Torq AI SOC Platform

We are primarily using Torq for phishing alert handling, which means we are getting the alert data from Splunk and then using that data to pull back the phishing emails and their attachments, detonate those in various sandboxes, and then collate all that data up into an incident for the security team. We have a couple of workflows in that vein. We handle phishing, malware detections, and AI use cases in a similar manner, and we are also doing a lot of data syncs between our various vulnerability platforms. We are using Torq for that, and eventually we will be using it for case management, but that is currently in the works.

Regarding Torq's Identity AI, we have not really gotten to use it a whole lot because of the nature of the transition project that we are currently working on, so I do not have a lot to say about it.

We are actually using Torq to automate triage, investigation, and remediation actions across multiple attack surfaces like endpoint, identity, cloud, and IT right now. Outside of the piecemeal automations we have, which encompass all three of those different security domains, the new case management workflow ecosystem we are building out is exactly that.

Torq has changed the day-to-day experience for my security analysts and me by saving literally thousands of man-hours per month since we have implemented some of these use cases. The analysts now have a lot more free time to do their work.

My favorite thing about Torq thus far is the ease of use. Once you get over the initial learning curve, which for me was not that bad, it is a very simple platform with a lot of drag and drop tools. It is flexible enough that I could use Python if I needed to, and logically, it is a clean editor that makes a lot of sense for me and is just simple and intuitive.

What I dislike about it is that because my background is primarily in Python, the platform itself can run on Python scripts, and when those fail, it is really easy for me to figure out what is going on. The underlying code being run by the platform for all of the built-in parts of the built-in automations that you can create uses Go, which is a different programming language, and the way it displays errors within the platform when something goes wrong is not as intuitive for me to debug or do a traceback on. That would be the biggest issue I have with it. Sometimes when it spits out an error, it is either because I am not familiar with Go or the platform itself just is not giving me enough to usually go off of.

The comparison of Torq's unified platform approach to SOC automation and case management to any other experiences managing multiple point solutions across the stack is a loaded one. The automation side is really great. However, the case management piece, due to the platform being an automation-first tool, lacks real robust out-of-the-box case templates or good solutions for creating those without spending a lot of time doing development work, which makes the overall experience poor, honestly. In a previous life, I managed Phantom, Phantom SOAR, Splunk SOAR, whatever you want to call it, and another tool called IBM Resilient, which was our external ticketing system. That tool itself had pre-made case templates you could use. Out-of-the-box, you could get the integration going between the two platforms, and it was relatively simple. With Torq, you have to build everything from scratch, and I wish it had a little bit more of a case management feature that was a bit more developed.

I have been working with it for just over a year now, since we did our demo with them and got access.

I have not really noticed any issues with stability. The UI can be a little laggy at times, but I do not think that is really the platform. I think it might just be the implementation at my company. We have never had an outage, so I can at least say we have not had that happen. Any lag I think is usually client-side, not server-side.

Torq seems to be very scalable. There are some limitations with the platform in terms of how many workflows you can run. There is only so many that you are allowed to run in the system before pricing starts becoming an issue, and that can be a little frustrating, but the actual platform itself seems to scale very well.

I have contacted their technical support, and that is usually what I am doing when I am reporting bugs.

If I were to put them on a scale from one to ten, I would give them a ten. They are fantastic.

The quality and speed of the support from Torq are very much on top of their game. You put in a ticket, and you usually hear something back within an hour. If it is a big bug, we have got dedicated resources from Torq that we can reach out to directly. Even if it is something as simple as asking how to do something in an automation and it is just not working, they will usually get back to me about that. They are very attentive and very much on top of making sure we have all the resources that we need to do what we need to do.

I have used Splunk SOAR as an alternative that I can compare Torq to.

Comparing Torq and Splunk SOAR is tough because it is not exactly an apples-to-apples comparison. Overall, I would still say I probably prefer Torq. There are things I like more about Splunk SOAR, like that it is entirely Python-based, so I feel a lot more comfortable writing custom code in there. However, the way that it handles certain data objects requires designing from a different angle in both tools, and I feel like Torq's angle is a little more intuitive.

Addressing the specific challenges to our SOC that led us to consider changes before implementing Torq is an odd situation because I was not very involved in that decision. I am just dedicated to development work on this platform, but I do not work for the SOC. They are more or less my customer in a way. I think the primary driver was budgetary concerns, as well as issues with ServiceNow. We have a ServiceNow team managing a lot of this, and our SOC wanted more flexibility and a little bit more control over when they could make changes to their case management or their automations. I am pretty sure that was the main driver—putting some of that ownership back into our security teams, with me being their primary technical resource for it.

The initial deployment was super easy. Because Torq is a SaaS solution, there is not a lot that goes into it. They basically spin it up for you and then hand you the keys, essentially. That portion of it was like maybe a day, and there were some internal activities that had to happen for setting up things like SSO on our side. That was not difficult. It is just a big corporation, so it takes time to get all the different teams to do what they need to do.

I saw the benefits of Torq almost immediately after we deployed it because we transitioned our already existing SOAR workflows from Phantom. Pretty much anything that was running in Phantom is now running in Torq as of day one, so it was immediate savings.

I would not be the right person to ask about my opinion on the pricing. That would be my manager.

Torq's abilities compared to other tools I have looked at are similar in that they all do a lot of the same things. I would say all SOAR platforms are kind of the same, at least in essence, in what they are trying to achieve. What differentiates them really is ease of use, and I would say Torq is probably the easiest one that I have gotten to use so far.

In my current field overall, I have been working in SOAR automation and software development specifically for roughly six years.

I have never really done any maintenance myself. That is all being taken care of by the Torq developers. The only thing I have really helped out with in that regard is bug fix type things where I catch an actual platform bug and then report it.

I do not know what measurable security outcomes matter most to our leadership team. I do not really talk to management all that much. I code for them and let them worry about the KPIs and other matters.

Overall, I would give Torq a score of nine out of ten. I think it is fantastic. There are some headaches that come with the platform, and the case management part does have issues, but as a SOAR platform, I think it is fantastic. I give Torq a rating of nine out of ten.