Connectors · Identity & security
Splunk SOAR MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Splunk SOAR and the rest of your systems. It gives your agent 217 Splunk SOAR actions (142 reads, 58 writes and 17 that wait for a confirmation) and holds the Splunk SOAR credential itself, so the agent never does. It paces Splunk SOAR's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "splunk_soar.users.list", intent: "check which Splunk SOAR account is connected"}# List users · read · 1 upstream call- 217actionsin one signed file
- 142readlook, never change
- 58writecreate and update
- 17wait for a yesdestructive, confirmed first
Set up
Connect Splunk SOAR in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Splunk SOAR.
Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
usernameSOAR username for a user loginpasswordThe user's password, or an automation user's ph-auth-token (Administration > User Management > Users > the…hostWhere your Splunk SOAR lives: your host
account { op: "connections.requirements", service: "splunk_soar" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "splunk_soar.users.list" }# list users · read · 1 upstream callcheck { action: "splunk_soar.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Splunk SOAR at a glance
- Sign-in
- Username and secret. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
usernamepassword- Setup fields
host- Limits we pace to
- 10 calls a second, per connection
- API covered
- Splunk SOAR REST API (SOAR Cloud and On-premises 6.x/7.x), at your Splunk SOAR instance's API base URL, which you enter when connecting
- Built from
- Splunk SOAR's documentation, read 23 October 2026help.splunk.comhelp.splunk.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 141 of 142 reads, for up to 1 minute; a write clears what it affects
- Shared entities
- 7, so ask can line Splunk SOAR up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Splunk SOAR.
217 actions in 50 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 142readlook, never change
- 58writecreate and update
- 17destructivewait for a confirmation
Containers
2015 read · 4 write · 1 destructive
List containers · Get a container's audit trail · Create a container · Get a container
Widgets
1818 read · 0 write · 0 destructive
List dashboard widgets · Get dashboard data: artifact statistics · Get dashboard data: container statistics · Get dashboard data: containers by status
Indicators
1010 read · 0 write · 0 destructive
List indicators · List artifacts sharing an indicator · List containers sharing indicators · Get an indicator
Users
85 read · 2 write · 1 destructive
List users · Create a user · Get a user · Update a user
Playbook runs
75 read · 1 write · 1 destructive
List playbook runs · Get a playbook run · Get a playbook run's log · Run a playbook
Roles
74 read · 2 write · 1 destructive
List roles · Create a role · Get a role · Update a role
Action runs
64 read · 1 write · 1 destructive
Run an action · List action runs · List an action run's app runs · List an action run's approvals
Artifacts
62 read · 3 write · 1 destructive
Create artifacts in bulk · Create an artifact · List artifacts · Get an artifact
42 more areas · 135 actions
- Custom lists 6
- Notes 6
- Playbooks 6
- System settings 6
- Assets 5
- Automation brokers 5
- Cef 5
- Container statuses 5
- Custom functions 5
- Workbook templates 5
- Aggregation rules 4
- Apps 4
- Container attachments 4
- Feature flags 4
- Severities 4
- Workbook phase templates 4
- Workbook task templates 4
- App runs 3
- Approvals 3
- Command runs 3
- Container comments 3
- Container pins 3
- Evidence 3
- Indicator cef filters 3
- Records 3
- Source control 3
- Workbook tasks 3
- Cluster nodes 2
- External prompts 2
- License 2
- Notifications 2
- Tenants 2
- User settings 2
- Vault documents 2
- Workbook phases 2
- App status 1
- Audit 1
- Container pin settings 1
- Health 1
- Search 1
- System info 1
- Version 1
Top actions
The Splunk SOAR API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 30 of Splunk SOAR's 30 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
splunk_soar.users.listList users | List users. | read | identity.user.list474 connectors |
splunk_soar.roles.listList roles | List roles. | read | identity.role.list184 connectors |
splunk_soar.user_settings.getGet my user settings | Get my user settings. | read | identity.current_user.get307 connectors |
splunk_soar.users.createCreate a user | Create a user. | write | identity.user.create262 connectors |
splunk_soar.roles.createCreate a role | Create a role. | write | identity.role.create105 connectors |
splunk_soar.users.deleteDelete a user | Delete a user. | destructive | identity.user.delete253 connectors |
splunk_soar.containers.listList containers | List containers. | read | security.incident.list17 connectors |
splunk_soar.audit.listQuery the audit log | Query the audit log. | read | security.audit_log.list69 connectors |
splunk_soar.notes.listList notes | List notes. | read | security.incident_note.list9 connectors |
splunk_soar.containers.audit.listGet a container's audit trail | Get a container's audit trail. | read | security.audit_log.list69 connectors |
splunk_soar.notes.createCreate a note | Create a note. | write | security.incident_note.create8 connectors |
splunk_soar.containers.createCreate a container | Create a container. | write | security.incident.create8 connectors |
Try it
Prompts to paste into Claude.
