# What’s the best tool for coordinating cybersecurity incident response?

<p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">Hey folks, I’m in the middle of evaluating <a class="a a--md" elv="true" href="https://www.g2.com/categories/incident-response">incident response platforms</a>, and my head’s kinda spinning with all the options. I pulled up the G2 leaders grid, and here’s what I’ve got so far:</p><ul>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/knowbe4-phisher-phisher-plus/reviews"><strong>KnowBe4 PhishER/PhishER Plus:</strong></a> looks like the go-to when phishing is the main headache and you need quick triage.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/dynatrace/reviews"><strong>Dynatrace</strong></a><strong>:</strong> Provides deep observability tied into IR.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/datadog/reviews"><strong>Datadog</strong></a>: massive market presence and strong footprint in observability and monitoring</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/tines/reviews"><strong>Tines</strong></a><strong>:</strong> Strong for automating workflows, connecting different tools</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/torq/reviews"><strong>Torq</strong></a>: similar vibe to Tines, automates security workflows to orchestrate complex security processes at scale</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/cynet-all-in-one-cybersecurity-platform/reviews"><strong>Cynet</strong></a><strong>:</strong> positioned more as a consolidated “everything under one roof” platform.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/servicenow-security-operations/reviews"><strong>ServiceNow Security Operations</strong></a><strong>:</strong> I see this a lot in larger enterprises where IR workflows are baked into broader IT processes.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/palo-alto-cortex-xsiam/reviews"><strong>Palo Alto Cortex XSIAM</strong></a><strong>:</strong> strong if you’re already in the Palo Alto ecosystem and want it all tied together.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/ibm-instana/reviews"><strong>IBM Instana</strong></a><strong>:</strong> more of an observability + IR connection point.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/cyrebro/reviews"><strong>CYREBRO</strong></a><strong>:</strong> pitched as a centralized hub for detection and response.</li>
</ul><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">I’m mainly looking for a tool that helps <strong>coordinate teams quickly during incidents</strong> — centralizing alerts, standardizing workflows, and making playbooks easy to execute.</p><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">For those who’ve used these, what’s been the best fit for your team?</p><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">I'm also seeing Splunk SOAR, Microsoft Sentinel, and Exabeam mentioned often. Is anyone here finding those best for IR?</p>

##### Post Metadata
- Posted at: 11 months ago
- Author title: SaaS and Software Research
- Net upvotes: 1


## Comments
### Comment 1

&lt;p&gt;I’ve noticed teams that lean on monitoring stacks gravitate toward Datadog or Dynatrace, while others really like Tines/Torq for the workflow automation side. Curious to see which direction most folks here are leaning.&lt;/p&gt;

##### Comment Metadata
- Posted at: 11 months ago
- Author title: SaaS and Software Research





## Related discussions
- [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team)
  - Posted at: about 13 years ago
  - Comments: 6
- [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section)
  - Posted at: about 13 years ago
  - Comments: 0
- [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm)
  - Posted at: about 13 years ago
  - Comments: 4