Torq AI SOC Platform

We are primarily using Torq for phishing alert handling, which means we are getting the alert data from Splunk and then using that data to pull back the phishing emails and their attachments, detonate those in various sandboxes, and then collate all that data up into an incident for the security team. We have a couple of workflows in that vein. We handle phishing, malware detections, and AI use cases in a similar manner, and we are also doing a lot of data syncs between our various vulnerability platforms. We are using Torq for that, and eventually we will be using it for case management, but that is currently in the works.

Regarding Torq's Identity AI, we have not really gotten to use it a whole lot because of the nature of the transition project that we are currently working on, so I do not have a lot to say about it.

We are actually using Torq to automate triage, investigation, and remediation actions across multiple attack surfaces like endpoint, identity, cloud, and IT right now. Outside of the piecemeal automations we have, which encompass all three of those different security domains, the new case management workflow ecosystem we are building out is exactly that.

Torq has changed the day-to-day experience for my security analysts and me by saving literally thousands of man-hours per month since we have implemented some of these use cases. The analysts now have a lot more free time to do their work.

My favorite thing about Torq thus far is the ease of use. Once you get over the initial learning curve, which for me was not that bad, it is a very simple platform with a lot of drag and drop tools. It is flexible enough that I could use Python if I needed to, and logically, it is a clean editor that makes a lot of sense for me and is just simple and intuitive.

What I dislike about it is that because my background is primarily in Python, the platform itself can run on Python scripts, and when those fail, it is really easy for me to figure out what is going on. The underlying code being run by the platform for all of the built-in parts of the built-in automations that you can create uses Go, which is a different programming language, and the way it displays errors within the platform when something goes wrong is not as intuitive for me to debug or do a traceback on. That would be the biggest issue I have with it. Sometimes when it spits out an error, it is either because I am not familiar with Go or the platform itself just is not giving me enough to usually go off of.

The comparison of Torq's unified platform approach to SOC automation and case management to any other experiences managing multiple point solutions across the stack is a loaded one. The automation side is really great. However, the case management piece, due to the platform being an automation-first tool, lacks real robust out-of-the-box case templates or good solutions for creating those without spending a lot of time doing development work, which makes the overall experience poor, honestly. In a previous life, I managed Phantom, Phantom SOAR, Splunk SOAR, whatever you want to call it, and another tool called IBM Resilient, which was our external ticketing system. That tool itself had pre-made case templates you could use. Out-of-the-box, you could get the integration going between the two platforms, and it was relatively simple. With Torq, you have to build everything from scratch, and I wish it had a little bit more of a case management feature that was a bit more developed.

I have been working with it for just over a year now, since we did our demo with them and got access.

I have not really noticed any issues with stability. The UI can be a little laggy at times, but I do not think that is really the platform. I think it might just be the implementation at Marriott. We have never had an outage, so I can at least say we have not had that happen. Any lag I think is usually client-side, not server-side.

Torq seems to be very scalable. There are some limitations with the platform in terms of how many workflows you can run. There is only so many that you are allowed to run in the system before pricing starts becoming an issue, and that can be a little frustrating, but the actual platform itself seems to scale very well.

I have contacted their technical support, and that is usually what I am doing when I am reporting bugs.

If I were to put them on a scale from one to ten, I would give them a ten. They are fantastic.

The quality and speed of the support from Torq are very much on top of their game. You put in a ticket, and you usually hear something back within an hour. If it is a big bug, we have got dedicated resources from Torq that we can reach out to directly. Even if it is something as simple as asking how to do something in an automation and it is just not working, they will usually get back to me about that. They are very attentive and very much on top of making sure we have all the resources that we need to do what we need to do.

I have used Splunk SOAR as an alternative that I can compare Torq to.

Comparing Torq and Splunk SOAR is tough because it is not exactly an apples-to-apples comparison. Overall, I would still say I probably prefer Torq. There are things I like more about Splunk SOAR, like that it is entirely Python-based, so I feel a lot more comfortable writing custom code in there. However, the way that it handles certain data objects requires designing from a different angle in both tools, and I feel like Torq's angle is a little more intuitive.

Addressing the specific challenges to our SOC that led us to consider changes before implementing Torq is an odd situation because I was not very involved in that decision. I am just dedicated to development work on this platform, but I do not work for the SOC. They are more or less my customer in a way. I think the primary driver was budgetary concerns, as well as issues with ServiceNow. We have a ServiceNow team managing a lot of this, and our SOC wanted more flexibility and a little bit more control over when they could make changes to their case management or their automations. I am pretty sure that was the main driver—putting some of that ownership back into our security teams, with me being their primary technical resource for it.

