Splunk Enterprise Security

Score8.4 out of 10

266 Reviews and Ratings

What is Splunk Enterprise Security?

Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.

Categories & Use Cases

Videos

Custom dashboards and workspaces
dashboards that can be customized to meet the needs of specific groups
Category average: 8.7
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Category average: 8.7
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Category average: 8.6

Data integration/API management
Ease and quality of data integrations between SIEM and other systems
Category average: 8.3
Rules-based and algorithmic detection thresholds
Effectiveness of manually-established rules and algorithmically-determined detection thresholds
Category average: 8.3
Deployment flexibility
Ability to tune system to maximize threat detection and minimize false positives
Category average: 7.8

Most Frequent Users

Top 3 industries using Splunk Enterprise Security.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

26.7%

455 installations of 1,703

#2 most frequent

Finance and Insurance

11.2%

190 installations of 1,703

#3 most frequent

Information

11.2%

190 installations of 1,703

Pros

Robust log management and ingestion capabilities
Centralization, normalization, and visualization of diverse logs
Strong correlation and detection functionalities

Cons

Difficulty with data onboarding and Common Information Model (CIM) mapping
High complexity and steep learning curve for users
Significant deployment and ongoing maintenance overhead

Rachel Kemp

Systems engineer in Information Technology at Health Ridge (51-200 employees)

Use Cases and Deployment Scope

We have multiple servers, networks, apps, and endpoints generating loads of logs. We deployed Splunk Enterprise Security to monitor activity across our framework and correlate the logs. It investigates unusual system behavior, troubleshoots, and traces incidents back to their source. We don't have to be on call; everything is centralized, and it's easy to spot patterns and respond to vulnerabilities.

Pros

Its ability to ingest and analyze data from whichever sources.
With threat intelligence, we are not overwhelmed by alerts, and we still get the important ones.
Unity. Everything from threat detection to response and incident management is all in a single platform.

Cons

The learning curve, for sure.

Return on Investment

An improved security posture. Everything is centralized: from threat detection to mitigation, everything lives on a single platform.
The alerts have high sensitivity, so we seldom have false positives, and they have saved resources.

Usability

Other Software Used

Atlassian Jira, Splunk SOAR, Slack

Nikhil Jhawar

Product Lead in Engineering at WF (10,001+ employees)

Use Cases and Deployment Scope

In our organization, we use Splunk Enterprise Security for Large financial enterprise SOC (security operations system) leveraging ES (enterprise security) to run SecOps

Pros

Large telemetry logging
correlation

Cons

I think scalability has room for improvement in Splunk Enterprise Security
I think buit-in agentic capability has room for improvement in Splunk Enterprise Security

Return on Investment

Good dashboarding but flaky performance
expensive from a ROI perspective

Usability

Alternatives Considered

SecOps Solution and Chronicle Cloud

Verified User

Engineer in Engineering (1001-5000 employees)

Use Cases and Deployment Scope

We deployed Cisco Splunk as a central SIEM to consolidate all of our logs from different vendors (Palo Alto, Fortinet, Aruba, Red Hat, Check Point...). Before Splunk, our analysts were juggling multiple disconnected tools across many dashboards and logs. Splunk fits our needs perfectly with real-time logging and alerting to prioritize incidents.

Pros

Risk alerting.
SOAR integration.
Threat management.
Ecosystem

Cons

Costs and license.
Onprem integration.
Out of the box detection.

Return on Investment

Tools consolidated.
False positive rate.
MTTD reduction.

Usability

Alternatives Considered

Kibana

Other Software Used

CheckPoint, Juniper 7000, Fortinet FortiGate

Verified User

Engineer in Information Technology (10,001+ employees)

Use Cases and Deployment Scope

I'm a security analyst and my bau task is to triage and investigate incidents. To investigate the security incidents, I depends on logs and to query logs we use Splunk Enterprise Security. Almost all the device, software, services push logs into the SIEM and we query then on demand basis. Splunk Enterprise Security helped my company to store, query the logs mainly. We also use it to run a analytical query on the logs to search anamolies.

Pros

Splunk Enterprise Security is really good in storing logs from all the different system and services.
Splunk Enterprise Security provides a really good interface to query logs and analytics
Splunk Enterprise Security is really good in creating and managing analytical rule which is used for creating detections.

Cons

The search speed is slow as compared to other solutions
Although UI is significantly improved recently but it has a room for improvment.

Return on Investment

Splunk Enterprise Security query is slow when searching for very large amount of logs this can pump or SLA for resolving security alerts, As we need to query logs multiple times.

Usability

Alternatives Considered

Google Security Operations

Other Software Used

CrowdStrike Falcon, Jamf Connect, PingOne from Ping Identity

Saurabh Gupta View profile

Cyber Security Manager in Information Technology at Deloitte (10,001+ employees)

Use Cases and Deployment Scope

In our organization, Splunk Enterprise Security (ES) is the central Security Information and Event Management (SIEM) platform that consolidates telemetry across the enterprise, spanning network infrastructure, cloud services, endpoints, Kubernetes environments, identity systems, and critical applications. As part of the Cisco family, Splunk continues to evolve with deep integrations into Cisco threat intelligence (e.g., Talos) and network telemetry, enhancing both detection fidelity and operational efficiency.

Pros

Centralized Log & Event Aggregation.
Compliance & Reporting.
Threat Visibility Across the Enterprise.
Scalability for Global Growth.

Cons

Complexity and learning curve.
Deployment Overhead.

Return on Investment

Cost and licensing.

Usability

Alternatives Considered

Arcsight by OpenText

Other Software Used

Cisco Secure Network Analytics, Cisco Catalyst Center, SDWAN|Link

IBM Security QRadar SIEM

LogRhythm NextGen SIEM Platform

Securonix Next-Generation SIEM

Splunk Enterprise Security

What is Splunk Enterprise Security?

Categories & Use Cases

Videos