We performed a comparison between Splunk and Zabbix based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.
Comparison Results: In this comparison, Zabbix comes out on top. When compared to Splunk, it is easier to deploy and is open-source.
"One of the most valuable features is that it creates a kind of a single pane of glass for organizations that already use Microsoft software. So, when they have things like Microsoft 365, it is very easy for them to kind of plug in or enroll those endpoints into the Azure Sentinel service."
"The dashboard that allows me to view all the incidents is the most valuable feature."
"The solution offers a lot of data on events. It helps us create specific detection strategies."
"The best feature is that onboarding to the SIM solution is quite easy. If you are using cloud-based solutions, it's just a few clicks to migrate it."
"Microsoft Sentinel provides the capability to integrate different log sources. On top of having several data connectors in place, you can also do integration with a threat intelligence platform to enhance and enrich the data that's available. You can collect as many logs and build all the use cases."
"We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place."
"We are able to deploy within half an hour and we only require one person to complete the implementation."
"Its inbuilt Kusto Query Language is a valuable feature. It provides the flexibility needed to leverage advanced data analytics rules and policies and enables us to easily navigate all our security events in a single view. It helps any user easily understand the data or any security lags in their data and applications."
"The consolidated overview of all the events that come in through our environment and an easy-to-access interface for all our end users are valuable."
"The product has a good security posture."
"We saw the granularity that we could get from Splunk far exceeded what we already had. We had the ability to have our security team really focus on the platform and stay within the platform, but they could correlate with a variety of other stakeholders, and our stakeholders were growing."
"One of the most valuable features is threat hunting. We can do threat hunting and identify if there is any malicious activity happening within our environment, which is a key feature for us."
"Splunk is quite flexible for our customers. Splunk does not filter from a specific lock, you can define it later."
"The product provides visibility and enables us to correlate data and generate alerts."
"Splunk allows us to customize processing and dashboards, which helps us take care of our customers' needs."
"The solution helped reduce our alert volume."
"Zabbix is a cost-effective solution. We're a small organization with a few dozen devices to monitor, and it was available for free. We can see what we need. We haven't done an in-depth analysis on it, but we're currently okay with the product."
"The integration capabilities and APIs are the best part."
"SNMP monitoring, source discovery, and alert triggering are most valuable."
"There is a problems page that shows us every warning or problem that occurs on our VMs globally. The map screen is also really useful because this is something that was missing. I don't know every other tool in the market. So, I don't know if this is a good point of only Zabbix, or other tools are also doing it, but from my point of view, this is the most useful page that I use, along with the problems page that efficiently lists the problem, recovery time, ending hours, starting hours, and so on."
"The initial setup, while not simple, is easier than other products."
"Zabbix is good for discovery."
"The features I found most valuable are the user interface and a wide range of network devices that are easy to configure."
"We have found that Zabbix is more easy to use than other applications."
"We are invoiced according to the amount of data generated within each log."
"The data connectors for third-party tools could be improved, as some aren't available in Sentinel. They need to be available in the data connector panel."
"We're satisfied with the comprehensiveness of the security protection. That said, we do have issues sometimes where there have been global outages and we need to raise a ticket with Microsoft."
"If their UI was a bit more streamlined and easy to find when I need it, then that would be a great improvement."
"We do have in-built or out-of-the-box metrics that are shown on the dashboard, but it doesn't give the kind of metrics that we need from our environment whereby we need to check the meantime to detect and meantime to resolve an incident. I have to do it manually. I have to pull all the logs or all the alerts that are fed into Sentinel over a certain period. We do this on a monthly basis, so I go into Microsoft Sentinel and pull all the alerts or incidents we closed over a period of thirty days."
"They only classify alerts into three categories: high, medium, and low. So, from the user's point of view, having another critical category would be awesome."
"Its implementation could be simpler. It is not really simple or straightforward. It is in the middle. Sometimes, connectors are a little bit complex."
"Sometimes, we are observing large ingestion delays. We expect logs within 5 minutes, but it takes about 10 to 15 minutes."
"The analytics of Splunk could be improved."
"The UI can be improved. Dashboards and reports can be better in terms of graphics."
"Splunk could add more ways to manage archiving and storage. There isn't a web interface. You can do this on the SaaS version, but the on-premise platform doesn't have this option. It has other things but no option for remote NAS. I would like to have a personal web interface where I can specify how long logs should be stored. To have this readily available on the web, you need to adjust some settings on the backend. That is tricky."
"Writing queries is a bit complicated sometimes."
"The training was mostly sales-focused, like how to monitor your sales. It was hard to then come back from doing the training and try to switch it to a cybersecurity focus because all the training we did was sales oriented. The basic training didn't really touch on any kind of cybersecurity use cases or anything like that. That would have been great to see in the training."
"The CIM model is the method Splunk uses to normalize data and categorize its important parts, but it is quite complex."
"I have concerns about the architecture as well since I can see it is not very well defined."
