CrowdStrike offers the Falcon Endpoint Protection suite, an antivirus and endpoint protection system emphasizing threat detection, machine learning malware detection, and signature free updating. Additionally the available Falcon Spotlight module delivers vulnerability assessment with no performance impact, no additional agents, hardware, scheduled scans, firewall exceptions or admin credentials.
$59.99
per endpoint/month (minimum number of endpoints applies)
Splunk Enterprise Security
Score 8.1 out of 10
N/A
Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.
N/A
Pricing
CrowdStrike Falcon
Splunk Enterprise Security
Editions & Modules
Falcon Go (Small Business)
$59.99
per endpoint/month (minimum number of endpoints applies)
Falcon Go (Small Business)
$59.99
Falcon Pro
$99.99
per endpoint/month (for 5-250 endpoints, billed annually)
Falcon Enterprise
$184.99
per endpoint/month (minimum number of endpoints applies)
I have evaluated Cortex XDR and SentinelOne Singularity alongside CrowdStrike Falcon, and while all three are capable enterprise-grade solutions, Falcon ultimately stood out due to its cloud-native architecture, broader modular coverage, and stronger identity-focused detection. …
It was just a legacy AV program onboarded during initial setup days. As the org. As it expanded, its threat landscape also grew, and we needed a next-gen solution to protect against evolving threat vectors. Falcon EDR was the one that solved all these in a single place.
Depends on your network architecture.. NDR can be very expensive. EDR works on almost all network architectures, even those segmented networks. However if you rely on centralized switch and older style of network architecture, NDR should be asses and considered, especially if …
It stacks on top. We love the ease of use, the third-party integration, having AI, and the CrowdStrike team was way more helpful with our team, so that adoption was within a couple of months. We also compared prices, and the value was higher, with a faster ROI, which helps our …
There really wasn't a question. CrowdStrike is best in class and really doesn't have an equal in this space, any other threat protection vendor is a compromise in some area, and even though we are paying for the premier service, we can feel comfortable and protected with our …
Sentinelone is bit complicated language use in there console in compare to CrowdStrike Falcon. CrowdStrike Falcon have much big modules and features but sentinelone don't. CrowdStrike Falcon have one single unified agent and in sentinelone bit confused in selection of agent …
CrowdStrike is by far the superior product as we have had zero problems since installing compared to Trend where is positively failed us. We switched and again have had zero issues with the product and it protects our environment as it should without much interaction.
CrowdStrike Falcon is way ahead of Symantec, and covers features that defender XDR doesn't, even if you purchase all the addons. I think the only real competitors are Sentinel One, maybe Palo Alto or Huntress, or Carbon Black.
In my opinion, CrowdStrike Falcon provides superior detection and prevention capabilities over Jamf Protect. At the time we purchased (2017) CrowdStrike Falcon was more advanced than SentinelOne and Microsoft Defender for Endpoint.
CrowdStrike Falcon is an industry leader in this sector and is superior in its low overhead agent, having minimal impact on end-users. We plan to migrate our macOS fleet when our existing contract expires.
Advance detection capability.Overwatch threat hunt team which proactively hunts your environment Interactive sandbox. Reduced false positives & ease of whitelisting to granular level.AI and ML can analyze events to identify subtle patterns that might indicate malicious …
In my opinion, CrowdStrike Falcon does a better job of detection than Carbon black in all forms. Compared to SentinelOne XDR, CrowdStrike Falcon does a better job of finding potential threats even though the machine learning based detection cause more False Positives than the …
It is superior on the following two: Advanced threat detection because AI and ML can analyze vast amounts of data to identify subtle patterns that might indicate malicious activity, even zero-day attacks (previously unknown threats).Reduced false positives because it can help …
At the time of purchase CrowdStrike provided the best featureset and value proposition for the organisation. The cloud first nature of the product and the mix of heuristic and behaviour based detection technologies was better than anything else that we looked at.
In my experience, Sentinel only works well for clients invested in azure. But the moment you step outside that ecosystem, mixing AWS , on prem and custom logs, things fall into shambles and feel fragmented
Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible …
The cost of Splunk Enterprise Security is very low as this can be hosted on private cloud. Google secops has very good UI and better log query speed and other features but cost sooo much.
The fact that it is used by many large companies was a strong reason for selecting Splunk Enterprise Security. After several demos and POCs, the teams were convinced of the value it brings: it demands the right amount of customization to fit with the company data sources. Also …
We piloted Sentinel for one of our regional logistics hubs but it struggled to handle our volume on-prem iot and telematics data cleanly. Splunk on the other hand gave us more control than its competitors
LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and …
I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some …
AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics.
These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once …
Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review …
I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for …
Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now.
Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat.
FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing.
- Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, …
Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for …
Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES …
Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and …
CrowdStrike Falcon is ideal for large, cloud-native enterprises that prioritize advanced behavioral detection and have a mature SOC to manage their intelligence. However, its cloud-reliant architecture makes it a poor fit for air-gapped or offline networks. Additionally, small organizations with limited staffing may find it difficult to manage, while teams that require integrated SOAR and vulnerability management might be discouraged by the need for additional licensing to unlock those capabilities.
