Torq AI SOC Platform

My main use case for Torq is reviewing the incidents and responding to them. After that, I investigate them and take appropriate actions.

For example, a user has logged in from a blacklisted country and it triggers an alert. I investigate the alert and contact the user through Torq.

Another use case is when an IP from my client side has tried to connect to an external IP which is malicious. It may also trigger an alert, and if at the firewall it's not blocked, the action is not blocked. So that may trigger an alert and I will have to do further investigation and complete the required action.

Torq offers the best feature through integration with AI. I can use AI alongside Torq.

AI helps me add work notes, resolve notes, and also assists in the investigation and checking of IPs, IP reputation, and more. AI helps me accomplish all of these things.

Torq has minimized the alert fatigue and also reduced the time I need to work on the alerts. Runbooks are present for each use case that helps eliminate other tasks such as going through all of the alerts manually.

The automation Torq provided for some use cases removed the false positives, which saved me time. The number of alerts is reduced after fine-tuning the false positives.

Torq has changed my approach in many ways. It reduced the manual tasks and also helped me in resolving high volume alerts. I also work on the malware alerts more efficiently through Torq.

Torq's ability to solve an operational security issue is commendable. It meets all the compliances and also helps me resolve threats. I also use runbooks to contain malware.

Torq can be improved by adding some more features, such as adding more automation and providing a no-code option so I don't have to code for everything.

Torq could add API dependency and also on-premise connectivity. If on-premise connectivity is available, organizations wanting to work on Torq could implement it that way.

I have been using Torq for three months now.

Torq is very stable.

Regarding the scalability of Torq, I need to consider the elasticity as well. Its scalability is good because it has a cloud-native architecture and it expands dynamically to handle thousands of alerts at the same time.

I haven't had any issues using Torq so far, so I haven't contacted customer support. That is why I cannot comment on that.

I used Splunk and I wanted to work on a different tool with more enhanced features. That is why I switched to Torq.

The standardized processes helped me guarantee identical incident response every time.

Torq fortified my workflows and secured my cloud infrastructure.

I am the end user. I don't have knowledge about pricing, setup cost, or licensing.

I also evaluated Azure Sentinel and QRadar. Those are the two options I evaluated before choosing Torq.

I would definitely recommend others to use Torq as it is an all-rounder tool which even integrates AI. As we all know, it is the era of AI users, so we have to integrate AI into every tool. Torq is best suited for all the SOC analysts.

Torq is a very scalable, elastic tool and also throttles integration of the tools, drops events, and creates message processing backlogs. It also shares back-end resources, so it is a good tool overall. I give Torq a rating of eight out of ten.

My main use case for Torq is to automate security incidents. By using Socrates CI, I am able to automate the investigation steps with the runbook and integrate other devices to forward their logs, customizing recording coordinates and parsing with jq.

A recent scenario where I used Torq involved integrating Elasticsearch with Torq to forward the entire log from Elasticsearch to Torq, where I wrote a runbook for the investigation. For example, there is an RDP to the internet use case requiring ten to fifteen steps to investigate the incident. With Torq and Socrates, I automate everything to reach the final outcome.

I have used Torq to automate triage, investigations, and remediation actions across multiple attack surfaces. It performs better than other tools because of its extensive integration capabilities and customizable features, allowing me to tailor responses according to my needs.

I primarily utilize Torq for investigation and alert automation, and I do not have any other business relationships with the vendor.

I find Torq very helpful from an automation point of view, with customizable suite features that allow me to customize according to my needs. Initially, developing workflows was complex due to the numerous customization options available, but with Torq's support, I can successfully do that. I also utilize the available templates in Torq as a guideline for developing workflows based on these templates.

Torq offers features like the shocker rates, allowing me to give prompts to the procreate, which investigates each alert according to my defined handbook—a feature I really appreciate. Additionally, I can integrate any third-party tool to Torq using the webhook connector and Torq's default connectors, which is another excellent feature I appreciate.

