SOAR, DIY n8n, or Managed: Which Is Right for Your SOC?

Once a SOC decides to automate its triage, there are three ways to get there. Buy a SOAR platform. Build the workflows yourself on something like n8n. Or have someone build them on your infrastructure and keep them running.

We sell two of those three, so read this with that in mind. We have also run our own automation on Wazuh and n8n for long enough to know where the DIY route goes wrong, and there are teams for whom a commercial SOAR is the right answer. This post tries to say which team is which.

Option 1: a commercial SOAR platform

Splunk SOAR, Cortex XSOAR, Tines and Torq are the names most teams look at first. What you pay for is a product built for this job:

• Case management, so an alert becomes an incident with an owner, a timeline and an audit trail

• A library of ready-made playbooks and vendor-maintained connectors

• Role-based access and reporting that an auditor will recognise

• A vendor to call when something breaks

The cost is harder to pin down, because most of these platforms are sold on an annual quote rather than a price list. Budget for the licence and for an implementation project, since a platform with no playbooks configured does nothing.

The part buyers underestimate is that a SOAR still needs an owner. Somebody writes and tunes the playbooks, fixes them when an integration changes, and decides what gets automated next. The vendor maintains the connectors. Your playbooks are yours.

A SOAR fits when you have a team large enough to justify the licence, compliance requirements that call for case management and audit trails out of the box, and at least one person whose job includes owning the platform.

Option 2: build it yourself on n8n

n8n is a general workflow automation tool that happens to be very good at security work. The self-hosted version is free to run, it talks to anything with an API or a webhook, and it has Code nodes for the parts no integration covers. You can run a local model through Ollama, so alert data never leaves your network. Our own catalog is built on it.

What you give up compared to a SOAR:

• No case management built in. You pair it with TheHive, Jira or whatever ticketing you already have

• No vendor maintaining your integrations. When Wazuh changes an API or a field name, your workflow is the one that breaks, usually without an error. We wrote up what breaks during a Wazuh upgrade and how to catch it

• The knowledge lives with whoever built it. When that person leaves or gets busy, the workflows keep running until the first thing changes underneath them

If you plan to offer n8n-based automation to your own clients, read n8n's Sustainable Use License first. Running it for your own organisation is the case it is written for.

DIY fits when you have an engineer who likes building this, enjoys the debugging, and has the hours to keep it current. Plenty of good SOC automation runs this way.

Option 3: managed automation

The third option is the same n8n stack, deployed on your infrastructure, with someone else responsible for keeping it working. That is what our Managed SOC Automation plan is, so here is exactly what it covers and what it does not.

We set it up (setup is included), give you access to the full workflow catalog, and then watch the automation: workflow runs, failures, credentials and integrations. When something breaks, we respond the next business day. When an API changes, we update the workflow. If your priorities change, we add or change automations.

What it does not cover: your security posture, incident response, or the SIEM itself. We run the automation that feeds your analysts. Your analysts still decide what an alert means, and your team still owns the Wazuh deployment.

Managed fits when you want what the DIY route gives you (no licence, your data on your servers, any SIEM with an API) and nobody on the team has the hours to own it.

The three side by side

Commercial SOARDIY on n8nManaged (n8n)Upfront costLicence plus implementation, usually quotedYour engineer's timeIncluded in the monthly feeOngoing costAnnual licenceYour engineer's time$249 a monthWho maintains the playbooksYour teamYour teamUsCase managementBuilt inBring your ownBring your ownWhere your data livesDepends on the vendor and planYour serversYour serversVendor supportYesCommunity forumNext business dayBest fitLarger teams with compliance needs and a platform ownerTeams with a builder who has spare hoursSmall teams with no one to own it

The maintenance math

The decision between DIY and managed usually comes down to one number: how many hours a month the upkeep takes.

At $50 an hour for an analyst, $249 a month is about five hours. If keeping your workflows healthy takes less than that (checking failed executions, fixing what an upgrade broke, rotating credentials, testing after changes), DIY is cheaper and you should keep doing it. If it takes more, or if the honest answer is that nobody does it at all, managed is cheaper, and the second case is the one to worry about. Automation nobody maintains keeps running and returns fewer results each month until somebody notices.

You do not have to pick one forever

The three options are steps, and most teams move between them:

1. Start with a ready-made workflow from the store and run it yourself

2. If deploying it is the part you would rather skip, Done For You is $129 one-time: we install it, test it end to end, and fix anything that breaks in the first 30 days

3. If you are happy installing things yourself but do not want to track every Wazuh and API change, Updates + Support is $39.99 a month for updated and fixed versions of the workflows you bought, plus email support

4. When upkeep starts costing more than five hours a month, move to Managed. Updates + Support is included, so you do not pay for both

And if you outgrow all of it, with a team big enough for a platform owner and an auditor asking for case management, a commercial SOAR is a reasonable next step. The workflows you built in n8n will have taught you exactly which playbooks you need.

Not sure which one you are?

Book a 15-minute call. Tell us what you run and how many alerts you see, and we will tell you which of the three we would pick in your position, including when it is not ours. You can also compare our plans on the services page.