Each one names the Splunk SOAR actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which Splunk SOAR incidents are open, and how long has each been open?
calls
splunk_soar.containers.list - Writewrite
Create a user in Splunk SOAR. Show me exactly what you will send before you save it.
calls
splunk_soar.users.create
Governance for Splunk SOAR
Destructive actions wait for a yes.
17 Splunk SOAR actions are destructive. These are all of them:
- Delete a user
splunk_soar.users.delete - Delete a role
splunk_soar.roles.delete - Delete a note
splunk_soar.notes.delete - Delete a container
splunk_soar.containers.delete - Cancel a playbook run
splunk_soar.playbook_runs.cancel - Delete a CEF field definition
splunk_soar.cef.delete - Delete an app
splunk_soar.apps.delete - Delete an asset
splunk_soar.assets.delete - Delete an evidence record
splunk_soar.evidence.delete - Delete an artifact
splunk_soar.artifacts.delete - Delete a custom list
splunk_soar.custom_lists.delete - Delete an Automation Broker
splunk_soar.automation_brokers.delete - Delete a container status
splunk_soar.container_statuses.delete - Delete a workbook template
splunk_soar.workbook_templates.delete - Delete a container attachment
splunk_soar.container_attachments.delete - Cancel an action run
splunk_soar.action_runs.cancel - Remove a container label
splunk_soar.system_settings.labels.remove
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete a user?
intent: the user asked me to delete a user
account { op: "keys.create", name: "splunk-soar-agent", allowed_actions: ["splunk_soar.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "splunk_soar.users.delete", approver: "[email protected]" }, { match: "splunk_soar.roles.delete", approver: "[email protected]" }, { match: "splunk_soar.notes.delete", approver: "[email protected]" } ]}Cost
What Splunk SOAR costs on actionlake.
Every Splunk SOAR action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Splunk SOAR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 217 Splunk SOAR actions
- 217actions pageeach page of a long list is one call
- 141reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Splunk SOAR action.
217 actions by area: the id your agent calls, what it does, and its effect.
Containers20
splunk_soar.containers.actions.listList a container's action runsreadsplunk_soar.containers.activity_feed.listList a container's activity feedreadsplunk_soar.containers.approvals.listList a container's approvalsreadsplunk_soar.containers.artifacts.listList a container's artifactsreadsplunk_soar.containers.attachments.listList a container's attachmentsreadsplunk_soar.containers.audit.listGet a container's audit trailreadsplunk_soar.containers.authorized_users.updateSet authorized users on several containerswritesplunk_soar.containers.bulk_createCreate containers in bulkwritesplunk_soar.containers.comments.listList a container's commentsreadsplunk_soar.containers.createCreate a containerwritesplunk_soar.containers.deleteDelete a containerdestructivesplunk_soar.containers.fields.getGet one field of a containerreadsplunk_soar.containers.getGet a containerreadsplunk_soar.containers.listList containersreadsplunk_soar.containers.options.getGet container optionsreadsplunk_soar.containers.permitted_users.listList users who may be authorized on a containerreadsplunk_soar.containers.playbook_runs.listList a container's playbook runsreadsplunk_soar.containers.recommended_actions.getGet recommended actions for a containerreadsplunk_soar.containers.recommended_playbooks.getGet recommended playbooks for a containerreadsplunk_soar.containers.updateUpdate a containerwrite
Widgets18
splunk_soar.widgets.artifact_stats.getGet dashboard data: artifact statisticsreadsplunk_soar.widgets.container_stats.getGet dashboard data: container statisticsreadsplunk_soar.widgets.containers_filtered_by_status.getGet dashboard data: containers by statusreadsplunk_soar.widgets.containers_new.getGet dashboard data: new containers per dayreadsplunk_soar.widgets.containers_open.getGet dashboard data: open containersreadsplunk_soar.widgets.containers_performance.getGet dashboard data: container performancereadsplunk_soar.widgets.containers_resolved.getGet dashboard data: containers resolved per dayreadsplunk_soar.widgets.containers_workload.getGet dashboard data: container workloadreadsplunk_soar.widgets.label_stats.getGet dashboard data: events per day by labelreadsplunk_soar.widgets.listList dashboard widgetsreadsplunk_soar.widgets.pending_approvals.getGet dashboard data: pending approvalsreadsplunk_soar.widgets.playbook_stats.getGet dashboard data: playbook countsreadsplunk_soar.widgets.playbooks_actions_stats.getGet dashboard data: playbook and action runs per dayreadsplunk_soar.widgets.roi_stats.getGet dashboard data: roi per dayreadsplunk_soar.widgets.roi_summary.getGet dashboard data: roi summaryreadsplunk_soar.widgets.sla_stats.getGet dashboard data: sla breaches per dayreadsplunk_soar.widgets.sla_trend.getGet dashboard data: sla trendreadsplunk_soar.widgets.top_playbooks_actions.getGet dashboard data: top playbook actionsread
