Splunk Enterprise Security is the best security we can get for our working network
February 26, 2022

Splunk Enterprise Security is the best security we can get for our working network

Anonymous | TrustRadius Reviewer
Score 7 out of 10
Vetted Review
Verified User

Overall Satisfaction with Splunk Enterprise Security (ES)

I have been using Splunk Enterprise Security for the last year, and it helps me to analyze security-related aspects that I encountered from my organization of users. I used Splunk Enterprise Security for creating use-cases from the data I am onboarding. The dashboards help me to identify various threats and anomalies generated in my working environment among users, the data models, and the CIM mapping with various data indexes of Authentication, Endpoint, Email, Intrusion, and Detection data helps to monitor and analyze the problems more effectively.

Pros

  • We can create security use-cases to monitor the organization users record
  • Dashboards are widely used to analyze threats and anomalies
  • Data models which were used helps to find proper insights of the data

Cons

  • Splunk Enterprise Security can be merged with getting users related insights just like UBA
  • User Behaviour Analysis is the key factor in any organization to keep track of the users' activity is much more needed, and features can be added in Splunk Enterprise Security to get it done quickly
  • Splunk Enterprise Security can be documented more effectively to get it to understand more easily if any new users try to learn Splunk Enterprise Security for the first time
  • As compared to tradition, Splunk Enterprise Security has overall more licensing costs appeared
  • The Business has led to high availability and more profit when Splunk Enterprise Security comes into the picture
  • The query searching is fast; data model mapping helps to consume less time, and effective searching of queries
Splunk Enterprise Security has effectively helped to manage the goals in many ways. It could be an effective analysis of logs monitoring. Searching is easier when data is mapped to the data model in Splunk Enterprise Security. Correlation searches make things easier and faster as compared to other SIEM tools. And dashboards are like the cherry on the cake for Splunk Enterprise Security searching, monitoring for the results we encounter from it.
When it comes to onboarding a large amount of data in Splunk Enterprise Security, it is basically dependent on the licensing cost, which I feel is the same for other Splunk Enterprise Security, so there is nothing new in that for me. In a hybrid environment, UBA comes into the picture, and it is more likely getting more light than Splunk Enterprise Security.
As Sumo Logic and QRadar are the same SIEM Tool, the reason for selecting Splunk Enterprise Security above those was Splunk Enterprise Security is more handy than these two. The SPL query we write to get more effective results to create Alerts, Reports, and Dashboards are more prominent than the above two. Getting notified in terms of alerts, Splunk Enterprise Security is top-notch.

Do you think Splunk Enterprise Security delivers good value for the price?

Yes

Are you happy with Splunk Enterprise Security's feature set?

Yes

Did Splunk Enterprise Security live up to sales and marketing promises?

Yes

Did implementation of Splunk Enterprise Security go as expected?

I wasn't involved with the implementation phase

Would you buy Splunk Enterprise Security again?

Yes

The very good use of Splunk Enterprise Security is to work on security-related aspects to onboard data. It Makes it CIM compliant, which will get easier to make data models and search the right amount of data with more information which gets easier with data model mappings. DM Authentication, Malware, Intrusion detection is more effective in many ways, and sending the Data to Splunk UBA to do furthermore analysis upon threats and anomalies by users and devices.

Splunk Enterprise Security Feature Ratings

Security Information and Event Management (SIEM)
6.5
Centralized event and log data collection
5
Correlation
8
Event and log normalization/management
5
Deployment flexibility
8
Integration with Identity and Access Management Tools
Not Rated
Custom dashboards and workspaces
7
Host and network-based intrusion detection
8
Log retention
7
Data integration/API management
6
Behavioral analytics and baselining
4
Reporting and compliance management
5
Incident indexing/searching
9

Comments

More Reviews of Splunk Enterprise Security

  1. Home
  2. Security Information and Event Management (SIEM) Software
  3. Splunk Enterprise Security Reviews
  4. User Review of Splunk Enterprise Security