Item: Splunk Enterprise Security (ES)
Rating: 9
Author: Verified User

Use Cases and Deployment Scope

By having Splunk ingest log files from all of our security tools, Splunk Enterprise Security acts as a single event collection point reducing the need to involve tool-specific administrators to get involved in event detection and analysis and instead allowing a focus group of SOC analysts and IR teams to investigate and quickly respond to potential threats.

Pros and Cons

Notable email alerts contain enough info to determine if further action is required
Risk based alerts reduce alert fatigue for SOC analysts
Data ingestion scalability normally equates to real-time events appearing in Splunk

Initial setup time - alert configurations, rule development, building relevant queries for our environment, sometimes requires development type folks (or Splunk contractors) rather than Splunk admin types
Improved server health monitoring - we're deploying Meta Woot to give us specifics on hosts that are not sending log files or performing poorly, it seems like that should be part of Splunk IP

Return on Investment

I do not get involved in licensing costs, I am strictly a Splunk admin

Scalability

Because it is supported by key Splunk components like Deployment Server which allow for quick and seamless app configuration deployment and updates.

Alternatives Considered

N/A - Have only used Splunk Enterprise Security since coming to Deloitte

Key Insights

Do you think Splunk Enterprise Security (ES) delivers good value for the price?

Not sure

Are you happy with Splunk Enterprise Security (ES)'s feature set?

Yes

Did Splunk Enterprise Security (ES) live up to sales and marketing promises?

Yes

Did implementation of Splunk Enterprise Security (ES) go as expected?

I wasn't involved with the implementation phase

Would you buy Splunk Enterprise Security (ES) again?

Yes

Other Software Used

Tanium, Cylance Smart Antivirus, CrowdStrike Falcon Endpoint Protection

Likelihood to Recommend

Splunk Enterprise Security is the core piece of a large and robust Splunk on-premise deployment that has helped our SOC and IR teams to investigate, analyze and respond to large incidents such as the log4j vulnerability and several other pressing concerns that cannot be disclosed here. Though I'm not familiar with the pricing we get as a large Splunk Enterprise Security consumer, I would assume that Splunk sales support maintains a reasonable discount for shops that contains large Splunk deployments like ours and this will help Splunk to maintain its position as the central SIEM in our environment.

Splunk Enterprise Security - a notable SIEM cornerstone for the enterprise environment

Overall Satisfaction with Splunk Enterprise Security (ES)