Try our new research platform with insights from 80,000+ expert users

Icinga vs Splunk Enterprise Security comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Icinga
Average Rating
7.6
Reviews Sentiment
6.1
Number of Reviews
17
Ranking in other categories
Network Monitoring Software (17th), Server Monitoring (12th), IT Infrastructure Monitoring (25th), Cloud Monitoring Software (18th)
Splunk Enterprise Security
Average Rating
8.4
Reviews Sentiment
7.6
Number of Reviews
315
Ranking in other categories
Log Management (2nd), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
 

Mindshare comparison

While both are Systems Management solutions, they serve different purposes. Icinga is designed for Network Monitoring Software and holds a mindshare of 3.3%, up 2.5% compared to last year.
Splunk Enterprise Security, on the other hand, focuses on Security Information and Event Management (SIEM), holds 9.4% mindshare, down 12.1% since last year.
Network Monitoring Software
Security Information and Event Management (SIEM)
 

Featured Reviews

Harrison Bulley - PeerSpot reviewer
A stable, scalable and cost-effective solution that helps with inbuilt scripts for easy modification
I think the software is quite good, but we have had problems with getting it to recognize certain areas and amend certain checks, where we needed so we would have to create backend scripts for those checks. Though, being open source, it has the support to create backend scripts, it would be better to have these scripts in-built.
ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Icinga does the job and is fairly stable."
"An affordable solution for small organizations to do basic network monitoring."
"Icinga has multiple automation and integration features. There is an API for everything and a web UI for configurations. The APIs enable you to automate tasks in Icinga. We can also use plugins to talk to the API. The Icinga Director talks to a database in the background, and you can import settings from the CMDB to all systems in Icinga."
"We have found the solution to be stable."
"I like the ability to amend and adjust things really easily, which is useful in a case where you could make it auto-discover and then set a template to say all of these applications or servers under this template have an automatic threshold set that you’d set up manually."
"The best thing about the solution is how it highlights errors, the issues, and what needs my attention. The solution directs me to areas that I should look for first."
"The value of Icinga is that it has hundreds of plugins, so it's really easy to monitor pretty much anything."
"The ability to customize scripts and build your own queries to request information from the infrastructure elements you want to monitor. This level of personalization and customization is highly appreciated."
"The most valuable features of Splunk Enterprise Security are reporting capabilities. It is a good tool for checking systems and analyzing situations. I find it useful to check my systems and analyze situations."
"It follows MITRE ATT&CK and Cyber Kill Chain frameworks. There are certain notable events for which we can configure our security posture."
"The correlation search functions that generate all the notables are valuable. That can get pretty complicated, and it handles that pretty well."
"Splunk is a user-friendly solution."
"I like Splunk's automated threat detection and orchestration capabilities. Splunk offers a single solution for analyzing, aggregating, correlating, monitoring, reporting, visualizing, etc. You can get all of these capabilities in one place. On top of that, it provides a cloud, testing, on-premise, and hybrid solution, giving customers more flexibility for their use cases."
"The technical support is among the best in the market."
"Splunk incorporates a lot of elements that help to reduce security risks. For it to reach certain compliance, we need to have some security insight. Splunk is a very good SIEM, it’s a top solution, but the best feature is its cost of visibility. We have all the most important features to detect vulnerabilities or risks."
"It has a rapid response search environment in the event of an incident."
 

Cons

"There is room for improvement in multi-tenancy. It's not perfect, not even really good. It's average, but it should be improved."
"Icinga’s automation could be improved."
"The tool currently fails to provide notifications to users."
"At this time, the layout of the website is a bit difficult. It should be more user-friendly for changing the background and logos."
"One thing that Icinga lacks is the capability to create advanced and customized dashboards within the tool itself."
"Icinga is a complex solution that's hard to learn. It's a powerful product for monitoring, but new users will have a hard time figuring out what to do."
"We have found some problems with Nagios, and support isn't very responsive."
"In general, the product does not look good. However, it does what it is supposed to do. So, the improvements should focus on usability and UI."
"The main issue that I have with it is that the field transformations sometimes overlap with those in Splunk Enterprise, and then you get permissions issues that lead to troubles."
"There are limitations with Splunk not detecting all user activity, especially on mainframes and network devices."
"The incident response dashboard could be more user-friendly."
"The documentation and training resources available for knowledge and training can be expanded. We need to learn more about Splunk Enterprise Security and new security attacks."
"The complexity could be worked on so that it's even easier and faster."
"An area of improvement would be the licensing of the solution. They need a free license, which would allow faster lead times."
"Splunk needs to be able to hold more days of data. At the moment it only holds three months of data."
"For us, the area that Splunk Enterprise Security can improve is performance optimization."
 

Pricing and Cost Advice

"The solution is cheap."
"This is an open-source solution with paid support."
"It is cost-effective, and the return on investment can be very interesting because the price is low."
"Even though Icinga's financial cost is low, it is an expensive product regarding the resources required to maintain and operate it."
"It's an open-source solution."
"The product is inexpensive compared to other DBM products."
"We're using the free version of Icinga."
"The solution is free to use."
"Splunk Enterprise Security is expensive."
"The pricing model is expensive and a nightmare based on the amount of data."
"Pricing can be a limiting factor. You have to continuously tune what you are bringing in and make sure what you bring in is of value."
"Splunk Enterprise becomes extremely expensive after the 20GB/month license."
"Splunk differs from other SIEM solutions by using a gigabyte-based pricing model, rather than the agent-based licenses common with its competitors."
"The pricing could be made more competitive."
"The solution is costly."
"Splunk Enterprise Security is affordable."
report
Use our free recommendation engine to learn which Network Monitoring Software solutions are best for your needs.
860,632 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Manufacturing Company
8%
Computer Software Company
14%
Financial Services Firm
14%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Icinga?
The best thing about the solution is how it highlights errors, the issues, and what needs my attention. The solution directs me to areas that I should look for first.
What is your experience regarding pricing and costs for Icinga?
It is cost-effective, and the return on investment can be very interesting because the price is low. If you want to include this product in the services you offer to your customers, the return on i...
What needs improvement with Icinga?
There is room for improvement in multi-tenancy. It's not perfect, not even really good. It's average, but it should be improved. For instance, multi-tenancy for monitoring the virtual infrastructur...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
 

Also Known As

Icinga Cloud Monitoring
No data available
 

Overview

 

Sample Customers

Puppet Labs, Audi, Spacex, Debian, Snapdeal, McGill, RIPE Network Coordination Centre
Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Find out what your peers are saying about Zabbix, Auvik, SolarWinds and others in Network Monitoring Software. Updated: July 2025.
860,632 professionals have used our research since 2012.