The Power of Splunk Enterprise.
We use Splunk Enterprise in our Organization to achieve the following. Consolidate logs from all sources in one place. Create Custom …
Splunk Enterprise Security (ES)
Overview
What is Splunk Enterprise Security (ES)?
Splunk Enterprise Security (SIEM) is the company's flagship SIEM product, offered as a premium service to subscribers of Splunk Cloud or Splunk Enterprise.
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (100)9.393%
- Custom dashboards and workspaces (102)9.191%
- Incident indexing/searching (101)8.787%
- Deployment flexibility (101)8.383%
Reviewer Pros & Cons
Pricing
N/A
Unavailable
What is Splunk Enterprise Security (ES)?
Splunk Enterprise Security (SIEM) is the company's flagship SIEM product, offered as a premium service to subscribers of Splunk Cloud or Splunk Enterprise.
Entry-level set up fee?
- No setup fee
For the latest information on pricing, visithttps://www.splunk.com/en_us/products/p…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Would you like us to let the vendor know that you want pricing?
67 people also want pricing
Alternatives Pricing
What is Microsoft Sentinel?
Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.
What is InsightIDR?
In addition to their incident response service, Rapid7 offers InsightIDR, a combined XDR and SIEM that provides user behavior and threat analytics.
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- FAQs
What is Splunk Enterprise Security (ES)?
Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale. Ingest machine data from any source for full visibility to detect malicious threats in an environment. Investigate and correlate activities across multicloud and on-premises sources in one unified view to identify and remediate security incidents. Splunk Enterprise Security supports cloud, on-premises, and hybrid deployment models to meet the needs of the business. When deployed as a cloud-based SIEM, the vendor states Splunk Enterprise Security can deliver improved time to value, allowing teams to focus on higher value security tasks instead of managing infrastructure hardware and manual upgrades.
Splunk Enterprise Security (ES) Video
Threat intelligence capabilities can be found in a variety of products. In this video, the TrustRadius team goes over 4 leading products in the space, including Splunk Enterprise Security (ES).
Splunk Enterprise Security (ES) Competitors
Splunk Enterprise Security (ES) Technical Details
| Operating Systems | Unspecified |
|---|---|
| Mobile Application | No |
Frequently Asked Questions
Splunk Enterprise Security (SIEM) is the company's flagship SIEM product, offered as a premium service to subscribers of Splunk Cloud or Splunk Enterprise.
IBM Security QRadar SIEM, LogRhythm NextGen SIEM Platform, and Securonix Next-Generation SIEM are common alternatives for Splunk Enterprise Security (ES).
Reviewers rate Centralized event and log data collection highest, with a score of 9.3.
The most common users of Splunk Enterprise Security (ES) are from Enterprises (1,001+ employees).
Comparisons
Compare with
Reviews and Ratings
(250)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Pros
- Cons
- Recommendations
Intuitive User Interface: Users have consistently found the user interface of the product intuitive and easy to use, allowing for quick completion of tasks. Many reviewers praised its simplicity and user-friendly design.
Efficient Log Correlation: The automation capabilities in XDR were highly appreciated by users as they enable efficient log correlation and turning data into meaningful insights. Several reviewers mentioned that this feature saves them time and enhances their overall productivity.
Comprehensive Security Monitoring: Users highlighted the product's ability to monitor firewall traffic, mail systems, and AWS infrastructure, providing comprehensive security monitoring. This feature was commended for its effectiveness in identifying potential threats from various sources.
User Interface: Users have found the user interface of Splunk Enterprise Security to be confusing and not user-friendly, with a steep learning curve. Some users suggest improving the UI by reducing the number of clicks required.
Troubleshooting and Integration: Several users have experienced difficulty troubleshooting and integrating Splunk with other products. They mention that customizations often require technical support which may not always be on point. There is a need for optimization when it comes to handling multiple data sources.
Default Searches and Alerts: Many users find the default searches and alerts provided by Splunk Enterprise Security to be not valuable and in need of customization. They suggest better alert suppression, improved permissions, and more support for certain tools. Furthermore, users desire a more polished version of the miter coverage dashboard.
Users commonly recommend the following for Splunk Enterprise:
-
Invest in proper training for personnel to avoid misuse and low performance. Users suggest that investing in training for staff is crucial to ensure effective use of the software and prevent any potential issues or underutilization.
-
Consider other products in the market and evaluate compatibility with your business needs. While users recommend Splunk Enterprise, they also suggest exploring alternative solutions to determine which one best suits their specific requirements and environment.
-
Try Splunk Enterprise for free and explore its documentation. Users advise others to take advantage of the free trial offered by Splunk Enterprise and thoroughly explore the product documentation. This will help users evaluate whether the software meets their needs and understand its features before making a purchase decision.
