Darktrace AI interrupts in-progress cyber-attacks, including ransomware, email phishing, and threats to cloud environments. It's able to detect and establish baselines for your organization so it can make the distinction between what is and what isn't normal network activity for your organization. This allows it to tackle complex cyber-attacks as they happen and prevent future cyber-attacks from happening.
N/A
Splunk Enterprise
Score 8.6 out of 10
N/A
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.
Darktrace does a very good job at complementing our other security tools by adding an additional level of automated security. It is important to point out that the automation is optional. We ran Darktrace in "manual" mode until we were comfortable enough to switch it to a …
Its capabilities to respond to a threat both manual than automated way makes Darktrace one of the best NDR in the market. The rules editor allows the right flexibility to build a set of rules sized for the infrastructure, while the third parties integrations and modules helps …
The product's capacity to provide insights into network traffic is impressive. The organisation was able to find any malware harming the devices with their assistance. We really value network monitoring and self-learning monitoring tools.
We looked into several competitors and are still looking, due to the problems Darktrace has with false positives. Darktrace is attractive as their support is generally good, and working with the product is relatively easy.
We did NOT select Darktrace. OSSIM/AlienVault is a more mature product and it provided better intelligence and reporting. The end user interface is much easier to use - and you can tell built form engineers who have had to do the work. My suggestion for anyone considering …
Splunk could sort a much better log correlation than it competitors. dynatrace have better dashboards, but its harder to setup and in our case, way too expensive. with Splunk, no one regrets migrating from Qradar. it looks like different generations tools. the correlation is …
Splunk Enterprise has been a well-established solution for many clients for a long time and is a major player in the market. Its track record and performance make it the best choice. Furthermore, its ease of use for developing, using, and managing data makes it the best among …
Splunk Enterprise stands out compared to other solutions due to its broad compatibility and flexibility. It integrates easily with a wide range of infrastructure, network, security, and application products, thanks to its support for multiple data formats and its extensive …
Splunk is the undisputed leader in Security Information and Event Management. Splunk Enterprise Security allows for massive, complex correlation of data across disparate sources. It can be deployed entirely on-premise or in a private cloud, giving total "data sovereignty." …
Splunk Enterprise stacks similarly to IBM's qradar and outperforms both Palo Alto's Panorama and Cisco's Secure Firewall Management Center in regards to storing large amounts of logs and the ability for quick searches. Splunk Enterprise handles queries of data effectively and …
Splunk Enterprise is a very seasoned software , while other comparable software keep on adding new features and keep evolving, Splunk Enterprise has reached a state where new user onboarded doesnt have to request any basic feature or develop modules to simple tasks. Log parsing …
Splunk does a good job at log aggregation and compatibility however, integrations with other products is been a challenge. Especially the pricing can be more competitive to spice up the market and orgs looking to explore AI based logging over traditional practices.
Able to show more than Log data in Splunk views, we tested several plug-ins during a small pilot, and we were able to bring O/S (Win/Unix/Linux) & APM data metrics into the same views as Logged data. I've seen others use it to visualize a wider range of data types, too...better …
While both are market-leading SIEM platforms, they cater to different environments and organization priorities. The choice often comes down to a company's existing infrastructure, integration needs, and long-term security strategy. Deployment and architecture - Splunk offeres …
Splunk features of storing data and ingestion of logs , indexing of data , data analytics make is superior to other tools. Definately there is more improvement requirement in terms of visualisation of data but one stop for all features make splunk better than various other …
Splunk Enterprise was already chosen by our organization to be used across teams. However, the reasoning I know behind is the ability to share events/messages across different message brokers and making onboarding easier to legacy teams by just simple configuration.
Splunk was better in terms of analyzing unstructured data. Also Splunk has had a very good and strong community and is also has a more tried and tested performance. I personally found the dash boarding capability of Splunk better than datadog.
Omnibus was a Linux based tool. Not very easy to sue. End user needs to know Linux commands. Splunk Enterprise is more flexible and ease to use. Splunk Enterprise can generate reports, graphs, data visualization, data validation and much more. Use friendly query language and …
A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be …
Elastic and it's a little bit more cumbersome and a little bit more time consuming. Using Splunk is much easier flow and quicker to utilize to get to the root of a problem.
