AWS Security Hub vs. Splunk On-Call

I don't think there's yet a perfect tool in this category of security and incident aggregators, but AWS Security Hub is an excellent tool for having visibility into our overall security posture. It is a great aggregator for many AWS services but also for third party security tools with which it integrates really well.

Incentivized

I recommend Splunk on-call is more suited where there are high incident queues; multiple teams need to be involved in handling a P1 severity issue. Multiple levels of escalation are needed environment where automated action is required. I recommend the solution for large-scale & medium-scale business units. For small-scale business units, I see the functional value is less.

Incentivized

• Brings together the security related AWS tools in one dashboard
• Allows to pick and chose which AWS security tools to use
• Clean UI

Incentivized

• Easily assign work/tickets between multiple users
• Supports a wide variety of software integrations
• Easy to manage scheduling tool
• As part of the Splunk toolset, provides detailed levels of data analysis at our engineers fingertips

Incentivized

• Not easy to read past data, especially once it moves into Glacier deep storage
• performance is somewhat sluggish ... other systems are much faster to analyze data
• Doesn't always provide a remediation solution or suggested fix like other 3rd party tools like Qualys.
• It's hard to get the initial configuration and enrollment completed as there's a lot of manual intervention for every configured rule that needs to be enabled
• alerts are often times delayed

Incentivized

• The user interface can be furthe improved
• Licensing needs to be simplified and packaged as a bundle with other Splunk product like Enterprise Security
• Customer outreach can be further enhanced

Incentivized

It was a good solution with a good comprimise prize/features for our use cases

Incentivized

AWS always good with usability and same here for AWS Security Hub. A lot of good documentation is available to read and configure your own. We also started with looking at the videos and documentation to configure automation for our compliance checks. And to configure there are very less steps to be followed which is a very good thing for faster configuration.

Incentivized

Not a lot of love given to VO since the acquisition by Splunk from my POV

Incentivized

VictorOps support has proven excellent for us. Because it is such a widely used tool, there is a lot of documentation on usage, and a large community of users to lean on. Also, many engineers have had experience working with VictorOps already, and the tool is so easy to setup / manage that much support isn't really necessary.

Incentivized

It was a good solution with a good comprimise prize/features for our use cases

Incentivized

AWS Security Hub is it's own unique program that I have used. I haven't used anything similar to it and it was worth it to try out. However, for those that want to keep for long, it will be very heavy in term of budget and resource that they have to provide.

Incentivized

Splunk On-Call integrates better with our Splunk Cybersecurity and Reporting products due to the same family tree of the same eco system. We were previously using built-in on-call from individual applications and while adequate, they were difficult to manage and support SLA varied greatly across different applications. In addition we also used xMatters which did not integrate well with SAP products nor Citrix products so we were still using more than a single on-call product which was solved by implementing Splunk On-Call

Incentivized

• The automated compliance test helped us a lot to get PCIDSS certified so it was a very good return for our investments.
• Some third party tools we were using were not available for AWS Security Hub automated testing.
• Easy to configure for faster security automations but if we need detailed reports we should add more tools.

Incentivized

• It runs our on call rotation so it makes it easy for us.
• It integrates with Slack so it makes it easy for us to manage through Slack.

Incentivized