Intezer
AI SOC that triages, investigates and responds to alerts, priced by endpoints
Quick Overview
| Company | Intezer Labs Ltd. and Intezer Labs Inc. |
|---|---|
| Category | SOAR and Security Automation Platforms |
| Headquarters | Israel (US affiliate), Israel |
| Founded | Not stated |
| EU Presence | Partly - Israel (counted as European by EP), US affiliate named in the terms |
| Data Location | Not stated on pages read |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Not stated on pages read |
| Main Features | Automated triage, investigation with sandboxing and AI, auto-resolution of false positives, custom response workflows, detection rule tuning, expert support |
| Pricing | Starter and Complete plans priced by endpoints; amounts on request |
| Best For | SOC teams that want to offload Tier 1 and Tier 2 alert investigation rather than build playbooks |
| Replaces | Palo Alto Cortex XSOAR (triage playbooks) |
Detailed Review
Intezer's homepage says its AI SOC investigates alerts and removes false positives, escalating real threats for human review or auto-remediation. The company's own navigation lists SIEM and SOAR as topics, and its blog describes the product plugging into SOAR tools, so it often complements rather than replaces an orchestrator.
The terms of use name Intezer Labs Ltd. and Intezer Labs Inc. collectively and are governed by Israeli law.
Plans
The pricing page lists Starter, for one alert source (endpoint or user-reported phishing), and Complete, for all alert sources including SIEM, cloud, identity and network. Both are priced by endpoints, and Complete adds custom response workflows, an optional managed SIEM add-on and on-demand experts.
Starter includes automatic collection of files and URLs, deep investigations with sandboxing and AI, and auto-resolution of false positives.
Role next to a SOAR
Intezer concentrates on the investigation step. Playbooks that enrich and verdict an alert can be reduced to a call to the service, while containment actions still need an orchestrator such as Tines or Shuffle.
Entity
Because the terms name an Israeli company and a US company together, confirm in the order form which one contracts with you.
Limitations to Consider
Not a full SOAR: playbook breadth and orchestration across arbitrary tools are limited to the Complete plan's custom workflows. Prices are not published. A US company is named alongside the Israeli one in the terms, so eligibility depends on the signing entity. No self-hosting or data-location statement was found.
Who Should Use Intezer
SOC and MDR-replacement teams that want machine investigation of every alert and already have, or do not need, a classic orchestrator.
Pros and Cons
Pros
- Investigation of low-severity alerts too
- Auto-resolution of false positives
- Priced by endpoints in two plans
- Israeli company named in terms
- Expert help on demand in Complete
Cons
- Not a general SOAR
- Prices not published
- US affiliate named in the terms
- Data location not stated
Alternatives to Intezer
Other European soar and security automation platforms worth comparing before you decide:
Shuffle
Norway · Open source SOAR for security teams and MSSPs
SecureVisio
Poland · SIEM, SOAR and UEBA in one platform from Rzeszow
TheHive
France · Incident response case platform with native Flow automation
Tines
Ireland · No-code workflow automation used by security and IT teams
See all European soar and security automation platforms or compare them directly against Palo Alto Cortex XSOAR (triage playbooks) on our alternatives page.
Frequently Asked Questions
No. Its site positions it as an AI SOC that investigates alerts, and it describes plugging into existing SOAR tools. Complete adds custom response workflows.
Both Starter and Complete are priced by endpoints; amounts are not shown on the pricing page we read.
The terms of use name Intezer Labs Ltd. and Intezer Labs Inc. collectively, so check the order form.