The initial deployment was super easy. Because Torq is a SaaS solution, there is not a lot that goes into it. They basically spin it up for you and then hand you the keys, essentially. That portion of it was like maybe a day, and there were some internal activities that had to happen for setting up things like SSO on our side. That was not difficult. It is just a big corporation, so it takes time to get all the different teams to do what they need to do.

I saw the benefits of Torq almost immediately after we deployed it because we transitioned our already existing SOAR workflows from Phantom. Pretty much anything that was running in Phantom is now running in Torq as of day one, so it was immediate savings.

I would not be the right person to ask about my opinion on the pricing. That would be my manager.

Torq's abilities compared to other tools I have looked at are similar in that they all do a lot of the same things. I would say all SOAR platforms are kind of the same, at least in essence, in what they are trying to achieve. What differentiates them really is ease of use, and I would say Torq is probably the easiest one that I have gotten to use so far.

In my current field overall, I have been working in SOAR automation and software development specifically for roughly six years.

I have never really done any maintenance myself. That is all being taken care of by the Torq developers. The only thing I have really helped out with in that regard is bug fix type things where I catch an actual platform bug and then report it.

I do not know what measurable security outcomes matter most to our leadership team. I do not really talk to management all that much. I code for them and let them worry about the KPIs and other matters.

Overall, I would give Torq a score of nine out of ten. I think it is fantastic. There are some headaches that come with the platform, and the case management part does have issues, but as a SOAR platform, I think it is fantastic. I give Torq a rating of nine out of ten.

My main use case for Torq is the automation of cyber security processes through a SOAR platform and APIs.

A main example of how I use Torq for automation would be a classic one: opening of a security incident in an ITSM, bidirectional synchronization, enrichment, and auto-remediation based on closure of the incident. Everything is automated.

I use Torq for automation of triage, investigation, and remediation actions across multiple attack surfaces such as endpoint, identity, cloud, or IT. It automates the investigation with enrichment such as logs. I do not dive deeper into remediation actions, but they are present, and it automates triage, for example, for phishing incidents. It helps tremendously to have those kinds of data. Its abilities compared to other tools were evaluated through an RFP where we compared multiple tools, and Torq was literally the one, the outsider that stood out, and we chose it. As a technical team, we chose Torq compared to the one that we were using before. We did not start from scratch, as we already had a baseline, and we were searching for a tool that would bring something new to the table with the already existing technical tools that we had, but would bring new innovation and new capabilities. That was the objective, and Torq answered that.

One of the best features of Torq, I would highlight two main ones. The first one is the capability of transforming an action that you develop yourself, such as an HTTP request that you develop yourself, and make it available as a custom action to all of the other members of the team that you have, which in a sense increases the scalability of the tool and lets the tool be available for people that don't really know the specifics of APIs, HTTP requests, and just know how to click and drop some actions and want to do their small playbooks. Torq is, in a sense, a tool that is ever-evolving based on the usage that you do with it.

The second one is the look and feel is quite good, and it would be all the AI initiatives that are inside the tool. I can feel that Torq and the company that is behind it are pushing forward what SOAR is, not letting it stale in its current state, and they're pushing it further to make SOAR a new tool in itself by leveraging AI, making it the center of what a SOC is and what incident response is.

The custom action feature in Torq has helped my team tremendously. For example, SharePoint HTTP requests were quite difficult in one of our scenarios. You only have to do the job once of scraping the documentation, understanding how it works, developing the HTTP request by yourself, and then you can save them, put a meaningful description, and add some dynamic fields that the next person that will use that will find much easier than understanding how the logic is and how the documentation is. For the SharePoint example, it has helped tremendously to deliver automation quickly around SharePoint, CSV file upload, and other related tasks.

Torq has impacted my organization positively by allowing us to earn time and invest resources in other projects that are more meaningful and more interesting, pushing deeper into what a SOC is, and building our processes. Torq is a good way to reinvest time in something more interesting, whether for the humans, for the analysts, or for the company in a more secure way. This is what automation brings: interesting subject matter, new capabilities, and more time, fundamentally.

It is quite difficult to quantify, but a good example would be a playbook that is automatically analyzing a phishing incident developed with Torq. It frees up approximately 200 or 250 incidents per week or per month. You take one incident, which took about five minutes to ten minutes, and multiply that across all incidents. The human cost is also significant, such as the fatigue of doing always the same incident, always the same things. This is not easily measurable, but I think it is important to highlight that as it may sometimes be the best resource, the best gain that Torq can bring to the table.

