Splunk User Behavior Analytics vs. Trellix Helix

Splunk is well suited for applications with large amounts of data, and large enterprise applications. Especially if the application has interconnected modules, it helps us to analyze and monitor the application greatly.

Incentivized

Overall, we've had a great experience with FireEye Helix and would recommend it to organizations looking to improve their operational security. We've found Helix to be a great way to collect and analyze revenant security events and take action. Having a single pane of glass makes this process much more efficient. Prior to moving to FireEye Helix, we had different teams sending data to different applications, which resulted in confusion and critical data being missed.

Incentivized

• Monitor and troubleshoot for any system errors.
• Get the insights on application data sets and do some predictive analysis.

Incentivized

• Detection of advanced threats.
• Easy integration with cloud resources and our existing security tools thus enhancing performance.
• Easy deployment with great threats intelligence capabilities.

• Performance-wise, it can be improved. Queries take a long time.
• Dataset exploration - More data visualization charts can be added.

Incentivized

• Overly complex platform
• Multiple logins needed for various tools--leads to confusion
• Costs can add up

Incentivized

We've been fairly happy with FireEye Helix support overall. Most issues are resolved the same day the case is opened.

Incentivized

Easier we were using Splunk Enterprise on heavy forwarder on which all the add-on were installed and were using Splunk Cloud with respect to search head and indexers stack. And with Splunk Enterprise Security premium app, we were relying on correlation rules which were throwing more number of false positive but after implementing Splunk UBA, we are now getting real-time true positive threat or incidents.

Incentivized

It offers extensive visibility thus easy detection of threats and easy mitigation practices. Utilization of its threats intelligence capabilities thus early detection of incidents and maximization of security investments. Offers great integration of cloud resources with existing security tools thus ensuring seamless performance and all-time security for the organizational resources.

• Fewer team members to work on real threats.
• Less time required to deal with real incidents.
• Easy to implement across the network.

Incentivized

• Helix has had a significant impact on CSOC visibility efforts across the organization.
• Helix fills the logging and alerting gaps that are missing across the infrastructure side.
• Having a single pane of glass allows teams to more efficiently run incidents. Additionally, Helix is integrated with ServiceNow providing enhanced and efficient case management for all Helix alerts.

Incentivized