February 10, 2022

Fantastic opportunity to correlate datasets from datasets regardless of their vendor or location, bringing the capability to correlate and detect attacks covering wide areas of an organisation

Item: Splunk Enterprise Security (ES)
Rating: 9
Author: Verified User

Verified User

Consultant in Professional Services

Hospital & Health Care Company, 1001-5000 employees

Score 9 out of 10

Vetted Review

Verified User

Use Cases and Deployment Scope

We use Splunk Enterprise Security to collate security data sources from a wide range of on-premise and various cloud platforms, making use of the Splunk Common Information Model (CIM) to ensure that analysts can use predictable and familiar field names when reviewing data feeds and allowing us to easily turn on additional use-cases when new features/searches become available through software updates in Splunk Enterprise Security.

Pros and Cons

Visualise current threats
Aggregate data sources
Integration to other systems with event actions

Business Unit segregation

Return on Investment

MTTR are noticeable quicker
Incidents are raised with relevant parties far sooner, ultimately driving faster resolutions.
Analysts are able to spend more time on the things that matter.

Scalability

Using Splunk Cloud we have been able to increase the scaling as and when required, with no downtime and very little delay.

Alternatives Considered

Amazon GuardDuty, Microsoft Sentinel (formerly Azure Sentinel) and McAfee Advanced Threat Defense

Using Splunk Enterprise Security allows the combination of security data sources from any number of services or products, giving analysts a single view of the entire security footprint throughout the organization and correlating events across services that may otherwise be undetected with standalone or independent security monitoring services.

Key Insights

Do you think Splunk Enterprise Security (ES) delivers good value for the price?

Yes

Are you happy with Splunk Enterprise Security (ES)'s feature set?

Yes

Did Splunk Enterprise Security (ES) live up to sales and marketing promises?

Yes

Did implementation of Splunk Enterprise Security (ES) go as expected?

Yes

Would you buy Splunk Enterprise Security (ES) again?

Yes

Other Software Used

Splunk Enterprise, Splunk Cloud, Splunk IT Service Intelligence (ITSI)

Likelihood to Recommend

Splunk Enterprise Security is well suited for monitoring multiple data sources which may otherwise require multiple individual tools (e.g. Cloud vendor-specific tooling). I have not seen Business Unit segregation capabilities within ES that would allow individual business units to assist security teams with monitoring their areas without allowing the users to see all the ES data.