Splunk Enterprise Security

In our organization, Splunk Enterprise Security (ES) is the central Security Information and Event Management (SIEM) platform that consolidates telemetry across the enterprise, spanning network infrastructure, cloud services, endpoints, Kubernetes environments, identity systems, and critical applications. As part of the Cisco family, Splunk continues to evolve with deep integrations into Cisco threat intelligence (e.g., Talos) and network telemetry, enhancing both detection fidelity and operational efficiency.

• Cost and licensing.

Arcsight by OpenText

Cisco Secure Network Analytics, Cisco Catalyst Center, SDWAN|Link

We use Splunk for Security Logs. We basically monitor all Client logs whenever they use their cards.

• It is hard to estimate considering it's not been a year that I've been working in the company, but it has for sure definitely helped to keep us reliable, trustworthy and secure in an indirect way. All of these help the bank I work for financially as well.

Cisco Duo, Cisco Secure Access, Tenable Cloud Security

We deployed Cisco Splunk as a central SIEM to consolidate all of our logs from different vendors (Palo Alto, Fortinet, Aruba, Red Hat, Check Point...). Before Splunk, our analysts were juggling multiple disconnected tools across many dashboards and logs. Splunk fits our needs perfectly with real-time logging and alerting to prioritize incidents.

• Tools consolidated.
• False positive rate.
• MTTD reduction.

Kibana

CheckPoint, Juniper 7000, Fortinet FortiGate

Splunk Enterprise Security is used as the primary SIEM solution in my company, used by tens of SOC users for the detection and investigation of suspicious activities

• Splunk Enterprise Security support tens of SOC operators to track and investigate hundreds of security events every day.
• The SOC is a critical activity. Splunk Enterprise Security is one of if not the best solutions that makes it possible, and at scale

Elastic Security and RSA Access Manager (Discontinued)

Splunk Enterprise

We utilize Splunk Enterprise Security more as an operational layer that ties together everything we promise our clients from a security standpoint. What that looks like in practice revolves around compiling activity logs, endpoint detections or evn custom app logs into one place where we can make sense of it- 100% of the time, it's on Splunk Enterprise Security

• reuse of correlation searches across different domains
• Great increases in client confidence through deeper and with more context type of reporting

Microsoft Sentinel

IBM AIOps Insights, TeamViewer