"Its interface could be improved."
"The user web interface is a little bit too basic, we need to link Zabbix to Grafana to have more options, such as graphs and charts. The interface needs to be improved. Additionally, there could be better integration with Grafana API."
"Zabbix is not easy to configure, and upgrading is also an issue."
"The product could be more secure and more stable."
"The solution needs to add features for finding loopholes or problems and their root causes."
"Zabbix isn't a great tool for cloud-specific monitoring - its connection to public clouds needs to be improved. Other areas for improvement would be the lack of dashboards and integrations."
"As far as improvements, sometimes I get a bit frustrated when I move from a previous version to a new one because some configuration has changed—I need to investigate the documentation to deal with some configuration. But it doesn't take much time, so it's okay."
"The event correlation could be better."
"Zabbix does not draw automatic mapping of the network, this is something they should add in the future. There is a lot of effort that is involved in tailoring some of the settings which could be made easier."
Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Azure Sentinel, you can:
- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds
- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft
- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft
- Respond to incidents rapidly with built-in orchestration and automation of common tasks
To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.
Splunk Enterprise Security is a SIEM, log management, and IT operations analytics tool. The solution provides users with the ability to secure their information and manage their data in the cloud, data centers, or other applications. Splunk Enterprise Security also offers visibility from different areas, levels, and devices, rather than from a single system, thus, providing its users with flexibility. Splunk Enterprise Security can monitor data and analyze, detect, and prevent intrusions. This benefits users as it provides alerts to possible intrusions, helps users to be proactive, and reduces risk factors.
Break down data silos and gain actionable intelligence by ingesting data from multicloud and on-premises deployments. Get full visibility to quickly detect malicious threats in your environment.
Defend against threats with advanced security analytics, machine learning and threat intelligence that focus detection and provide high-fidelity alerts to shorten triage times and raise true positive rates.
Gather all the context you need and initiate flexible investigations with security analytics at your fingertips. The built-in open and extensible data platform boosts productivity and drives down fatigue.
Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Splunk meets you where you are on your cloud journey, and integrates across your data, tools and content.
Zabbix is a free software tool traditionally used for monitoring your organization’s IT infrastructure, including networks, servers, virtual machines, and cloud services. Zabbix makes it possible for you to maintain control of your infrastructure by collecting any metric from any source. The solution also offers agentless monitoring, synthetic monitoring, custom collection methods, and data transformation.
Zabbix has many valuable key features, including:
Action Log, Anomaly Detection, Auditing, Automated Actions, Availability Reports, Capacity Planning, Custom Scripts, Custom Templates, Data Retrieval, Drill-Down Reports, Encryption, Event Correlation, History Data Analysis, Metric Collection, Multiple Authentication Methods, Multiple Severity Levels, Native WMI Support for Windows Agent, Network Discovery, Notifications, Root Cause Analysis, Trend Prediction, WMI Support, Web Services Widget-based Dashboards, Zero-Maintenance
There are several benefits to implementing Zabbix. Some of the biggest advantages the solution offers include:
Reviews from Real Users
Below are some reviews and helpful feedback written by Zabbix users.
PeerSpot user Shibu B., Regional Manager/ Service Delivery at ASPL Info Services, says, "The solution is quite mature and very stable. The monitoring capabilities of the product are excellent.” He also adds, “The solution is very easy to scale and the product is open-source, meaning there aren't any licensing costs associated with it.”
Julian L., Senior Specialist Critical Infrastructure at an educational organization, comments that the solution is “A complete solution that doesn't cost anything, does what I need it to do, and has easy-to-use templates and very good scalability.” He also mentions “The agents are pretty cool. They're easy to roll out. The standard out-of-the-box templates are also pretty easy to use. The integration with other learning products is also good.”
Faycal N., CEO/Founder at Zen Networks, praises the product, mentioning, “Its overall flexibility is most valuable. When our customers have some custom applications that are not necessarily covered by the community or a standard monitoring tool, we use Zabbix to build our own modules with our own templates. This feature has been useful in using Zabbix for infrastructure and IT monitoring. It has also been useful for industrial equipment monitoring. Zabbix is very lightweight. It is efficient in terms of performance because it doesn't use a lot of resources."
Splunk Enterprise Security is ranked 1st in Security Information and Event Management (SIEM) with 71 reviews while Zabbix is ranked 1st in Network Monitoring Software with 35 reviews. Splunk Enterprise Security is rated 8.4, while Zabbix is rated 8.6. The top reviewer of Splunk Enterprise Security writes "Can be used to find any threats or vulnerabilities inside a user’s environment". On the other hand, the top reviewer of Zabbix writes "Very mature, easy to scale, and free to use". Splunk Enterprise Security is most compared with Wazuh, Dynatrace, Elastic Security, IBM Security QRadar and Datadog, whereas Zabbix is most compared with Checkmk, Nagios XI, Centreon, Nagios Core and SolarWinds NPM.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.