Indicators10
splunk_soar.indicators.artifacts.listList artifacts sharing an indicatorreadsplunk_soar.indicators.containers.listList containers sharing indicatorsreadsplunk_soar.indicators.getGet an indicatorreadsplunk_soar.indicators.get_by_valueGet an indicator by valuereadsplunk_soar.indicators.listList indicatorsreadsplunk_soar.indicators.stats.countCount indicatorsreadsplunk_soar.indicators.stats.top_labelsTop labels by indicator countreadsplunk_soar.indicators.stats.top_typesTop indicator typesreadsplunk_soar.indicators.stats.top_valuesTop indicator valuesreadsplunk_soar.indicators.timeline.getGet an indicator's timelineread
Users8
splunk_soar.users.audit.listGet a user's audit trailreadsplunk_soar.users.createCreate a userwritesplunk_soar.users.deleteDelete a userdestructivesplunk_soar.users.getGet a userreadsplunk_soar.users.listList usersreadsplunk_soar.users.roles.listList a user's rolesreadsplunk_soar.users.token.getGet an automation user's token inforeadsplunk_soar.users.updateUpdate a userwrite
Playbook runs7
splunk_soar.playbook_runs.actions.listList a playbook run's action runsreadsplunk_soar.playbook_runs.block_results.getGet a playbook run's block resultsreadsplunk_soar.playbook_runs.cancelCancel a playbook rundestructivesplunk_soar.playbook_runs.createRun a playbookwritesplunk_soar.playbook_runs.getGet a playbook runreadsplunk_soar.playbook_runs.listList playbook runsreadsplunk_soar.playbook_runs.log.listGet a playbook run's logread
Roles7
splunk_soar.roles.audit.listGet a role's audit trailreadsplunk_soar.roles.createCreate a rolewritesplunk_soar.roles.deleteDelete a roledestructivesplunk_soar.roles.getGet a rolereadsplunk_soar.roles.listList rolesreadsplunk_soar.roles.updateUpdate a rolewritesplunk_soar.roles.users.listList a role's usersread
Action runs6
splunk_soar.action_runs.app_runs.listList an action run's app runsreadsplunk_soar.action_runs.approvals.listList an action run's approvalsreadsplunk_soar.action_runs.cancelCancel an action rundestructivesplunk_soar.action_runs.createRun an actionwritesplunk_soar.action_runs.getGet an action runreadsplunk_soar.action_runs.listList action runsread
Artifacts6
splunk_soar.artifacts.bulk_createCreate artifacts in bulkwritesplunk_soar.artifacts.createCreate an artifactwritesplunk_soar.artifacts.deleteDelete an artifactdestructivesplunk_soar.artifacts.getGet an artifactreadsplunk_soar.artifacts.listList artifactsreadsplunk_soar.artifacts.updateUpdate an artifactwrite
Custom lists6
splunk_soar.custom_lists.createCreate a custom listwritesplunk_soar.custom_lists.deleteDelete a custom listdestructivesplunk_soar.custom_lists.formatted_content.getGet a custom list's formatted contentreadsplunk_soar.custom_lists.getGet a custom listreadsplunk_soar.custom_lists.listList custom listsreadsplunk_soar.custom_lists.updateUpdate a custom listwrite
Notes6
splunk_soar.notes.bulk_createCreate notes in bulkwritesplunk_soar.notes.createCreate a notewritesplunk_soar.notes.deleteDelete a notedestructivesplunk_soar.notes.getGet a notereadsplunk_soar.notes.listList notesreadsplunk_soar.notes.updateUpdate a notewrite
Playbooks6
splunk_soar.playbooks.audit.listGet a playbook's audit trailreadsplunk_soar.playbooks.getGet a playbookreadsplunk_soar.playbooks.importImport a playbookwritesplunk_soar.playbooks.listList playbooksreadsplunk_soar.playbooks.resource_usage.getGet a playbook's resource usagereadsplunk_soar.playbooks.updateUpdate a playbookwrite
System settings6
splunk_soar.system_settings.features.updateTurn a system feature on or offwritesplunk_soar.system_settings.getGet system settingsreadsplunk_soar.system_settings.labels.addAdd a container labelwritesplunk_soar.system_settings.labels.listList container labelsreadsplunk_soar.system_settings.labels.removeRemove a container labeldestructivesplunk_soar.system_settings.updateUpdate system settingswrite
Assets5