The Socrates feature is a basic AI model that I develop according to my needs and offer some context in the Socrates tool. I write runbooks and provide prompts to automate the investigation steps using Socrates, which connects every tool and software to enrich the data I need. This feature significantly aids my daily activities, especially since it automates many tasks previously performed by manual analysts. Currently, I am using the WayBook connector and Torq's default connector to integrate third-party tools with Torq, along with various tools like Elasticsearch.

I appreciate Torq's GUI interface, which is easy for every analyst to understand. Additionally, the dashboard features enable monitoring spikes, device integrations, and device statuses according to my needs, allowing me to develop comprehensive visualizations for alerts. Recently introduced migration features in the GUI add value by showing connected tools to my endpoints and assisting my investigation processes, which I find beneficial.

To improve Torq, I suggest that known alerts and attacks in the market should lead to developed use cases and workflows. Implementing these would help map known traits automatically when integrating third-party tools and require minimal credential configurations. Having examples of steps to investigate specific alerts would assist in developing other cases effectively.

Torq provides comprehensive support, and I find their documentation useful for addressing challenges in my workflows. Walking through the documentation available on Torq's website gives me clarity on solving issues. If Torq could enhance its AI features, it would benefit customers significantly by making the platform even more user-friendly.

I have been using Torq for the last one to two years.

Torq is stable and functions reliably within my operations.

Torq's scalability is highly effective, allowing me to customize features according to my specific requirements.

Torq provides comprehensive support, and I find their documentation useful for addressing challenges in my workflows. Walking through the documentation available on Torq's website gives me clarity on solving issues. If Torq could enhance its AI features, it would benefit customers significantly by making the platform even more user-friendly.

Customer support is very good, available twenty-four seven, offering quick resolutions through group chats or calls.

My experience managing various point solutions was complicated compared to using Torq's unified platform approach for AI SOC automation and case management.

Before Torq, using separate security platforms posed challenges in enabling log forwarding and investigating alerts efficiently with manual documentation. With Torq, I automate actions while achieving SLA compliance and streamline alert investigation processes much better.

I started realizing value with Torq right away; the benefits became apparent immediately as I transitioned to automation.

I have seen a return on investment with Torq, as the automation reduces the number of employees needed and significantly saves both time and resources.

I did not evaluate other options before choosing Torq, as my focus remains on employing Torq as my solution.

I would rate Torq a perfect ten on a scale of one to ten.

I chose ten because Torq meets all my expectations, providing support for any challenges I face during workflow, integration, and runbook development. They also have comprehensive documentation for knowledge sharing, along with Torq Academy, which offers multiple certifications to help users understand how Torq features work, especially the SOC analyst certification for beginners.

While comparing various AI outputs, I find that accuracy is not always one hundred percent, but it reaches about eighty percent with precise prompts. Accuracy depends significantly on the clarity of prompts given to Torq's AI, with good prompts yielding better responses.

The effect of using Torq's Agentic AI on stress levels and focus is positive, as it automates procedures, allowing staff to follow predefined protocols without additional manual effort.

Metrics that matter most to my leadership team include investigating every alert and resolving issues as per defined parameters. Automation from Torq helps us show real SOC impact through efficient handling and timely responses.

Before using Torq, I relied on manual investigation steps detailed in my playbook for alerts. Now, with Torq, I automate procedures through a defined software model, allowing runbooks to handle alerts effectively. When an alert is triggered in Elasticsearch, it forwards to Torq, which follows the runbooks I have set up for each alert. If additional actions are required, it sends alerts and notifications, categorizing legitimate alerts and closing them automatically at both Torq and Elasticsearch levels.

I can monitor alert severity and manage how many alerts I have based on this metric, which is a positive impact since investigating alerts efficiently was challenging during manual processes. I can now see how many alerts are pending and their severity levels, contributing to meeting my SLA and TRA requirements.

Torq significantly changes day-to-day experiences for security analysts by automating alert handling and reducing overall workload, thus improving job satisfaction and operational efficiency.

