Item: Splunk Enterprise Security (ES)
Rating: 8
Author: Holt Archer

Use Cases and Deployment Scope

Our SOC uses Splunk Enterprise Security as a SIEM, it is the heart of our security monitoring program. Having all our security logs in one place with the built-in intelligence allows us to satisfy customers, regulatory, and actual security requirements with one pane of glass. Standardizes our information and language as we troubleshoot security issues.

Pros and Cons

One pane of glass for all log sources
Easy to search with
Prioritize basic security issues

Built in SOAR would be a great addition

Return on Investment

Quickly identifying security issues
Visibility across security tooling leads to faster problem identification

Scalability

We have integrated several cloud-native services, hybrid, and on-prem log sources into the platform with great success. The only scalability issues have been with the correct sizing of the resources we have deployed for Splunk Enterprise Security components.

Alternatives Considered

Sumo Logic, AlienVault USM and Security Onion

In my experience with Splunk Enterprise Security, the SIEM is far superior to my experience with Alienvault or Security Onion. Splunk Enterprise Security is FAR more stable, extensible, functional, easy to set up, and easier to use than either of these tools, so much so that I would not put them in the same class as Splunk Enterprise Security. My experience with Sumo is that it is an equivalent offering but does not have some of the deployment flexibility that Splunk Enterprise Security does as it is fully cloud-native and at the time I was deploying it we were unable to have an on-prem presence.

Key Insights

Do you think Splunk Enterprise Security (ES) delivers good value for the price?

Yes

Are you happy with Splunk Enterprise Security (ES)'s feature set?

Yes

Did Splunk Enterprise Security (ES) live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Splunk Enterprise Security (ES) go as expected?

Yes

Would you buy Splunk Enterprise Security (ES) again?

Yes

Other Software Used

CrowdStrike Falcon Endpoint Protection, Sumo Logic, AWS CloudTrail

Likelihood to Recommend

I was previously using Sumo Logic for our SIEM function and my company was purchased and the purchaser is using Splunk Enterprise Security so the decision was not mine to make as to what was the best fit for our uses. With that said, I am finding Splunk Enterprise Security to be a great and intuitive log search SIEM product suitable for SOC teams and for security engineers to find and troubleshoot security issues. It could have a better UI for basic users, maybe autocomplete or drop-down lists for searching.

Fun with Splunk Enterprise Security as a SIEM

Overall Satisfaction with Splunk Enterprise Security (ES)