Item: Splunk Enterprise Security (ES)
Rating: 9
Author: Verified User

Use Cases and Deployment Scope

Because Splunk ES is bundled with Splunk Enterprise Core, you can import whatever data you choose, regardless of whether or not it relates to security. Version 7 of Splunk ES includes fantastic dashboards for executives, the cloud (AWS, Azure), and security. Aside from that, Splunk env has investigation and incident workflow tools that allow you to perform these tasks quickly. ML(PDF, Classification, etc.) has a slew of built-in detection features, and you won't get any better than that by combining static and dynamic detection.

Pros and Cons

Enhancing the information contained in event logs.
ES, Security Essentials, and ESCU all provide a plethora of built-in detection features, some of which incorporate machine learning algorithms like PDF and categorization.
Automated alerts and alerts.

Orchestration
A lack of familiarity with Splunk components and data pipelines can make deploying and managing architecture a challenge.
Splunk's help can be lacking at times, and you may find that you know Splunk far better than the support staff, and diagnostics can take a while.

Return on Investment

Less time to repair because of integrations.
Inspire a 7% increase in income because in protection.
Threat Intel integration has resulted in a reduction in MTTD.

Security Analytics

The product roadmap and future vision of the program ensure that our team does not fall behind in the development of tasks due to lack of capacity of the program in question.
This allows the objectives per month in development that we have set to be fulfilled or help to be fulfilled. In this way, the team works more confident and sure of not losing information.

Scalability

There's a lot of leeway with Splunk Enterprise Security. I've personally implemented this system in a wide range of scenarios, from on-premises to the cloud, and I can attest to its effectiveness. It has a lot of great options for hosting, and it's a breeze to get an instance up and running quickly. Add-ons that are simple to set up and use are also available.

Alternatives Considered

AWS Elastic Beanstalk and CrowdStrike Falcon Endpoint Protection

Only for big features and price.

Key Insights

Do you think Splunk Enterprise Security (ES) delivers good value for the price?

Yes

Are you happy with Splunk Enterprise Security (ES)'s feature set?

Did Splunk Enterprise Security (ES) live up to sales and marketing promises?

Did implementation of Splunk Enterprise Security (ES) go as expected?

Yes

Would you buy Splunk Enterprise Security (ES) again?

Yes

Likelihood to Recommend

One of the best ways to improve an organization's security is to use Splunk Enterprise Security. In a Security Operation Center, real-time alerts, monitoring, and reporting will be possible. Automated replies to security alarms can be generated by integrating them with other solutions as well.

Satisfaction and progress with Splunk ES.

Overall Satisfaction with Splunk Enterprise Security (ES)