Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.
N/A
Spotfire
Score7.8 out of 10
N/A
Spotfire, formerly known as TIBCO Spotfire, is a visual data science platform that combines visual analytics, data science, and data wrangling, so users can analyze data at-rest and at-scale to solve complex industry-specific problems.
N/A
Pricing
Splunk Enterprise Security
Spotfire
Editions & Modules
No answers on this topic
No answers on this topic
Offerings
Pricing Offerings
Splunk Enterprise Security
Spotfire
Free Trial
No
Yes
Free/Freemium Version
No
No
Premium Consulting/Integration Services
No
Yes
Entry-level Setup Fee
No setup fee
No setup fee
Additional Details
—
For Enterprise engagements, contact Spotfire directly for a custom price quote.
Splunk ES is great for organizations with complex IT environments, and real-time visibility into their infrastructure is critical. We use it as the central platform to sort through alerts, run diagnostics, and respond to incidents. We have integrated it with SOAR and automations; both help keep our security posture up to date.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A high level of data integration is available here it supports various data sources and so on. Collaborating features allow users to give access to the dashboard and merge data analytics with other team members. It can meet the demands of both small and large size business enterprises. A customized dashboard and reports are provided to meet the specific needs and get support of extensibility through APIs and customized scripts.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Writes Powerful Queries: The queries that can be written using the Splunk Query Language are very powerful and highly customizable to meet every need. Ex: Writing queries to search the intersection of two different sources like Network and Endpoint Logs.
Offers Dashboard Abilities: Helps build complex panels for Dashboards in addition to providing several out-of-the-box panels. Ex: creating panels to calculate the performance of analysts in a given timezone.
Helpful Search Aids: It helps to set up complex custom alerts very easily. The interesting fields section is very helpful while threat hunting. Ex: It shows all the users and the frequency of each in a failed login event. The user list on the interesting fields is useful to look for suspicious logins.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Improved User Interface Customization: While the interface is generally intuitive, providing more options for users to customize their dashboards and views would enhance the overall user experience. Tailoring the interface to specific roles or use cases could be a valuable addition.
Simplified Alert Management: Streamlining the process of managing alerts, such as grouping or categorizing them based on severity or type, would make it easier for security teams to prioritize and respond to incidents effectively.
Expanded Threat Intelligence Feeds: Increasing the variety and sources of threat intelligence feeds available within ES would provide a broader context for identifying and mitigating emerging threats, ensuring a more comprehensive defense against evolving attack vectors.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The donut chart is I guess a powerful illustrations but I hope it should be done quite simple in Spotfire. But in Spotfire there are lots of steps involve just to build a simple donut chart.
Table calculation (like Row or Column Differences) should be made simple or there should be drag and drop function for Table Calculation. No need for scripting.
Information Link should be changed. If new columns are added to the table just refreshing the data should be able to capture the new column. No need extra step to add column
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
-Easy to distribute information throughout the enterprise using the webplayer. -Ad hoc analysis is possible throughout the enterprise using business author in the webplayer or the thick client. -Low level of support needed by IT team. Access interfaces with LDAP and numerous other authentication methods. -Possible to continually extend the platform with JavaScript, R scripts, HTML, and custom extensions. -Ability to standardize data logic through pre-built queries in the Information Designer. Everyone in the enterprise is using the same logic -Tagging and bookmarking data allows for quick sharing of insights. -Integration with numerous data sources... flat files, data bases, big data, images, etc. -Much improved mapping capability. Also includes the ability to apply data points over any image.
I gave it a 6/10 because it's a perfect tool for experienced Splunk users. It's very difficult to add people to the Splunk team due to the complexity of the solutions. It took weeks to write useful SPL queries and even more time to be independent of the solution.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Basic tasks like generating meaningful information from large sets of raw data are very easy. The next step of linking to multiple live data sources and linking those tables and performing on the fly analysis of the imported data is understandably more difficult.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Even though, it's a rather stable and predictable tool that's also fast, it does have some bugs and inconsistencies that shut down the system. Depending on the details, it could happen as often as 2-3 times a week, especially during the development period.
