Splunk Enterprise Security

Splunk Enterprise Security

265 Reviews and Ratings

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
Splunk Enterprise Security	Score8.3 out of 10	N/A	Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.	N/A

Pricing

Splunk Enterprise Security

No answers on this topic

Pricing Offerings
Splunk Enterprise Security
Free Trial
No
Free/Freemium Version
No
Premium Consulting/Integration Services
No

No setup fee

—

Community Pulse
Key User Insights
	Splunk Enterprise Security
Considered Both Products	Cisco Nikhil Jhawar Product Lead in Engineering at WF (Financial Services, 10,001+ employees) Chose Splunk Enterprise Security Ranks comparably Incentivized Helpful? Verified User Chose Splunk Enterprise Security In my experience, Sentinel only works well for clients invested in azure. But the moment you step outside that ecosystem, mixing AWS , on prem and custom logs, things fall into shambles and feel fragmented Incentivized Helpful? Verified User Chose Splunk Enterprise Security Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible … Incentivized Helpful? Verified User Chose Splunk Enterprise Security The cost of Splunk Enterprise Security is very low as this can be hosted on private cloud. Google secops has very good UI and better log query speed and other features but cost sooo much. Incentivized Helpful? Saurabh Gupta Cyber Security Manager in Information Technology at Deloitte (Information Technology & Services, 10,001+ employees) Chose Splunk Enterprise Security High-fidelity analytics with machine learning and customizable correlation rules. Incentivized Helpful? Verified User Chose Splunk Enterprise Security The fact that it is used by many large companies was a strong reason for selecting Splunk Enterprise Security. After several demos and POCs, the teams were convinced of the value it brings: it demands the right amount of customization to fit with the company data sources. Also … Incentivized Helpful? Verified User Chose Splunk Enterprise Security We piloted Sentinel for one of our regional logistics hubs but it struggled to handle our volume on-prem iot and telematics data cleanly. Splunk on the other hand gave us more control than its competitors Incentivized Helpful? Verified User Chose Splunk Enterprise Security LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and … Incentivized Helpful? Sam Babbitt System/Network Administrator in Information Technology at Babbitt Access Computers (Computer & Network Security, 1-10 employees) Chose Splunk Enterprise Security Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh Incentivized Helpful? Verified User Chose Splunk Enterprise Security I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events. Incentivized Helpful? Verified User Chose Splunk Enterprise Security AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics. Incentivized Helpful? Verified User Chose Splunk Enterprise Security These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once … Incentivized Helpful? Joe Contreras Senior Security Specialist in Information Technology at San Manuel Casino (Entertainment, 5001-10,000 employees) Chose Splunk Enterprise Security Splunk is way better. Support is awesome too Incentivized Helpful? Verified User Chose Splunk Enterprise Security Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Chose Splunk Enterprise Security I believe it is definitely a leader in the security space Incentivized Helpful? Verified User Chose Splunk Enterprise Security I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now. Incentivized Helpful? Ramu S R Junior Network Administrator in Information Technology at AMRITA VISHWA VIDYAPEETHAM (Higher Education, 5001-10,000 employees) Chose Splunk Enterprise Security Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat. Incentivized Helpful? AMJITH LAL S Senior Network Administrator in Information Technology at AMRITA VISHWA VIDYAPEETHAM (Higher Education, 5001-10,000 employees) Chose Splunk Enterprise Security FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing. Incentivized Helpful? Verified User Chose Splunk Enterprise Security - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Incentivized Helpful? Saibal Banerjee Cyber Security Consultant in Professional Services at Tata Consultancy Services (Information Technology & Services, 10,001+ employees) Chose Splunk Enterprise Security Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor in Information Technology at Criterion Systems (Information Technology & Services, 1001-5000 employees) Chose Splunk Enterprise Security Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Verified User Chose Splunk Enterprise Security N/A - Have only used Splunk Enterprise Security since coming to Deloitte Incentivized Helpful?
	Would buy again
	99% Would buy again 109 Answers
	Delivers good value for the price
	94% Delivers good value for the price 90 Answers
	Happy with the feature set
	94% Happy with the feature set 103 Answers
	Lived up to sales and marketing promises
	91% Lived up to sales and marketing promises 80 Answers
	Implementation went as expected
91% Implementation went as expected 90 Answers

Features

Splunk Enterprise Security

Comparison of Security Information and Event Management (SIEM) features of Splunk Enterprise Security
Feature	Splunk Enterprise Security 8.4 107 Ratings 6% above category average
Centralized event and log data collection	7.1105 Ratings
Correlation	8.9104 Ratings
Event and log normalization/management	8.9105 Ratings
Deployment flexibility	7.9106 Ratings
Integration with Identity and Access Management Tools	8.9101 Ratings
Custom dashboards and workspaces	9.8107 Ratings
Host and network-based intrusion detection	7.9101 Ratings
Data integration/API management	7.9103 Ratings
Behavioral analytics and baselining	8.899 Ratings
Rules-based and algorithmic detection thresholds	7.9100 Ratings
Response orchestration and automation	7.992 Ratings
Reporting and compliance management	8.9100 Ratings
Incident indexing/searching	8.0106 Ratings

Best Alternatives
	Splunk Enterprise Security
Small Businesses	No answers on this topic
Medium-sized Companies	IBM Security QRadar SIEM Score8.9 out of 10
Enterprises	SolarWinds Security Event Manager (SEM) Score8 out of 10
All Alternatives	View all alternatives