Attribute Ratings
- 8.9Likelihood to Renew
- 9.1Availability
- 8.2Performance
- 7.6Usability
- 6.6Support Rating
- 8.2Online Training
- 9.1In-Person Training
- 9.1Implementation Rating
- 7.3Configurability
- 9.3Product Scalability
- 6.4Ease of integration
- 8.2Vendor pre-sale
- 8.2Vendor post-sale
- 9.1Professional Services
- 7.3Contract Terms and Pricing Model
Reviews
(1-25 of 64)Companies can't remove reviews or game the system. Here's why
March 25, 2024
The Power of Splunk Enterprise.
LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and quite frankly lot faster than Splunk. However, I prefer Splunk because of its better Dashboards and panel customization abilities. Elastic is another amazing tool. It is hard to choose between the two especially because both have different sets of logs on them. I use both. Elastic for internal server logs, Splunk for everything else.
September 12, 2023
Splunk ES Review
Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh
September 12, 2023
Splunk ES, a great tool to use with some caveats!
I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some of the logs are hard to find and you have to have a better knowledge of the environment to know which logs you need to look through. It's not just listed on the side.
September 11, 2023
excellent platform for the collection and management of logs from multiple sources
Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events.
September 06, 2023
Splunk ES Review
AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics.
September 06, 2023
Secure with Splunk Enterprise Security (ES)
These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score
GRS UBA helps to protect organization from data ,via sharing through emails and USB s .
Gurucu product license once purchased they will devolp accordingly and monthly touch base sessions
GRS UBA helps to protect organization from data ,via sharing through emails and USB s .
Gurucu product license once purchased they will devolp accordingly and monthly touch base sessions
July 24, 2023
Splunk Enterprise Security is a must!
- Active Roles from One Identity and Amazon S3 (Simple Storage Service)
Splunk is way better. Support is awesome too
July 21, 2023
Splunk ES Alert Reduction
- Splunk User Behavior Analytics (UBA)
Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review all of them.
- Splunk IT Service Intelligence (ITSI)
I believe it is definitely a leader in the security space
May 30, 2023
Automated Reporting and monitoring tool
It’s easy to understand and simple to implement
Score 10 out of 10
Vetted Review
Verified User
- (EOL) Cisco Cloudcenter
I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for network performance monitoring.
August 02, 2022
Aligning on Splunk means a cheaper and far more flexible security monitoring solution.
Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now.
I performed a migration from RSA SA and I found that ES is very easier to implement new Correlation Searches.
July 20, 2022
One SIEM to rule them all
- Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well.
- Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem.
- With lookups and trust, you can easily ingest your TI platforms and look for backlog and real-time data.
- Splunkbase
- RBA is using unsupervised learning also, so it's not like Qradar or McAfee. If we look at Qradar or McAfee, they are giving some magnitude values with static rules and define incident levels with that.
- Advanced investigation option and out-of-box security metrics tell you that where you are.
- Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem.
- With lookups and trust, you can easily ingest your TI platforms and look for backlog and real-time data.
- Splunkbase
- RBA is using unsupervised learning also, so it's not like Qradar or McAfee. If we look at Qradar or McAfee, they are giving some magnitude values with static rules and define incident levels with that.
- Advanced investigation option and out-of-box security metrics tell you that where you are.
July 19, 2022
Top class security alerting with excellent outbreak handling and precise vulnerability analysis.
Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat.
FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing.
Splunk does not hide its correlation and analytics logic from users as much as other solutions in the same space. While some features are harder to access the underlying information is all accessible and tunable. This gives Splunk an edge over other solutions that lock the user into a predefined box. However, many other solutions in the space have more advanced out-of-the-box functionality when turned on. The advantage lies with Splunk's granular control over logs and events to generate high-fidelity notables and alerts.
June 22, 2022
Splunk FTW... when it's the right fit
Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for MSP/multi-tenant platform is the go-to approach. QRadar is an excellent option for low-budget, standard SIEM use case customers. However, it cannot match up to the extensibility and customisation that Splunk ES provides especially for advanced use cases and non-standard data sources.
June 21, 2022
The Best SIEM Solution the market has to offer!
Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES is that it can also serve as a business intelligence tool for Data Analytics so both Security and Business teams can create use cases and monitor dashboards as per their needs.
June 20, 2022
Splunk Enterprise Security Normalizes Security!
Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and normalize it based on a simple app that is available from Splunkbase. It is a much more streamlined process.
- Splunk Cloud, Splunk Enterprise and Splunk User Behavior Analytics (UBA)
All Splunk products are easy to integrate, and they collaborate in the security of our organization.
N/A - Have only used Splunk Enterprise Security since coming to Deloitte
LogRhythm is a superior SIEM from a purely security/SOC perspective in my opinion. However, Splunk shines if you have an expert behind the wheel or if the organization is quite large - as my experience with LogRhythm indicated it couldn't handle large-size organizations.
June 20, 2022
Splunk Enterprise Security can take our jobs!!
We have both of these instances in our organization.