splunk_soar.assets.createCreate an assetwritesplunk_soar.assets.deleteDelete an assetdestructivesplunk_soar.assets.getGet an assetreadsplunk_soar.assets.listList assetsreadsplunk_soar.assets.updateUpdate an assetwrite
Automation brokers5
splunk_soar.automation_brokers.createCreate an Automation Brokerwritesplunk_soar.automation_brokers.deleteDelete an Automation Brokerdestructivesplunk_soar.automation_brokers.getGet an Automation Brokerreadsplunk_soar.automation_brokers.listList Automation Brokersreadsplunk_soar.automation_brokers.updateUpdate an Automation Brokerwrite
Cef5
splunk_soar.cef.createCreate a CEF field definitionwritesplunk_soar.cef.deleteDelete a CEF field definitiondestructivesplunk_soar.cef.getGet a CEF field definitionreadsplunk_soar.cef.listList CEF field definitionsreadsplunk_soar.cef.updateUpdate a CEF field definitionwrite
Container statuses5
splunk_soar.container_statuses.createCreate a container statuswritesplunk_soar.container_statuses.deleteDelete a container statusdestructivesplunk_soar.container_statuses.getGet a container statusreadsplunk_soar.container_statuses.listList container statussreadsplunk_soar.container_statuses.updateUpdate a container statuswrite
Custom functions5
splunk_soar.custom_functions.createCreate a custom functionwritesplunk_soar.custom_functions.getGet a custom functionreadsplunk_soar.custom_functions.importImport a custom functionwritesplunk_soar.custom_functions.listList custom functionsreadsplunk_soar.custom_functions.updateUpdate a custom functionwrite
Workbook templates5
splunk_soar.workbook_templates.createCreate a workbook templatewritesplunk_soar.workbook_templates.deleteDelete a workbook templatedestructivesplunk_soar.workbook_templates.getGet a workbook templatereadsplunk_soar.workbook_templates.listList workbook templatesreadsplunk_soar.workbook_templates.updateUpdate a workbook templatewrite
Aggregation rules4
splunk_soar.aggregation_rules.createCreate an aggregation rulewritesplunk_soar.aggregation_rules.getGet an aggregation rulereadsplunk_soar.aggregation_rules.listList aggregation rulesreadsplunk_soar.aggregation_rules.updateUpdate an aggregation rulewrite
Apps4
splunk_soar.apps.deleteDelete an appdestructivesplunk_soar.apps.getGet an appreadsplunk_soar.apps.installInstall or upgrade an appwritesplunk_soar.apps.listList appsread
Container attachments4
splunk_soar.container_attachments.createAttach a file to a containerwritesplunk_soar.container_attachments.deleteDelete a container attachmentdestructivesplunk_soar.container_attachments.getGet a container attachmentreadsplunk_soar.container_attachments.listList container attachmentsread
Feature flags4
splunk_soar.feature_flags.detail.getGet one field of a feature flagreadsplunk_soar.feature_flags.getGet a feature flagreadsplunk_soar.feature_flags.listList feature flagsreadsplunk_soar.feature_flags.updateUpdate a feature flagwrite
Severities4
splunk_soar.severities.createCreate a severitywritesplunk_soar.severities.getGet a severityreadsplunk_soar.severities.listList severitysreadsplunk_soar.severities.updateUpdate a severitywrite
Workbook phase templates4
splunk_soar.workbook_phase_templates.createCreate a workbook phase templatewritesplunk_soar.workbook_phase_templates.getGet a workbook phase templatereadsplunk_soar.workbook_phase_templates.listList workbook phase templatesreadsplunk_soar.workbook_phase_templates.updateUpdate a workbook phase templatewrite
Workbook task templates4
splunk_soar.workbook_task_templates.createCreate a workbook task templatewritesplunk_soar.workbook_task_templates.getGet a workbook task templatereadsplunk_soar.workbook_task_templates.listList workbook task templatesreadsplunk_soar.workbook_task_templates.updateUpdate a workbook task templatewrite
App runs3
splunk_soar.app_runs.getGet an app runreadsplunk_soar.app_runs.listList app runsreadsplunk_soar.app_runs.log.getGet an app run's logread
Approvals3
splunk_soar.approvals.detail_summary.getGet an approval's detail summaryreadsplunk_soar.approvals.getGet an approvalreadsplunk_soar.approvals.listList approvalsread
Command runs3
splunk_soar.command_runs.createRun system commandswritesplunk_soar.command_runs.getGet a system command runreadsplunk_soar.command_runs.listList system command runsread
Container comments3
splunk_soar.container_comments.createComment on a containerwritesplunk_soar.container_comments.getGet a container commentreadsplunk_soar.container_comments.listList container commentsread
Container pins3
