Item: Splunk Enterprise Security (ES)
Rating: 10
Author: Verified User

Use Cases and Deployment Scope

Splunk is the Core Security Incident Tool used for Core operations by the Blue Team at our organization. Within a short span of time after we integrated Splunk into our Security Operation Center, we were able to increase the Security Posture of our organization by 40% reducing the time required to mitigate attacks including Web, Mail, and Application Server endpoints.

Pros and Cons

Centralized Log Monitoring Systems
Event and Log Correlation
Custom Alarms
Custom Dashboards

Performance Improvement
License Dependency on Amount of Data infused
Automation capabilities
Requirement of Certification and complexity in Learning of Tool

Return on Investment

Scalability
Able to detect and Mitigate Attacks
Log4j attacks were remediated
Huge improvement against Ransomware and Phishing Campaigns

Scalability

We are migrating to cloud-only infrastructure and we are completely flexible to the part of Hosting the SIEM tools in the cloud. We were able to increase the performance of the cloud, work on legal and compliance policies for data retention across regions and we find it helpful in hosting security monitoring tools on cloud

Key Insights

Do you think Splunk Enterprise Security (ES) delivers good value for the price?

Yes

Are you happy with Splunk Enterprise Security (ES)'s feature set?

Yes

Did Splunk Enterprise Security (ES) live up to sales and marketing promises?

Yes

Did implementation of Splunk Enterprise Security (ES) go as expected?

Yes

Would you buy Splunk Enterprise Security (ES) again?

Yes

Likelihood to Recommend

The edge feature of Splunk ES helps us to integrate Cloud Platforms like AWS, GCP, etc, internal in house developed tools in a very modest and simplified way, However it was noted that in house developed tools generated a huge amount of data increases the cost of licensing to our organization and had to remove from Splunk as part of the cost-cutting strategy for our team. As I work in a security-first organization it was noted that it uses a lot of industry-standard benchmarks like CIS, NIST to indicate risks as well.

SIEM tool that Fortifies your Organization

Overall Satisfaction with Splunk Enterprise Security (ES)