Well suited: Splunk ES is highly recommended in an environment with many data sources and experienced computer engineers. It has a steep learning curve, but once that hurdle is crossed, it is absolutely a beast. It is also very expensive, so a company putting a high amount of budget in Security is needed. Not well suited: Splunk ES is not recommended if a company has only a few sources and some non-technical IT users. The price won't justify the fewer data sources and scratching just the surface level. Moreover, non-technical IT users would be better off with something that has a query builder, unlike Splunk.
Its best feature is its user interface, which is easy to navigate and understand. All you need is a little tutorial on how to use the Splunk query language and you're done.
Logs can be easily uploaded or shared across multiple platforms and display a highly insightful graphical representations of data using graphs, tables, and many other formats.
ES on the cloud (SaaS) has too many limitations with platform administration.
Supported integrations are not always on par with enterprise support especially when dependent on 3rd-party proprietary APIs.
In later versions, unforeseen glitches seem to show up that have no resolution except version upgrade. This used to not be the case in prior versions which were very stable.
Crowdstrike has a large suite of tools built for helping the engineers triage and respond to security event whenever identified. The ability to customize the security policies and implement more granular policies to different devices based on the functionality is unmatched. Crowdstrike provides so much of ability in a decent budget which ascertains the value for money or ROI.
I think it is a complete and very trustful XDR platform, with very few False Positives. It is very well supported by highly skilled professionals on all levels: from pre-sales engineers, Customer Account Managers and support engineers.
Maintaining hundreds or even 1000+ SOC use cases is really difficult, considering that the Data sources may not always send the data. A module that detects data freshness issues and detect data format changes would be a great help. the main challenge today using Splunk Enterprise Security is making sure that the detection rules are still working properly given all the changes that occur in data source applications. Also, maintaining the data collects on tens of thousands of servers and more than 100k workstations is a real company IT challenge: the splunkbase forwarder may not support old OS anymore, while these are the most important to monitor. Moving to the Open Telemetry collector has become essential so that only 1 agent is required for both SIEM and application observability.
It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up.
Support is generally pretty fast and gets right to the issue. We haven't had to use them much, fortunately, but the issues and questions we've had are usually answered quickly. The customer success manager/account manager you're assigned will also follow up with you on a regular cadence to ensure you're getting the most out of the subscription. There's not a whole lot of room to improve, other than the general confusion about what is/what is not covered in custom packages you're subscribed to. The initial purchase took much longer because of a package name changes and realignments of different modules into those packages.
It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this.
There is limited amount of learning that can be completed in an in-person training available. In my opinion, the self-paced learning provided by Falcon portal is more useful over in-person training. The support from Falcon is great and useful to overcome difficulties, if any.
I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience.
The training provided by Crowdstrike Falcon is complete in terms of the depth of technical knowledge and teaches the users about going through with the platform. There are lots of jargons for different tools that Crowdstrike Falcon has and this training teaches them all which helps in managing the platform better. Plus, the regular knowledge checks are also very helpful for the end user.
It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem.
I have evaluated Cortex XDR and SentinelOne Singularity alongside CrowdStrike Falcon, and while all three are capable enterprise-grade solutions, Falcon ultimately stood out due to its cloud-native architecture, broader modular coverage, and stronger identity-focused detection. Cortex XDR performs very well in environments already heavily invested in the Palo Alto ecosystem, particularly for network-to-endpoint correlation, but it introduces additional complexity and infrastructure overhead. SentinelOne excels in autonomous remediation and offline protection, especially with ransomware rollback, but is more endpoint-centric and comparatively limited in native identity and exposure-risk context. CrowdStrike Falcon provided the best overall balance by combining NGAV, EDR, identity protection, exposure management, threat intelligence, and managed hunting within a single lightweight agent and unified console, enabling better scalability, faster investigations, reduced tool sprawl, and stronger protection against modern identity-driven attacks, making it the most aligned choice for our security and operational objectives.
Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible choice. But if you need a performant SIEM, enjoy Splunk.
We have on prem splunk and it’s mostly east to setup, but we have issues keeping data separated between customer splunk deployments while at the same time only having to look at one SIEM to address events in every environment
Due to some of the difficulties with Support and Sales, we are likely looking to change to another vendor. We sometimes don't feel like customers.
When the bluescreen incident occurred (worldwide outage) in July 2024, we were unable to contact support due to the high volume of calls at the same time. We had to figure out how to remediate it ourselves, which we did, and recovered before the vendor's official release of fixes. It shook my confidence in them.
The product itself performed well over the last 2 years, which has kept us safe and productive. The product is good.
Swift Incident Response: ES's real-time monitoring and correlation capabilities have notably reduced our mean time to detect (MTTD) and respond (MTTR) to security incidents.
Cost Efficiency: ES streamlined operations, lowering operational costs through task automation and effective resource allocation.
Compliance Simplification: ES's robust reporting and compliance features have eased audits, reducing related costs and efforts.
