What is the default embedded search engine used by SOAR?

the default embedded search engine used by SOAR is the SOAR search engine, which is powered by

the PostgreSQL database built-in to Splunk SOAR (Cloud). A Splunk SOAR (Cloud) Administrator can

configure options for search from the Home menu, in Search Settings under Administration Settings.

The SOAR search engine has been modified to accept the * wildcard and supports various operators

and filters. For search syntax and examples, see Search within Splunk SOAR (Cloud)2.

Option A is incorrect, because the embedded Splunk search engine was used in earlier releases of

Splunk SOAR (Cloud), but not in the current version. Option C is incorrect, because Django is a web

framework, not a search engine. Option D is incorrect, because Elastic is a separate search engine

that is not embedded in Splunk SOAR (Cloud).

1: Configure search in Splunk SOAR (Cloud) 2: Search within Splunk SOAR (Cloud)

Splunk SOAR utilizes its own embedded search engine by default, which is tailored to its security

orchestration and automation framework. While Splunk SOAR can integrate with other search

engines, like the Embedded Splunk search engine, for advanced capabilities and log analytics, its

default setup comes with an embedded search engine optimized for the typical data and search

patterns encountered within the SOAR platform.