Cost was major factor which made us choose Splunk Enterprisek. Splunk Enterprise is versatile tool which further helped us to make our decision. Apart from that Managment wish to use something robust hence Splunk Enterprise became there first choice.
Splunk Enterprise is honestly the first tool we used and we cant realistically switch. We have not done any in depth studies or comparisons. We know there are alternatives and we would probably switch if one of them was much more economically viable, but right now we are happy …
Darktrace would be well suited to any environment really; the only constraint would be the budget. The cost scales on the number of devices to be monitored by the product, so it can be quite expensive in larger environments. Any company that would benefit from having 24/7 monitoring of their network would find that this product would suit that need perfectly. It can also create a number of reports, which is useful if you have any requirement to present periodic figures and statistics for your network. There are also additional features available and in development such as Antigena, which can be configured to allow potential threats to be automatically mitigated; it can block connections to a certain address, using certain ports, or it can enforce "normal behaviour" where it will only allow a machine to communicate in a way that Darktrace has observed before and considers normal. This has huge benefits particularly for 24/7 organisations where you don't have the ability to have someone monitoring the network personally at all times, as it could stop a malware outbreak in its tracks.
I'm liking the newer products, and I'm looking forward to how they integrate with the overall product when they come together. Just log in and be able to query a large number of systems for similar issues or a unique one. That is a great fit for Splunk Enterprise, looking for a simple case or a simple String or something of that nature across multiple machines. It's a great fit for that to identify issues or particular software, whatever your scenario is, String, to find it across any particular server or group of servers, so that you can update or do a deployment or whatever it is you're looking to do.
Uses it Al model UEBA to detect anomalies in the behaviour of not only the users in a corporate network but also the routers, servers, and endpoints in that network.
Provides a visualisation of both egress and outbound network traffics flowing in and out of the organisation.
Darktrace comes with it autonomous AI model detection and responses capabilities.
Darktrace as an AI next generation NDR solution, prevents ,contains and quarantines malicious traffics from and into the corporate network.
We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.
The Darktrace toolset is very expansive, allowing it to handle many different tasks, but this leads to a user interface that is sometimes not at all intuitive. Icons don't always make sense visually, and the associated tool tips do not always provide enough detail on what action the button performs
Splunk usability could be a little more friendly on correlations and log analysis. not for end users, but for the tech team, sometimes is hard to find good professionals to set up integrations and new dashboards when needed. For the high-level management, it can be overwhelming to read Splunk dashboards.
Darktrace support is excellent in my experience. They send a competent engineer on-site to provide on-boarding training. They were also very responsive in responding to questions and concerns. Having an individual point of contact who is a competent network and security engineer is not a common experience, at least for me.
Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method.
The online course was simple clear and described the main capabilities of the solution. There is also an initial module that can be done for free so anyone can familiarize themselves with the functionality of this solution. On the other hand, however, there could be more free online courses. Maybe even with a certificate, this would broaden the group of people who are familiar with the platform while increasing familiarity with the solution itself.
We did NOT select Darktrace. OSSIM/AlienVault is a more mature product and it provided better intelligence and reporting. The end user interface is much easier to use - and you can tell built form engineers who have had to do the work. My suggestion for anyone considering Darktrace, is to get the price upfront; do a 30/60 onsite trail; and do the same thing, at the same time, with AlienVault. AlientVault will win every time. I say that because that's exactly what I did.
A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be anything from the native logging that you find in other Cisco products. It's easier to use Splunk to draw the data that you're looking for as opposed to going to the individual's products themselves to get the logs that you're looking for.
One big positive is how it helps us with the security assessments that clients have done on us. They are looking to see if we know how we might have unusual/malicious traffic running on the network.
If you have a small network and only need 1 appliance, it can be a good ROI and peace of mind.
You could go down a hole in trying to spend time looking at all of your traffic with this software. You need to focus only on what it is showing as potential bad traffic.
Generation of metrics against compromised accounts based on location and time of the year. It helped in launching phishing education campaign before hitting the most vulnerable month of the year.
It helped in neutralizing vulnerable word-press sites across the campus, leading to the decrease of account compromise.