It takes a long time for items to load if you are just generally searching through logs. It is best to use the data models which load faster but can be strange in terms of what is coming from which logs where. Yes, you can look it up, but this also requires familiarity with where things are and how to look them up.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Generally, the Spotfire client runs with very good performance. There are factors that could affect performance, but normally has to do with loading large analysis files from the library if the database is located some distance away and your global network is not optimal. Once you have your data table(s) loaded in the client application, usually the application is quite good performance-wise.
It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Support has been helpful with issues. Support seems to know their product and its capabilities. It would also seem that they have a good sense of the context of the problem; where we are going with this issue and what we want the end outcome to be.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The instructor was very in depth and provided relevant training to business users on how to create visualizations. They showed us how to alter settings and filter views, and provided resources for future questions. However, the instructor failed to cover data sources, connecting to data, etc. While it was helpful to see how users can use the data to create reports, they failed to properly instruct us on how to get the dataset in to begin with. We are still trying to figure out connections to certain databases (we have multiple different types).
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The online training is good, provides a good base of knowledge. The video demonstrations were well-done and easy to follow along. Provided exercises are good as well, but I think there could be more challenging exercises. The training has also gone up in price significantly in the last 3 years (in USD, which hurts us even more in Canada), and I'm not sure it is worth the money it now costs (it is worth how much it cost 3 years ago, but not double that.)
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The original architecture I created for our implementation had only a particular set of internal business units in mind. Over the years, Spotfire gained in popularity in our company and was being utilized across many more business units. Soon, its usage went beyond what the original architectural implementation could provide. We've since learned about how the product is used by the different teams and are currently in the middle of rolling out a new architecture. I suggest:
Have clearly defined service level agreements with all the teams that will use Spotfire. Your business intelligence group might only need availability during normal working hours, but your production support group might need 24/7 availability. If these groups share one Spotfire server, maintenance of that server might be a problem.
Know the different types of data you will be working with. One group might be working with "public" data while another group might work with sensitive data. Design your Library accordingly and with the proper permissions.
Know the roles of the users of Spotfire. Will there only be a small set of report writers or does everyone have write access to the Library?
ALWAYS add a timestamp prompt to your reports. You don't want multiple users opening a report that will try and pull down millions of rows of data to their local workstations. Another option, of course, is to just hard code a time range in the backing database view (i.e. where activity_date >= sysdate - 90, etc.), but I'd rather educate/train the user base if possible.
This probably goes without saying, but if possible, point to a separate reporting database or a logical standby database. You don't want the company pounding on your primaries and take down your order system.
Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review all of them
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Spotfire is significantly ahead of both products from an ETL and data ingestion capability. Spotfire also has substantially better visualizations than Power BI, and although the native visualizations aren't as flexible in Tableau, Spotfire enables users to create completely custom javascript visaualizations, which neither Tableau or Power BI has. Tableau and Power BI are likely only superior to Spotfire with respect to embedded analysis on a website.
for my exterience, unit pricing and billing frequency are correct. As I already said, I hint to have more discount flexibility, expecially with new customers, because there are competitors less expensive and very aggressive that are dangerous. In addition the possibility to don't pay the license for the development period could be a very interesting feature for the final customers.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
- 8 out of 10 and took 2 for the data pipeline and administration part. Even if you'd like to improve yourself or your team, you have to pay a lot of money and it could be more than GIAC education + cert. - Normalization for Data models and CPU-based searches can be a problem sometimes.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
In an enterprise architecture, if Spotfire Advanced Data services(Composite Studio),data marts can be managed optimally and scalability in a data perspective is great. As the web player/consumer is directly proportional to RAM, if the enterprise can handle RAM requirement accomodating fail over mechanisms appropraitely, it is definitely scalable,
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
I had a fantastic experience with Splunk Professional Services: they worked with us in our last SON project (a SOC migration for a very large customer) and helped to build a multi tenent environment even if ES isn't a multi tenant platform. Th Splunk PS was a very professional and competent people, he is italian and was able to speak with our italian customers.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
We have a 100% success rate on all our ES implementations due to the amazing documentation and Splunk enablement on the subject.
Our Splunk ES business has grown 100% YoY for the last 3 years.
In terms of long term management and maintenance, ES has been highly stable and predictable, reducing our overhead on costly services team for ad hoc maintenance work.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