Torq's Agentic AI significantly increases the alert handling capacity for my SecOps staff, streamlining their responsibilities and ensuring they manage alerts effectively. I would rate this product ten out of ten.

For Torq, first of all, it's a hyperautomation and AI assistant usage. Our EDR SentinelOne is integrated in Torq and besides the vendor itself having hyperautomation abilities, Torq helps me to analyze incidents and to respond to incidents more quickly and more efficiently.

Torq's AI SOC automation case management is much faster and more efficient compared to the manual tools I have used before. Torq is an ideal assistant for AI SOC in automation challenges.

Torq changed the day-to-day experience for my security analysts. They are more confident and can test more approaches in the security operation center every day as workflows and routine.

I rely on Torq's AI assistant in most of my incident response and in building right and less complex workflows for automation.

Torq helped me also in some infrastructure and ticketing challenges, for example, to organize the ticketing system in our company, but I am still in a process of learning about Torq and realizing different scenarios using Torq.

The most valuable feature of Torq is hyperautomation and AI assistant because the quality of speed and recommendation from the AI assistant is really high. Another outstanding feature is that you don't need to write code. There is a library of prepared scripts or JSON scripts which can be right and adapted. You can face quite complex challenges without a programming background and can successfully solve these issues and challenges.

Torq's no-code library helps me to be more efficient and respond to incidents more flexibly. The support of the AI assistant makes my actions more efficient and quicker.

The only thing is more out-of-the-box integrations. Torq already has a lot of supported integrations and adding new ones is not difficult, but for some customers, it's easier to have a plug and play interface to start onboarding.

We didn't evaluate other options because we tested Torq and we liked it.

At this stage, I have no additional suggestions. I will update my review several months later and maybe then I will have some suggestions to prove and to what in addition I would like to see in the solution.

I can't evaluate Torq's agentic AI, but I think in my next review, I can provide more information.

I have been using Torq for the last six months.

I haven't experienced any downtime or technical issues while running the platform.

Torq can handle growth and increase easily without any downtime or lack of service.

Customer support is responsive and helpful, but most of my questions were more how-to questions.

I used online SIEMs with integrated SOARs, not online but on-premises, and we switched because it was too slow and too inefficient to use.

From my point of view, Torq has excellent documentation and a support portal. You can find literally everything on the support portal. There are visual manuals and quite simple instructions for onboarding and for every use case you can imagine in your infrastructure.

My advice would be to test Torq in your environment, ask as many questions as possible during POC and refer to documentation in cases you feel not confident about your new solution.

At this stage, we are just customers of Torq.

Regarding Torq's pricing and license costs, as long as our existing team started to work more efficiently and quicker, I think we have quite a return of investment and we suppose to add more security management center tools. The return of investment is also the money we saved not adding another security tool. For me and for our security stack, it's about 30% return on investment.

Torq is a standalone solution from Torq providers.

We didn't evaluate other options because we tested Torq and we liked it.

I think I have told everything about Torq that I can share at this stage, but I am still in the process of learning the platform and I still think that there are many more features which can be adapted and can be used inside the company.

According to positive outcomes, Torq reduced manual work and made incident response more efficient. From Torq workflows, I learn much more about my company ecosystem. This also reflects on the defensive side of the company. I see the gaps that I had according to incidents and I can fix and address the gaps relying on knowledge I get from automation results.

I think the speed of work increased minimum by 50%, but I think with more automation and more optimization, we can make this result much better.

The easiness of integration, good quality of support and good quality of documentation make this product easy to work with. From what I see, the vendor itself is oriented on improvement, which means that they will not stop at the level they reached by now.

I am quite confident in Torq because I have checked, for example, compliance to ISO 27001 and this is the most relevant standard here in Georgia. I trust in Torq and I trust in the security compliance the platform provides.

Torq's AI recommendations are consistently helpful. There was no case when the system provided me with a false recommendation or inaccurate response.

Alert fatigue is something I would like Torq to help me address.

My overall rating for this review is 10.