splunk_soar.container_pins.createPin data to a container's HUDwritesplunk_soar.container_pins.getGet a container HUD pinreadsplunk_soar.container_pins.listList container HUD pinsread
Evidence3
splunk_soar.evidence.createMark an object as evidencewritesplunk_soar.evidence.deleteDelete an evidence recorddestructivesplunk_soar.evidence.listList evidence recordsread
Indicator cef filters3
splunk_soar.indicator_cef_filters.getGet an indicator CEF filterreadsplunk_soar.indicator_cef_filters.listList indicator CEF filtersreadsplunk_soar.indicator_cef_filters.updateUpdate an indicator CEF filterwrite
Records3
splunk_soar.records.fields.getGet a field or related list of any recordreadsplunk_soar.records.getGet a record of any typereadsplunk_soar.records.listList records of any typeread
Source control3
splunk_soar.source_control.getGet a source control repositoryreadsplunk_soar.source_control.listList source control repositorysreadsplunk_soar.source_control.syncSync a source control repositorywrite
Workbook tasks3
splunk_soar.workbook_tasks.getGet a workbook taskreadsplunk_soar.workbook_tasks.listList workbook tasksreadsplunk_soar.workbook_tasks.updateUpdate a workbook taskwrite
Cluster nodes2
splunk_soar.cluster_nodes.getGet a cluster nodereadsplunk_soar.cluster_nodes.listList cluster nodesread
External prompts2
splunk_soar.external_prompts.getGet an external promptreadsplunk_soar.external_prompts.respondRespond to an external promptwrite
License2
splunk_soar.license.getGet license informationreadsplunk_soar.license.updateLoad a licensewrite
Notifications2
splunk_soar.notifications.detail_summary.getGet a notification's detail summaryreadsplunk_soar.notifications.listList notificationsread
Tenants2
splunk_soar.tenants.getGet a tenantreadsplunk_soar.tenants.listList tenantsread
User settings2
splunk_soar.user_settings.getGet my user settingsreadsplunk_soar.user_settings.updateUpdate my user settingswrite
Vault documents2
splunk_soar.vault_documents.getGet a vault documentreadsplunk_soar.vault_documents.listList vault documentsread
Workbook phases2
splunk_soar.workbook_phases.getGet a container workbook phasereadsplunk_soar.workbook_phases.listList container workbook phasesread
App status1
splunk_soar.app_status.listList app status recordsread
Audit1
splunk_soar.audit.listQuery the audit logread
Container pin settings1
splunk_soar.container_pin_settings.createCreate an HUD pin templatewrite
Health1
splunk_soar.health.getGet system healthread
Search1
splunk_soar.search.querySearch SOARread
System info1
splunk_soar.system_info.getGet system informationread
Version1
splunk_soar.version.getGet the SOAR versionread
Questions
The Splunk SOAR MCP server, answered.
Is there a Splunk SOAR MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 217 Splunk SOAR actions across containers, widgets, indicators and users, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Splunk SOAR.
What do I need to connect Splunk SOAR?
SOAR username for a user login and The user's password, or an automation user's ph-auth-token (Administration > User Management > Users > the…. Plus your host. The free call account { op: "connections.requirements", service: "splunk_soar" } lists exactly what to paste.
Can an AI agent delete or change things in Splunk SOAR?
Only if its key allows it, and only with an explicit confirmation. 17 Splunk SOAR actions are destructive, including delete a user, delete a role and delete a note. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Splunk SOAR API limit?
actionlake paces every call to the limits in the Splunk SOAR service file: 10 calls a second per connection. Repeated reads are answered from cache (141 Splunk SOAR actions can be), which never reaches Splunk SOAR.
What does a Splunk SOAR action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (217 Splunk SOAR actions page). Cache hits, searches, dry runs and calls Splunk SOAR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Splunk SOAR API does it cover?
The Splunk SOAR REST API (SOAR Cloud and On-premises 6.x/7.x) at your Splunk SOAR instance's API base URL, which you enter when connecting. It is built from Splunk SOAR's documentation as read on 23 October 2026. 217 actions in 50 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Splunk SOAR data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 1 minute, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Splunk SOAR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Splunk SOAR today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
