LogRhythm NextGen SIEM Platform vs. Splunk Enterprise Security

LogRhythm is good for providing a comprehensive view of the environment. It gives a great outline of whatever is going on in our servers and systems regarding security malfunctions. The SIEM sends real-time notifications when there are some occurrences; like creating a new user and inappropriate login attempts. It also avails a good use case that meets our HIPAA compliance.

Incentivized

Well suited: Splunk ES is highly recommended in an environment with many data sources and experienced computer engineers. It has a steep learning curve, but once that hurdle is crossed, it is absolutely a beast. It is also very expensive, so a company putting a high amount of budget in Security is needed. Not well suited: Splunk ES is not recommended if a company has only a few sources and some non-technical IT users. The price won't justify the fewer data sources and scratching just the surface level. Moreover, non-technical IT users would be better off with something that has a query builder, unlike Splunk.

Incentivized

• LogRhythm is a great SIEM to learn content on because the building blocks are very intuitive and easy to implement. All of the concepts relevant to content development are literally represented as drag and drop building blocks that can be easily manipulated.
• The statistical building blocks contain powerful anomaly detection capabilities that are extremely difficult to implement in other SIEMs or not possible at all.
• LogRhythm does better event classification than any other SIEM by far. My team typically drops all classification schemes from default installations of SIEMs and rebuilds them from scratch. I can actually use LogRhythms event classifications in rules without worrying about excessive partial matches or correlating unwanted events.

Incentivized

• Its best feature is its user interface, which is easy to navigate and understand. All you need is a little tutorial on how to use the Splunk query language and you're done.
• Logs can be easily uploaded or shared across multiple platforms and display a highly insightful graphical representations of data using graphs, tables, and many other formats.

Incentivized

• While searching for log events is quick, the interface isn't as user-friendly as other SIEM products.
• Many of the administrative/management functions are only available through the full LogRhythm desktop console, not through the web console.
• The LogRhythm agent, when used for FIM and RIM, is very memory intensive.

Incentivized

• ES on the cloud (SaaS) has too many limitations with platform administration.
• Supported integrations are not always on par with enterprise support especially when dependent on 3rd-party proprietary APIs.
• In later versions, unforeseen glitches seem to show up that have no resolution except version upgrade. This used to not be the case in prior versions which were very stable.

LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.

Incentivized

We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless.

Incentivized

LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.

Incentivized

Maintaining hundreds or even 1000+ SOC use cases is really difficult, considering that the Data sources may not always send the data. A module that detects data freshness issues and detect data format changes would be a great help. the main challenge today using Splunk Enterprise Security is making sure that the detection rules are still working properly given all the changes that occur in data source applications. Also, maintaining the data collects on tens of thousands of servers and more than 100k workstations is a real company IT challenge: the splunkbase forwarder may not support old OS anymore, while these are the most important to monitor. Moving to the Open Telemetry collector has become essential so that only 1 agent is required for both SIEM and application observability.

Incentivized

I don't think I've ever seen Splunk ES go fully offline or have any downtime greater than a few minutes on rare occasions.

Incentivized

It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up.

Incentivized

Support has always been fantastic for this product compared to many other support providers I've worked with. They are always very friendly and seem to be well trained and knowledgeable and never have to wait long for a solution. We usually get the issue fixed in the first call, but also we really haven't had to use support a ton so that's also a plus

Incentivized

It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this.

Incentivized

I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience.

Incentivized

It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem.

Incentivized

• Buy professional services.
• Buy and implement the system if possible.
• Remember that the end point log configuration may require other teams in your company to assist you in getting the desired logs from all resources.
• Attend the end user and daily operations training after a period of usage so you are not overwhelmed with information on concepts not yet seen.
• Don't be afraid to call for help during your first months of use.
• Don't close any ticket until you are sure the expected results are verified.
• Use the community forums to discuss issues with your peers.
• Watch the training videos offered by L R University.

Incentivized

It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check.

Incentivized

I think Logrhythm still has a lot of work to do to catch up with competitors in many areas. They need to improve their design cycle, with a cycle that's completely focused on bug fixing and reliability, without introducing any new features to improve the system's overall reliability. They also need to improve their API, as now all security solutions should talk very well with each other, which APIs can enable.

Incentivized

Before Splunk, we ran Elastic Security for our log aggregation and alerting platform. Unfortunately, the solution was not a good fit for many logs and mixed on-prem/cloud infrastructure, as our. For cost or small infrastructure, Elastic is a very good, strong, and credible choice. But if you need a performant SIEM, enjoy Splunk.

Incentivized

We have on prem splunk and it’s mostly east to setup, but we have issues keeping data separated between customer splunk deployments while at the same time only having to look at one SIEM to address events in every environment

Incentivized

• One of the positive impacts that we experienced from LogRhythm NextGen SIEM Platform is the Dynamic Alarming System. It shows the recent tickets, and we know what exactly to prioritize at the start of the day.
• The search tool also helped us trace back wireless users by log correlation that we almost gave up our hope for.
• A slightly negative impact that can be featured it relying too much on it. We have been a victim of a false alarm and went on a completely wrong direction until we tallied with the Log source and found the problem. It is good, but we must correspond against the log source to be confirmed.

Incentivized

• Swift Incident Response: ES's real-time monitoring and correlation capabilities have notably reduced our mean time to detect (MTTD) and respond (MTTR) to security incidents.
• Cost Efficiency: ES streamlined operations, lowering operational costs through task automation and effective resource allocation.
• Compliance Simplification: ES's robust reporting and compliance features have eased audits, reducing related costs and efforts.

Incentivized