Splunk SOAR (Cloud) is licensed by the number of user accounts that can log in to Splunk SOAR (Cloud). This number includes local accounts in Splunk SOAR (Cloud), regardless of role assigned, and accounts authenticated or managed by external services, like LDAP or SAML. The built-in user accounts for the Automation and the soar_local_admin users do not count against a seat-based license. Other local users assigned the admin role still count against a seat-based license.

Seat limits must be purchased in increments of five.

For Splunk Cloud customers who license Splunk Enterprise Security (Cloud) and SOAR (Cloud) directly from Splunk, use of Splunk Mission Control does not affect your Splunk SOAR seats or the licensed number of users allowed to log in to Splunk SOAR (Cloud). If you're a Splunk Mission Control user, see Access Splunk Mission Control in the Splunk Mission Control Service Description manual for details on how your Splunk SOAR license works with Splunk Mission Control.

You obtain a license when you purchase Splunk SOAR (Cloud).