Splunk Enterprise Security is especially compelling for large scale organizations and/or those already using the Splunk platform

Splunk Enterprise Security is our one-stop-shop for gaining visibility and insight into most of our secops tooling. We currently use it as our primary alerting platform (via Splunk On-Call) and share access/administration with a third-party hybrid SOC. Assets are our biggest pain point, with our current methodology relying on reading a CSV each day, performing data cleaning/sanitization, and using macros to define key fields like category and risk. This is really only feasible for our critical assets, so the remaining hosts are very inconsistent and unreliable at times, especially for our cloud assets.

Partially, we had difficulties with our deployment from the start of the project and the vendor was required to pull out early. Because of this, we have been behind the eight ball since the start and it has been a very arduous and manual process getting the platform into a usable state. We are now in a place where we can action notables daily, but tuning and general uplift take significant time and effort. Solutions like Admin on demand do not fit a lot of our purposes or use cases, and where they do - it takes significant time to explain the issue sometimes. This has led to a feeling of our organization having to do this work ourselves and not rely on Splunk's assistance.