Coremetrics / IBM Digital Analytics (discontinued) vs. Splunk Enterprise Security

IBM analytics has continued to improve upon the days of being the original core metrics. After using the updated version for quite some time, it has been great at providing the needed analytics to measure ROI and goal performance for our quarterly KPI's. It has resulted in a great increase in web engagements although we are a midsize company, smaller outfits may not need such an expensive option.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Based on my experience, Splunk is a strong git for some environments and a poor match for others. The distinction is primarily based on infrastructure complexity and budget. It's perfect for large enterprises with a mix of on-prem/cloud infrastructure. It's not a perfect match for small teams with restricted resources.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• IBM CXA comprises an acquisition called Tealeaf. This tool has deep heritage and this is evident in its present-day capabilities.
• The Universal Behaviour Exchange or UBX puts the concept of personalisation at the forefront. The ability to combine physical (analog) and digital transactions to create the complete picture of a customer journey, is a stand out benefit.
• The solution does not have to involve the purchase of software. IBM CXA can be sold as a service bundled with analytics as a service. This not only lowers the cost of ownership, it gets around one of the principal issues. Strong staff with design and analytical capability to drive the solution and deliver tangible benefits.
• The seamless integration of Watson AI services to help with the heavy lifiting. Watson reinforces the analytical focus this solution has and can learn to recognise situations specific to a company.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• Writes Powerful Queries: The queries that can be written using the Splunk Query Language are very powerful and highly customizable to meet every need. Ex: Writing queries to search the intersection of two different sources like Network and Endpoint Logs.
• Offers Dashboard Abilities: Helps build complex panels for Dashboards in addition to providing several out-of-the-box panels. Ex: creating panels to calculate the performance of analysts in a given timezone.
• Helpful Search Aids: It helps to set up complex custom alerts very easily. The interesting fields section is very helpful while threat hunting. Ex: It shows all the users and the frequency of each in a failed login event. The user list on the interesting fields is useful to look for suspicious logins.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• The user interface is in Flash, which can be very frustrating and slow at times. Apparently, this is to be transitioned in a future release.
• Can only segment the last 93 days of data. Any historical segmentation beyond the 93 days must be run in Explore (which is credit based, and has its own limitations with the number of credits per month, based on the initial contract with IBM).
• Reports can only display 93 days of data at a given time for custom date ranges. There are pre-programmed date ranges setup with IBM during implementation (last week, last month, last quarter etc.), but are not flexible enough to answer more specific questions.
• Certain reports cannot have segments applied, making answering some simple questions a bit more tricky. For example, I can create a segment around mobile devices and apply it to the marketing channels report, but I can't create a marketing channel segment and apply it to the mobile reports.
• Built in API calls allows for nice report design and automation.

• Improved User Interface Customization: While the interface is generally intuitive, providing more options for users to customize their dashboards and views would enhance the overall user experience. Tailoring the interface to specific roles or use cases could be a valuable addition.
• Simplified Alert Management: Streamlining the process of managing alerts, such as grouping or categorizing them based on severity or type, would make it easier for security teams to prioritize and respond to incidents effectively.
• Expanded Threat Intelligence Feeds: Increasing the variety and sources of threat intelligence feeds available within ES would provide a broader context for identifying and mitigating emerging threats, ensuring a more comprehensive defense against evolving attack vectors.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

IBM Digital Analytics is a great solution for our clients and I believe they offer the best solution for the retail space. We have access to IBM support via email or live chat and they can answer many of the reporting questions that come up. IBM is receptive to our feedback of the product so I am confident they will continue making improvements

We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Very easy to implement and use.

Maintaining hundreds or even 1000+ SOC use cases is really difficult, considering that the Data sources may not always send the data. A module that detects data freshness issues and detect data format changes would be a great help. the main challenge today using Splunk Enterprise Security is making sure that the detection rules are still working properly given all the changes that occur in data source applications. Also, maintaining the data collects on tens of thousands of servers and more than 100k workstations is a real company IT challenge: the splunkbase forwarder may not support old OS anymore, while these are the most important to monitor. Moving to the Open Telemetry collector has become essential so that only 1 agent is required for both SIEM and application observability.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Never had any issues

I don't think I've ever seen Splunk ES go fully offline or have any downtime greater than a few minutes on rare occasions.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

As reports are templated, the system is pretty quick. Sometimes you have to wait a bit for a report to render. Or you might have to re-load the page. But there is no real issue here and the system is on par with other similar systems.

It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up.

Incentivized

Invited by TrustRadius (TR) on Vendor's Behalf

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Overall, the level of support is very good and I would say it is a strong asset of the solution. However, you can sometimes feel that there is a difference of level among the support team.

It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Online training is really great. One of the best assets that they have. Lots of great videos, pop quizzes at the end of each module. Fantastic. Other tools have similar features, but not as good.

It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

See previous comment: reading and understanding the encyclopedic implementation guide is a must.

It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Much of the work we did in IBM Digital Analytics could have been answered through Google Analytics, a much simpler, agile and FREE solution set. Not mention, given the vast number of Google Analytics USERS, free and actionable support is simply a click away ... this compared to IBM Digital Analytics fractured and often absent support service.

Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review all of them

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

for my exterience, unit pricing and billing frequency are correct. As I already said, I hint to have more discount flexibility, expecially with new customers, because there are competitors less expensive and very aggressive that are dangerous. In addition the possibility to don't pay the license for the development period could be a very interesting feature for the final customers.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

This solution can support large amount of data and transaction. The way that user management features are built, it shows it is meant for large organizations.

- 8 out of 10 and took 2 for the data pipeline and administration part. Even if you'd like to improve yourself or your team, you have to pay a lot of money and it could be more than GIAC education + cert. - Normalization for Data models and CPU-based searches can be a problem sometimes.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

I had a fantastic experience with Splunk Professional Services: they worked with us in our last SON project (a SOC migration for a very large customer) and helped to build a multi tenent environment even if ES isn't a multi tenant platform. Th Splunk PS was a very professional and competent people, he is italian and was able to speak with our italian customers.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• We spend too much time trying to work around bugs on the new UI.
• We spend too much time trying to figure out how to make certain segments work because support and the knowledge center are lackluster.
• Our sales rep is very unresponsive and leaves us searching for a lot of answers on our own, including what other products we may benefit from that IBM offers.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• We have a 100% success rate on all our ES implementations due to the amazing documentation and Splunk enablement on the subject.
• Our Splunk ES business has grown 100% YoY for the last 3 years.
• In terms of long term management and maintenance, ES has been highly stable and predictable, reducing our overhead on costly services team for ad hoc maintenance work.