There are some bugs in Torq, of course. They can be present in data transformation, some UI debugging, and other areas that can be improved. There are some ideas, and Torq always takes them into consideration. Unfortunately, they are currently focused too much on AI and how the tool is evolving. I can understand because this is how they can keep their head above the water and ahead of all the other tools. This is how they can be this disruptive and interesting for companies. However, it is also important to have some good bases, some solid baselines. There are some issues and bugs that I think need to be fixed, but they are currently not focused on it. The tool is working overall. It is doing what we need. No tool can be perfect, and there is room for improvement, but Torq is already quite far advanced compared to others in the market.

One of the things that I think would be the most interesting for Torq is the ability, when you are debugging, when you have a crash in a playbook, to rerun the playbook from the step that has crashed. This is not implemented, and it is painful to relaunch a playbook manually and do everything when you have actions inside a playbook that have impact. For example, if you reset the token of a user and then the playbook crashes, and it was supposed to send a notification in Teams or add the user to a specific table, just to have the information, you want to have this information, but you don't want to relaunch the whole playbook because it will reset the token of the user again. This is an example where it is quite important, but the feature is lacking.

I have been using Torq for approximately one year to a year and a half.

Torq is stable.

The scalability of Torq is quite good. The customer support is quite responsive and helpful. Most cases are handled in less than a week.

I would rate the customer support a four. They are present and help a lot.

I previously used Logic App from Microsoft. The two main pain points were the number of connectors available with built-in actions. We needed to redevelop every HTTP request every time that we started to create a new playbook. Scalability was not present in that case. Additionally, the tool was quite stale. It did not move a lot in the last year. It has started to move a bit now, but when we were doing the RFP and thinking of changing, we wanted a tool that has a roadmap, innovation, and people that were working on it.

Pricing is pretty straightforward and adaptable based on what you need and what you want to use. The pricing is based on the number of playbooks that you have, which makes it interesting based on how you design your SOC's architecture and makes you spend more time on how you want to design your automation SOCs.

Regarding someone thinking about using Torq, I recommend looking into their provided academy to start working with the tool and understand how JQ works, how the sprig function works, and not diving directly into automation without being sure that your processes and what you want to automate have already been tested out and are a good return on investment for the time that your SOAR team will spend on it. I would rate this review as an 8 out of 10.

My main use case for Torq is enterprise automation, focusing on the cybersecurity application to support security automation and orchestration as well as case management.

For example, we have Splunk which aggregates the logs and generates high-fidelity alerts. With Torq automation, we automate the process to poll for the alerts, enrich all the alerts, and build workflows for the security teams, including security operations, the SOC, and incident response, to quickly investigate the alerts. The automation then determines the maliciousness of the alerts and progresses through all other stages of the case life cycle.

At this point, we primarily focus on cybersecurity for incident response as well as internal insider risk automation, which is our main use case for Torq.

The best feature of Torq is the ease of developing workflows. It has templates, and visually, it is very easy to build the steps, called automation steps. It is easy to debug, as you can see the input and output, making it very clear where issues occur, allowing for quick fixes. This is the best feature I see compared to command line options.

The impact of Torq on my team's efficiency is significant because with compiled code, you go through the whole cycle, and it takes a long time to figure out bugs. With Torq automation, every step is a container, clearly defining the input and output, which significantly speeds up the debugging process. It helps us produce workflows quickly, and we can also quickly respond to issues and fix them.

Additionally, Torq integrates with many other technologies very easily, making integration reusable.

Regarding improvements for Torq, there is definitely work still to be done to mature it. The biggest thing I think is the GUI. If you want to build a full-fledged workflow with the visual interface, it is not as fully functional as other counterparts. Currently, if you want to build a screen and then have a pop-up and then go back, it is not possible. It is just one way instead of having a mature UI component. Some work needs to be done to make UI development easier and more mature.

For documentation, I think Torq has good documentation, but it occasionally needs updates, as some parts are outdated. In general, their documentation is sufficient. For integration, it is not always smooth, but generally, it goes well. However, we did encounter some problems with custom steps, which definitely affected our progress, and the speed of bug fixes is also a bit slower than expected.

I have been using Torq for more than a year.

Torq is relatively stable, though not always, but stable enough.

So far, Torq's scalability appears good, but we still need to see how it holds up over time.

The customer support for Torq is a little above average, though not super excellent.

Previously, we were using IBM QRadar, which is a legacy three-tier on-premises solution. We switched to the cloud-based automation system that also has AI capabilities, as it offers a new generation tool that leverages AI.

The specific challenges in our SOC that led us to consider changes before implementing Torq included the legacy SOAR product from IBM, which is very hard to maintain and troubleshoot. People felt that an AI-enabled new product would be better.

