Share your experience using Venusense USM

We use Panther for our SIEM solution. It is used for aggregating logs and analyzing user activities. We can filter down to individual roles inside of AWS through all the accounts and user activities.

I find Panther's detection capabilities and integrations to be highly valuable. It allows integration with anything as long as I am willing to write detections, and their team is very helpful. I find its log analysis capabilities valuable. It enables me to filter down to individual roles in AWS, and if I am skilled at SQL queries, I can query anything. The infrastructure as code feature allows me to use Git repositories to manage detections and import detections from other Git repositories.

The solution could be improved by providing more built-in integrations, which would reduce the need for me to build them myself.

I have had experience with Panther for two years.

The search is pretty good, and it builds SQL queries for me, allowing me to go through logs and click on elements to add filters, automatically building the query.

The support team is very helpful and supportive.

Neutral

Before Panther, we mainly relied on CloudWatch and did not have a dedicated SIEM solution. We are a cloud-only company, and Panther was a good fit for us.

Setting up Panther was straightforward and easy, worthy of an eight out of ten in terms of ease.

Our security team is quite small, consisting of fewer than five people, and we were able to deploy Panther. The same small team can maintain the solution and build integrations.

Panther does what is expected of a SIEM solution. It is used by engineers for troubleshooting issues and defining role-based controls for visibility between teams.

I find the pricing to be reasonable, although I can't recall the exact cost.

We evaluated Panther against Devo and Gurucul. Panther offered better hot storage for logs and was less expensive than Devo.

I would recommend Panther to other companies because of its ease of use. The infrastructure as code feature allows using Git repositories for secure detections. Overall, I would rate the solution eight out of ten.

Public Cloud

Other

My main use case for Splunk Enterprise Security is to achieve security-related outcomes, streamline data analysis, and implement advanced detections with enriched alerting, threat detection, investigation, and response workflow.

A specific example of how I use Splunk Enterprise Security for threat detection involves reviewing audit logs to identify man-in-the-middle attack attempts and detect foul play related to installations or phishing attacks.

Splunk Enterprise Security has impacted my organization positively by significantly reducing alerting sent to individual people or distribution lists. It functions as a SOC dashboard where you can view any triggered alerts, and it also sends alerting as well. While it does not completely eliminate alerts, you do not need to create multiple alerts since only critical alerts are sent via email, while all others can be viewed on the SOC dashboard in Splunk Enterprise Security, which is a helpful scenario.

This change has affected my team's workflow and efficiency by reducing alert fatigue. Once an incident is triggered or a notable is generated, our team members immediately begin working on it and assign themselves to the task. This way, when anyone newly opens the dashboard, they can see who is working on that incident, which helps eliminate multiple people working on the same incident. In such scenarios, it is both time-saving and reduces the number of alerts being generated.

Splunk Enterprise Security has definitely helped a lot, and we also use SOAR automation, so along with its integration, it has provided significant benefits. Splunk Enterprise Security has helped reduce my team's average mean time to detect incidents by forty to fifty percent.

Splunk Enterprise Security's risk-based alerting has impacted my alert volume and analyst productivity by helping a lot, and SOC dashboards have also helped considerably. Incident Review is something which we have on board, so it is completely usable and user-friendly, and teams can utilize it and address issues as quickly as possible.

Splunk Enterprise Security has helped me detect threats faster because it has its own use case libraries which provide anomalies. Most of the time, it could be a real-time detection or perhaps a false anomaly as well, but it gives you keywords or phrases to identify incidents early, which does help with that use case library capability.

Splunk Enterprise Security Essentials has definitely helped in reducing the time to identify issues, though I would not say it completely reduced analyst burnout or fatigue.

AI-driven detections and assistance have improved the accuracy of my investigations because it analyzes a lot of information and transactions happening through user accounts and similar factors. This is how AI has helped us in identifying and detecting threats proactively.

Splunk Enterprise Security Essentials has improved my visibility across hybrid or multi-cloud environments, along with its use cases, and since it is not a complete product like the full version, it has helped in locations where we did not deploy the full version completely.

Splunk Enterprise Security has helped improve my organization's business resilience by identifying threats. I would not say high-scale or larger-level threats, but it has definitely helped us prevent many initial attempts that could have caused bigger losses.

The consolidation of SIEM, SOAR, and UEBA into a single interface has improved my team's operational efficiency because it is easy to handle all of these components in a single platform instead of managing multiple platforms. Earlier, we had separate teams which each managed their own cluster. Now all three of them coming into a single platform is much easier to manage and also reduces the number of admins required and the administration overhead.

In my opinion, the best features Splunk Enterprise Security offers are ease of use. You do not need to do extra ingestion or anything complicated; just normal Splunk ingestion is required. It is essentially an add-on module that you can utilize with your own data by adding UI-related enhancements to make sure it is working fine, and this also helps you with having detections scheduled.

Out of those features, the one that has made the biggest difference for me is ease of use, because it is a drag-and-drop tool with UI-related functionality. There is no need to do major backend configurations or require any extra Linux administration efforts. If you can handle it through the UI, it is straightforward.

I assess the threat topology and MITRE ATT&CK framework features as quite useful for discovering the overall scope of an incident by tagging them to the framework, identifying the alerting, and reviewing the notables and events. It helps to understand which framework an incident falls under, and the MITRE ATT&CK framework integration with Splunk Enterprise Security is helpful for understanding the criticality and nature of incidents which occurred.

Splunk Enterprise Security can be improved with more integrations, and maintaining it can sometimes be problematic. The upgrade procedure for Splunk Enterprise Security occasionally fails, which is the only piece that is currently an issue. Additionally, normalizations and data model acceleration sometimes utilize a lot of resources, so if resource utilization can be kept in check, then Splunk Enterprise Security would be an even better product. Everything else seems to be fine so far.

From my firsthand experience with the accuracy and reliability of output from Splunk Enterprise Security's AI capabilities, I would say it is still developing, so it takes some time for it to be fully mature.

I have been using Splunk Enterprise Security for almost nine years.

I would rate Splunk Enterprise Security as nine out of ten.

I choose nine out of ten because it is a fully built tool that is completely tested through many iterations, many years, and numerous upgrades. It is a fully developed tool, and while there is definitely room for improvement for any product, this is why I am giving it a nine.

Regarding Splunk Enterprise Security's AI capabilities, I have not used it much, but I probably will dive into it more in the future.

My advice to others looking into using Splunk Enterprise Security is that if you want integration and automation related to SOAR or UEBA, it is better to start with Splunk Enterprise Security, which keeps you within a framework of normalizing your data and trying to integrate with other products. The ease of use is something which you can accomplish entirely through the UI, and nothing much else is needed or no new logging is necessary. It just uses your existing logging and logs coming through, so it is a straightforward process.

On-premises