted my organization positively by allowing us to earn time and invest resources in other projects that are more meaningful and more interesting, pushing deeper into what a SOC is, and building our processes. Torq is a good way to reinvest time in something more interesting, whether for the humans, for the analysts, or for the company in a more secure way. This is what automation brings: interesting subject matter, new capabilities, and more time, fundamentally.

It is quite difficult to quantify, but a good example would be a playbook that is automatically analyzing a phishing incident developed with Torq. It frees up approximately 200 or 250 incidents per week or per month. You take one incident, which took about five minutes to ten minutes, and multiply that across all incidents. The human cost is also significant, such as the fatigue of doing always the same incident, always the same things. This is not easily measurable, but I think it is important to highlight that as it may sometimes be the best resource, the best gain that Torq can bring to the table.

There are some bugs in Torq, of course. They can be present in data transformation, some UI debugging, and other areas that can be improved. There are some ideas, and Torq always takes them into consideration. Unfortunately, they are currently focused too much on AI and how the tool is evolving. I can understand because this is how they can keep their head above the water and ahead of all the other tools. This is how they can be this disruptive and interesting for companies. However, it is also important to have some good bases, some solid baselines. There are some issues and bugs that I think need to be fixed, but they are currently not focused on it. The tool is working overall. It is doing what we need. No tool can be perfect, and there is room for improvement, but Torq is already quite far advanced compared to others in the market.

One of the things that I think would be the most interesting for Torq is the ability, when you are debugging, when you have a crash in a playbook, to rerun the playbook from the step that has crashed. This is not implemented, and it is painful to relaunch a playbook manually and do everything when you have actions inside a playbook that have impact. For example, if you reset the token of a user and then the playbook crashes, and it was supposed to send a notification in Teams or add the user to a specific table, just to have the information, you want to have this information, but you don't want to relaunch the whole playbook because it will reset the token of the user again. This is an example where it is quite important, but the feature is lacking.

I have been using Torq for approximately one year to a year and a half.

Torq is stable.

The scalability of Torq is quite good. The customer support is quite responsive and helpful. Most cases are handled in less than a week.

I would rate the customer support a four. They are present and help a lot.

I previously used Logic App from Microsoft. The two main pain points were the number of connectors available with built-in actions. We needed to redevelop every HTTP request every time that we started to create a new playbook. Scalability was not present in that case. Additionally, the tool was quite stale. It did not move a lot in the last year. It has started to move a bit now, but when we were doing the RFP and thinking of changing, we wanted a tool that has a roadmap, innovation, and people that were working on it.

Pricing is pretty straightforward and adaptable based on what you need and what you want to use. The pricing is based on the number of playbooks that you have, which makes it interesting based on how you design your SOC's architecture and makes you spend more time on how you want to design your automation SOCs.

Regarding someone thinking about using Torq, I recommend looking into their provided academy to start working with the tool and understand how JQ works, how the sprig function works, and not diving directly into automation without being sure that your processes and what you want to automate have already been tested out and are a good return on investment for the time that your SOAR team will spend on it. I would rate this review as an 8 out of 10.