Before choosing Torq, we evaluated Swimlane as well.

We just started to operationalize Torq, and we have just gone into production. It is definitely well-received by the security operation team, who appreciate the neat GUI and what they see. I believe they think it is better than the legacy SOAR product we had.

We have seen a return on investment regarding time saved. It used to take us weeks to develop a workflow, but now it can be done in days or even hours. We have a two-person team, and we are accomplishing the workload of five people.

It took about half a year to realize value with Torq.

My experience with pricing, setup costs, and licensing is that it could be clearer, especially related to the AI aspects, which seem a bit fuzzy. The licensing and cost for the AI agent are not easy to understand, and I hope it becomes clearer once we start to use it more actively.

In this early stage, they are able to capture the metrics they want, such as MTTD and MTTR. It is very clear from the case life cycle to have those metrics, and they like what they see.

SOC has good potential, and for integration, we still need to see how HyperSOC can manage multiple point solutions. We have a very complex environment, but I think we are moving in a good direction as we have started to integrate with Defender and other technologies like Splunk.

Torq has definitely changed the day-to-day experience for our security analysts, as they feel more excited and feel that Torq interface and workflow allow them to build things themselves. They think it is a better product than the legacy product.

We have started to build workflows in Torq to triage, analyze, and contain incidents, including enrichment and integration of intelligence into the workflow. I find it a very good framework for integration compared to completely in-house built tools, as it is easier to maintain due to its vendor components and appears scalable.

What matters most to our leadership team is risk reduction through automation and using the automation system to amplify efficiency, allowing us to do more with fewer people, along with leveraging some AI agent capabilities. Torq has helped us show real SOC impact in this regard.

Regarding Torq's AI capabilities, I note they do have guardrails. I have not fully explored its AI capabilities, except for playing around with Socrate, which appears to have a triage agent. I still need more time to explore it, but the potential is there. Socrate can automatically summarize the case information; we just need more time to actually use it.

So far, the AI agent from Socrate seems good enough in terms of accuracy and reliability of output. It is a generalized AI agent, and for other capabilities, we have not tried them, so I cannot comment.

We have not started to use Torq's agentic AI capabilities yet, but we are definitely looking into it, hoping it will provide additional resources for our operations.

My advice for others looking into using Torq is that those who are capable of developing will be able to utilize its features to leverage Torq platform effectively. I would rate this product a 7.5 out of 10.

My main use case for Torq is to handle the correct cases using it as a SOAR platform. We have created a work plan and we've used Torq as a SOAR platform to handle the incidents from start to closure.

In my opinion, the best features Torq offers are ease of navigation and good AI usage as Socrates. There are different stages of the incident when it comes into the queue, and we could easily navigate to the sections that we would want to update and work on. That is how it brings a lot of customization to the incidents navigation and all other stages of the incident. The good usage of AI is regarding Socrates, the AI that summarizes and can respond to the threats or the incidents on its own when it's assigned to the incident. Those are two of the strongest points of Torq.

Torq is good in the reporting structure and showing metrics to the leadership. I think Torq plays a good role in that sense.

Torq can probably use more ML and look at what can be closed and what cannot be closed in terms of data classification. In terms of auto closure of incidents, it can do better when it uses ML. I choose that number because it's a great SOAR tool. It's not one of those existing SOAR platforms or just a pure SOAR. It has good incident handling, good UI, and a good user-friendly environment, but it can also improve its automation workbooks, work plans, and usage of ML to better cater to the market or consumers.

I have used Torq for five months.

I did not see it buffer, take a lot of time to load, or be unresponsive. I haven't seen those issues in Torq. I think that's a good experience.

If scalability is rated out of ten, I would rate it seven out of ten.

It was Demisto XSOAR, and we shifted because we needed a more user-friendly SOAR platform.

I would just make sure to replace the old or the previous solution with Torq point by point. If that is good, I think everything else will be taken care of.

We were just consumers.

I can share the time saved from my work alone and cannot disclose or specify any other employees. I saved nearly roughly about ten hours of my time while I was working in Torq because it's much better than the previous tool.

I have heard Hyper Automate is pretty user-friendly and has less coding compared to other leaders in the market or other players in the market. Its drag and drop tasks or work plan building is what I heard.

We have seen fewer failures of automations from the time Torq came into the picture. We've had a more streamlined process of handling incidents, and at the same time, we've learned to embed the AI into our incident types, and that is how it has helped us in the automation. I think Torq can really integrate other tools within the case management platform, and it can make the work a little more efficient. I would rate this review eight out of ten.