Splunk Enterprise Security (ES)

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
Splunk Enterprise Security (ES)	Score 8.4 out of 10	N/A	Splunk Enterprise Security (SIEM) is the company's flagship SIEM product, offered as a premium service to subscribers of Splunk Cloud or Splunk Enterprise.	N/A

Pricing

Editions & Modules

No answers on this topic

Offerings

Pricing Offerings
Splunk Enterprise Security (ES)
Free Trial
No
Free/Freemium Version
No
Premium Consulting/Integration Services
No

Entry-level Setup Fee

No setup fee

Additional Details

—

More Pricing Information

Community Pulse
	Splunk Enterprise Security (ES)
Considered Both Products	Splunk Enterprise Security (ES) Verified User Engineer Chose Splunk Enterprise Security (ES) LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and … Incentivized Helpful? Sam Babbitt System/Network Administrator Chose Splunk Enterprise Security (ES) Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh Incentivized Helpful? Verified User Analyst Chose Splunk Enterprise Security (ES) I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some … Incentivized Helpful? Verified User Professional Chose Splunk Enterprise Security (ES) Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events. Incentivized Helpful? Verified User Manager Chose Splunk Enterprise Security (ES) AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics. Incentivized Helpful? Verified User Team Lead Chose Splunk Enterprise Security (ES) These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once … Incentivized Helpful? JC Joe Contreras Senior Security Specialist Chose Splunk Enterprise Security (ES) Splunk is way better. Support is awesome too Incentivized Helpful? Verified User Engineer Chose Splunk Enterprise Security (ES) Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Administrator Chose Splunk Enterprise Security (ES) I believe it is definitely a leader in the security space Incentivized Helpful? Verified User Professional Chose Splunk Enterprise Security (ES) It’s easy to understand and simple to implement Incentivized Helpful? Verified User Professional Chose Splunk Enterprise Security (ES) I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for … Helpful? Verified User Professional Chose Splunk Enterprise Security (ES) Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now. Incentivized Helpful? Giuseppe Cusello GRC Director Chose Splunk Enterprise Security (ES) I performed a migration from RSA SA and I found that ES is very easier to implement new Correlation Searches. Incentivized Helpful? Verified User Engineer Chose Splunk Enterprise Security (ES) - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Ramu S R Junior Network Administrator Chose Splunk Enterprise Security (ES) Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat. Incentivized Helpful? AMJITH LAL S Senior Network Administrator Chose Splunk Enterprise Security (ES) FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing. Incentivized Helpful? Verified User Analyst Chose Splunk Enterprise Security (ES) Splunk does not hide its correlation and analytics logic from users as much as other solutions in the same space. While some features are harder to access the underlying information is all accessible and tunable. This gives Splunk an edge over other solutions that lock the … Incentivized Helpful? Verified User Vice-President Chose Splunk Enterprise Security (ES) Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Helpful? Saibal Banerjee Cyber Security Consultant Chose Splunk Enterprise Security (ES) Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor Chose Splunk Enterprise Security (ES) Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Ernesto J. Meléndez Sr. Security Engineer Chose Splunk Enterprise Security (ES) All Splunk products are easy to integrate, and they collaborate in the security of our organization. Incentivized Helpful? Verified User Administrator Chose Splunk Enterprise Security (ES) N/A - Have only used Splunk Enterprise Security since coming to Deloitte Incentivized Helpful? Verified User Analyst Chose Splunk Enterprise Security (ES) LogRhythm is a superior SIEM from a purely security/SOC perspective in my opinion. However, Splunk shines if you have an expert behind the wheel or if the organization is quite large - as my experience with LogRhythm indicated it couldn't handle large-size organizations. Incentivized Helpful? Shilpi Jain Intermediate Enterprise Support Analyst Chose Splunk Enterprise Security (ES) We have both of these instances in our organization. Incentivized Helpful?

Features

Splunk Enterprise Security (ES)

Security Information and Event Management (SIEM)

Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
	Splunk Enterprise Security (ES) 8.5 102 Ratings 8% above category average
Centralized event and log data collection	9.3100 Ratings
Correlation	8.899 Ratings
Event and log normalization/management	8.5100 Ratings
Deployment flexibility	8.3101 Ratings
Integration with Identity and Access Management Tools	8.096 Ratings
Custom dashboards and workspaces	9.1102 Ratings
Host and network-based intrusion detection	8.396 Ratings
Data integration/API management	8.498 Ratings
Behavioral analytics and baselining	7.995 Ratings
Rules-based and algorithmic detection thresholds	8.796 Ratings
Response orchestration and automation	7.487 Ratings
Reporting and compliance management	9.195 Ratings
Incident indexing/searching	8.8101 Ratings

Best Alternatives
	Splunk Enterprise Security (ES)
Small Businesses	AlienVault USM Score 8.0 out of 10
Medium-sized Companies	InsightIDR Score 8.6 out of 10
Enterprises	Microsoft Sentinel Score 8.4 out of 10
All Alternatives	View all alternatives