User Ratings
	Splunk Enterprise Security
Likelihood to Recommend	7.1 (109 ratings)
Likelihood to Renew	9.1 (4 ratings)
Usability	7.0 (12 ratings)
Availability	9.1 (4 ratings)
Performance	7.0 (4 ratings)
Support Rating	7.3 (8 ratings)
In-Person Training	9.1 (1 ratings)
Online Training	8.2 (1 ratings)
Implementation Rating	9.1 (1 ratings)
Configurability	7.3 (1 ratings)
Contract Terms and Pricing Model	7.3 (1 ratings)
Ease of integration	6.4 (1 ratings)
Product Scalability	8.7 (98 ratings)
Professional Services	9.1 (1 ratings)
Vendor post-sale	8.2 (1 ratings)
Vendor pre-sale	8.2 (1 ratings)

User Testimonials
	Splunk Enterprise Security
Likelihood to Recommend	Cisco Based on my experience, Splunk is a strong git for some environments and a poor match for others. The distinction is primarily based on infrastructure complexity and budget. It's perfect for large enterprises with a mix of on-prem/cloud infrastructure. It's not a perfect match for small teams with restricted resources. Incentivized Verified User Read full review
Pros	Cisco Writes Powerful Queries: The queries that can be written using the Splunk Query Language are very powerful and highly customizable to meet every need. Ex: Writing queries to search the intersection of two different sources like Network and Endpoint Logs. Offers Dashboard Abilities: Helps build complex panels for Dashboards in addition to providing several out-of-the-box panels. Ex: creating panels to calculate the performance of analysts in a given timezone. Helpful Search Aids: It helps to set up complex custom alerts very easily. The interesting fields section is very helpful while threat hunting. Ex: It shows all the users and the frequency of each in a failed login event. The user list on the interesting fields is useful to look for suspicious logins. Incentivized Verified User Read full review
Cons	Cisco Improved User Interface Customization: While the interface is generally intuitive, providing more options for users to customize their dashboards and views would enhance the overall user experience. Tailoring the interface to specific roles or use cases could be a valuable addition. Simplified Alert Management: Streamlining the process of managing alerts, such as grouping or categorizing them based on severity or type, would make it easier for security teams to prioritize and respond to incidents effectively. Expanded Threat Intelligence Feeds: Increasing the variety and sources of threat intelligence feeds available within ES would provide a broader context for identifying and mitigating emerging threats, ensuring a more comprehensive defense against evolving attack vectors. Incentivized Verified User Read full review
Likelihood to Renew	Cisco We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless. Incentivized Verified User Read full review
Usability	Cisco Maintaining hundreds or even 1000+ SOC use cases is really difficult, considering that the Data sources may not always send the data. A module that detects data freshness issues and detect data format changes would be a great help. the main challenge today using Splunk Enterprise Security is making sure that the detection rules are still working properly given all the changes that occur in data source applications. Also, maintaining the data collects on tens of thousands of servers and more than 100k workstations is a real company IT challenge: the splunkbase forwarder may not support old OS anymore, while these are the most important to monitor. Moving to the Open Telemetry collector has become essential so that only 1 agent is required for both SIEM and application observability. Incentivized Verified User Read full review
Reliability and Availability	Cisco I don't think I've ever seen Splunk ES go fully offline or have any downtime greater than a few minutes on rare occasions. Incentivized Verified User Read full review
Performance	Cisco It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up. Incentivized Verified User Read full review
Support Rating	Cisco It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this. Incentivized Allan Crittenden Edwards Security Analyst Read full review
In-Person Training	Cisco I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience. Incentivized Giuseppe Cusello GRC Director Read full review
Online Training	Cisco It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem. Incentivized Giuseppe Cusello GRC Director Read full review
Implementation Rating	Cisco It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check. Incentivized Giuseppe Cusello GRC Director Read full review
Alternatives Considered	Cisco Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review all of them Incentivized Verified User Read full review
Contract Terms and Pricing Model	Cisco for my exterience, unit pricing and billing frequency are correct. As I already said, I hint to have more discount flexibility, expecially with new customers, because there are competitors less expensive and very aggressive that are dangerous. In addition the possibility to don't pay the license for the development period could be a very interesting feature for the final customers. Incentivized Giuseppe Cusello GRC Director Read full review
Scalability	Cisco - 8 out of 10 and took 2 for the data pipeline and administration part. Even if you'd like to improve yourself or your team, you have to pay a lot of money and it could be more than GIAC education + cert. - Normalization for Data models and CPU-based searches can be a problem sometimes. Incentivized Verified User Read full review
Professional Services	Cisco I had a fantastic experience with Splunk Professional Services: they worked with us in our last SON project (a SOC migration for a very large customer) and helped to build a multi tenent environment even if ES isn't a multi tenant platform. Th Splunk PS was a very professional and competent people, he is italian and was able to speak with our italian customers. Incentivized Giuseppe Cusello GRC Director Read full review
Return on Investment	Cisco We have a 100% success rate on all our ES implementations due to the amazing documentation and Splunk enablement on the subject. Our Splunk ES business has grown 100% YoY for the last 3 years. In terms of long term management and maintenance, ES has been highly stable and predictable, reducing our overhead on costly services team for ad hoc maintenance work. Verified User Read full review
ScreenShots