ExtraHop Reveal(x) vs. Splunk User Behavior Analytics

ExtraHop is a must have for on-premise environments where traffic passes through a physical data centre or network operations centre giving complete visibility into what is happening on the corporate network. This works flawlessly if business operations are in office. For hybrid or remote setups, the solution still works well by placing ExtraHop traffic between the VPN termination and firewall and setting up a span port. ExtraHop works well for cloud based deployments as well with their virtual appliances; however, it does not have the same edge against competition as many CNAPP solutions can gather similar data using graph API's provided by the cloud service provider. That said, ExtraHop does provide some unique features that CNAPP's do not around network operations.

Incentivized

Splunk is well suited for applications with large amounts of data, and large enterprise applications. Especially if the application has interconnected modules, it helps us to analyze and monitor the application greatly.

Incentivized

• Network discovery
• Network based detections for suspicious/malicious activity and behaviour
• Insight into data flow between systems
• Visibility into network errors

Incentivized

• Monitor and troubleshoot for any system errors.
• Get the insights on application data sets and do some predictive analysis.

Incentivized

• Performance-wise, it can be improved. Queries take a long time.
• Dataset exploration - More data visualization charts can be added.

Incentivized

Console is easy to use use and familiarize oneself with. Some points deducted as it can be annoying at times to have to drill down using the drop down menu, and then selecting tabs to get the data you want.

Incentivized

I evaluated ExtraHop against Dark Trace. Against all criteria, ExtraHop had a clear edge including visibility, price, effectiveness, integrations, and more.

Incentivized

Easier we were using Splunk Enterprise on heavy forwarder on which all the add-on were installed and were using Splunk Cloud with respect to search head and indexers stack. And with Splunk Enterprise Security premium app, we were relying on correlation rules which were throwing more number of false positive but after implementing Splunk UBA, we are now getting real-time true positive threat or incidents.

Incentivized

• Increased visibility into network based attacks
• Increase visibility into data flows aiding in data loss prevention capabilities
• Assisting network infrastructure teams with visibility into network based performance metrics

Incentivized

• Fewer team members to work on real threats.
• Less time required to deal with real incidents.
• Easy to implement across the network.

Incentivized