User Ratings
	Splunk Enterprise Security (ES)
Likelihood to Recommend	9.0 (103 ratings)
Likelihood to Renew	8.9 (3 ratings)
Usability	7.6 (2 ratings)
Availability	9.1 (1 ratings)
Performance	8.2 (1 ratings)
Support Rating	6.6 (6 ratings)
In-Person Training	9.1 (1 ratings)
Online Training	8.2 (1 ratings)
Implementation Rating	9.1 (1 ratings)
Configurability	7.3 (1 ratings)
Contract Terms and Pricing Model	7.3 (1 ratings)
Ease of integration	6.4 (1 ratings)
Product Scalability	9.3 (100 ratings)
Professional Services	9.1 (1 ratings)
Vendor post-sale	8.2 (1 ratings)
Vendor pre-sale	8.2 (1 ratings)

User Testimonials
	Splunk Enterprise Security (ES)
Likelihood to Recommend	Splunk Well suited: Splunk ES is highly recommended in an environment with many data sources and experienced computer engineers. It has a steep learning curve, but once that hurdle is crossed, it is absolutely a beast. It is also very expensive, so a company putting a high amount of budget in Security is needed. Not well suited: Splunk ES is not recommended if a company has only a few sources and some non-technical IT users. The price won't justify the fewer data sources and scratching just the surface level. Moreover, non-technical IT users would be better off with something that has a query builder, unlike Splunk. Incentivized Verified User Anonymous Read full review
Pros	Splunk Advanced Threat Detection and Correlation: ES stands out in its ability to detect sophisticated threats by correlating data from multiple sources. For instance, it can identify unusual patterns in user behavior, cross-referencing with network logs to flag potential insider threats. Real-time Monitoring and Alerting: ES offers robust real-time monitoring capabilities. It excels in promptly alerting us to critical security events, such as suspicious network traffic spikes or unauthorized access attempts, allowing for immediate response. Comprehensive Log Analysis: ES ingests and analyzes an extensive range of log data. It's particularly adept at parsing and making sense of complex log formats, making it a versatile tool for understanding system activities and security events. Incentivized Verified User Anonymous Read full review
Cons	Splunk ES on the cloud (SaaS) has too many limitations with platform administration. Supported integrations are not always on par with enterprise support especially when dependent on 3rd-party proprietary APIs. In later versions, unforeseen glitches seem to show up that have no resolution except version upgrade. This used to not be the case in prior versions which were very stable. Verified User Anonymous Read full review
Likelihood to Renew	Splunk We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless. Incentivized Verified User Anonymous Read full review
Usability	Splunk You definitely need to learn how to use Splunk to get the most of the tool. There are many courses available for free to get up to speed on the usability of the tool but it's not that simple. It will take time to digest all the data and to understand how to query for what you are looking for. Incentivized Verified User Anonymous Read full review
Reliability and Availability	Splunk I'm not an ES user, but, in my implementation I usually try to prevent all service stops to guarantee High availability to the final customers. Incentivized Giuseppe Cusello GRC Director Read full review
Performance	Splunk ES requires a very performant infrastructure: if it has it's performant, otherwise not. I had situation with a very performant infrastructure and I didn't notized that it was a distributed architecture, it seemed that there ware few data on my PC, othewise I experienced less performant infrastructures with less performaces. Incentivized Giuseppe Cusello GRC Director Read full review
Support Rating	Splunk It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this. Incentivized AE Allan Crittenden Edwards Security Analyst Read full review
In-Person Training	Splunk I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience. Incentivized Giuseppe Cusello GRC Director Read full review
Online Training	Splunk It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem. Incentivized Giuseppe Cusello GRC Director Read full review
Implementation Rating	Splunk It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check. Incentivized Giuseppe Cusello GRC Director Read full review
Alternatives Considered	Splunk Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review all of them Incentivized Verified User Anonymous Read full review
Contract Terms and Pricing Model	Splunk for my exterience, unit pricing and billing frequency are correct. As I already said, I hint to have more discount flexibility, expecially with new customers, because there are competitors less expensive and very aggressive that are dangerous. In addition the possibility to don't pay the license for the development period could be a very interesting feature for the final customers. Incentivized Giuseppe Cusello GRC Director Read full review
Scalability	Splunk - 8 out of 10 and took 2 for the data pipeline and administration part. Even if you'd like to improve yourself or your team, you have to pay a lot of money and it could be more than GIAC education + cert. - Normalization for Data models and CPU-based searches can be a problem sometimes. Incentivized Verified User Anonymous Read full review
Professional Services	Splunk I had a fantastic experience with Splunk Professional Services: they worked with us in our last SON project (a SOC migration for a very large customer) and helped to build a multi tenent environment even if ES isn't a multi tenant platform. Th Splunk PS was a very professional and competent people, he is italian and was able to speak with our italian customers. Incentivized Giuseppe Cusello GRC Director Read full review
Return on Investment	Splunk ES has highly impacted ROI because as the customer of the ES the work we do for creating use cases for clients in terms of security-related aspects by their logs has given more return than investment. The correlation searches we run to get detailed results from the Data models are very less time-consuming than Splunk Enterprise itself we can get quick responses to the use cases and dashboards populated because of ES. The CIM compliance feature is ES has made more jobs easy in the terms of finding more Authentication related data we can get data onboarded in the Email data model from O365 and search is email data model instead of searching for particular indexes. Incentivized Verified User Anonymous Read full review
ScreenShots