Splunk Enterprise Security is mainly used for enterprise defense like cybersecurity threat detection. We have SOAR and SIEM, Security Information and Event Management systems. We feed the data to them, SOAR.

Enterprise security tools, that's what SIEM is. It has multiple products too, including Anvilogic, which they integrate.

Definitely, it helps us to evaluate the threats, especially the risk. However, my scope is very limited to Splunk administration. I think we do use Splunk as primary. We still use the security modules, including the integration of the security modules or the multiple feeds, not only Splunk. We have Elasticsearch and other things, but Splunk is one of the major feeds for them.

View full review »

I work mainly as a system integrator directly for a Splunk Enterprise Security infrastructure and log source analysis or log source integration within Splunk Enterprise Security. I also develop dashboards for monitoring purposes and use cases for alerting purposes.

My focus is on SIEM, mainly in the Cloud and Cloud SIEM environments.

View full review »

Similar to other tools available, we use Postman, Bruno, VS Code, STS (Spring Tool Suite), and Eclipse. We also use PostgreSQL and pgAdmin for PostgreSQL management, Jira, and DNS dashboard for health checks of services since we have services registered. We monitor the health of the services continuously. Additionally, we use Splunk Enterprise Security, Honeycomb, and AWS Console to check the containers and services that are registered. These tools are essential to our operations.

View full review »

I'm currently working on Splunk Enterprise Security. I have been working with Splunk for almost seven years. I work in the banking sector for American Express, where we track all event logs closely. We also track security events and monitor each and every transaction. The fundamentals for which we use Splunk Enterprise Security include tracking each and every event that a customer makes when using their credit cards or their cards.

View full review »

One significant deployment we executed was for an organization looking to extend and modernize their existing SIEM capabilities. Their primary objective was to strengthen their threat detection, investigation, and response posture, which had outgrown their legacy solution.

As part of this engagement, they also expanded their Security Operations Center — bringing in additional skilled analysts to support the growing operational demand. The architecture we deployed centered around Splunk Enterprise Security as the core SIEM platform, which was then tightly integrated with Splunk SOAR to automate response workflows and accelerate incident handling. This combination of Splunk ES for detection and investigation, paired with Splunk SOAR for orchestration and automated response, delivered a comprehensive and cohesive end-to-end security operations capability.

View full review »

Splunk Enterprise Security is primarily used by Mews for phishing protection, as the company deals with numerous phishing incidents and wants to protect customers, which requires obtaining the right log in for proprietary data.

An instance of using Splunk Enterprise Security for phishing involves threat actors performing credential harvesting to create backdoor accounts. A more recent example is a detection that identifies a newly created user, identifies anomalous login behavior, and allows data extraction, which occurs in approximately 40 seconds, indicating an automated and sophisticated attack.

Risk scoring and risk-based analysis are also important, as different scores from the alerting help determine true positives and false positives.

View full review »

My main use case for Splunk Enterprise Security is utilizing the correlation searches in the SOC environment that I work in to triage events.

A quick specific example of how I use it to triage events is that recently it helped us in a lateral movement case where we set up the correlation searches to detect lateral movement using the different telemetry and logs that were available. We were able to determine if it was a false positive or not through that capability.

View full review »

Our primary use cases for Splunk Enterprise Security center around comprehensive content management and advanced security monitoring. We leverage the platform to develop and maintain our security use cases, while also supporting large-scale data collection, analytics, and real-time monitoring across our environment.

A key example involves our Office 365 visibility, where Splunk ES helps us track user login activity across geographic regions. This enables us to quickly identify logins from unusual or high-risk locations, investigate anomalies, and provide leadership with meaningful insights through dynamic dashboards.

We also rely on Splunk ES for real-time threat detection, using correlation searches enriched with threat intelligence. By ingesting threat intel feeds and aligning them with our use cases, we can immediately flag activity associated with known malicious IPs or other indicators of compromise.

Overall, Splunk Enterprise Security serves as a critical enabler for proactive detection, informed decision-making, and continuous improvement of our security posture.

View full review »

Splunk Enterprise Security serves as our security monitoring solution and logging solution. We are using it for threat detection and incident handling.

View full review »

Splunk Enterprise Security has been used by my company for the past four to five years. I have been with the company for about a year, so I have approximately one year of experience with Splunk Enterprise Security.

Splunk Enterprise Security has various complex use cases. In our environment, the most common use case is SIEM, which stands for security information and event management. This involves security monitoring, including various attacks monitoring and logs coming from firewalls and other devices. We monitor all the devices and networks as well, which is a very effective use case for Splunk Enterprise Security. Another important use case is threat hunting. Since SIEM has all the logs from all the devices, it makes threat hunting very easy and helps us find the source of all attacks or potential attack attempts.

View full review »

I primarily use it for SIEM operations including log monitoring, threat detection, and incident investigation. We collect logs from multiple sources such as firewalls, servers, and cloud platforms and use Splunk Enterprise Security to correlate events and identify suspicious activities. It acts as a centralized platform where we can monitor everything and respond to potential security incidents effectively.

View full review »

The business case we use Splunk Enterprise Security for is internal security and organizational security purposes. We use it for all kinds of use cases, depending on the project.

View full review »

We are consuming Splunk Enterprise Security because Wells Fargo routes all alerts and logs into it. I work on the reporting side that leadership uses to see the alerts and logs. Whenever threats or alerting occurs, we have kept a couple of algorithms based on which we can assume that this is not normal behavior on the server or any other devices that we are monitoring. It will alert to our systems, then we'll capture all the logs and present them on the reporting side through a dashboard.

Security monitoring, threat detection, and risk-based alerting are the key features that we use daily. Because this is a cybersecurity project, leadership wants to get alerts about what is happening overall at the enterprise level, whether there are any threats, and how to improve cybersecurity. There are a number of applications that are customer-facing, and they are under compliance, so we monitor those applications closely for any cybersecurity threats or issues. If there is something detected, we alert the application team that there is a vulnerability in their systems and these are the measures they can implement. It is a complete cycle. When we detect a threat or potential vulnerability, we report to the application team stating which vulnerabilities exist in their application and what they have to work on. Automatically, that dashboard vulnerability points get captured into a service board and from service board to the application team's Jira board. This is also called TCI activity.

My job and responsibility involves pushing the data to the corresponding team whenever we get an alert. The alert mechanism and all the algorithms have been completely designed by the admin team and the architect teams. As an analyst, I focus more on the data side. This is my source of record for my reporting. I access the Splunk web-based application directly through an API. I verify whatever comes to my database to ensure it is correct and check all the logs. There is a particular index that we use to check. We have a dedicated index for authentication-related items or data-level encryption items. All threats get alerted in the logs, and it is completely based on the risk score, which is an algorithm created for threats with a specific score. We track mostly scores where the score is more than 20.

View full review »

We are currently in beta mode with AI-driven detections, connecting with AI while using Splunk forwarders and API connectors to ingest data from SCADA systems, historian databases, firewalls, endpoint security platforms, and cloud services. So far, the beta platform is working as expected, although we are not fully integrated with AI yet. Splunk Enterprise Security includes threat intelligence feeds, which summarize alerts in bullet points for analysts, helping them investigate incidents.

I use Splunk Enterprise Security as a SIEM management tool that gathers SIEM, log management, and operational monitoring. We are using it to integrate with different systems and centralize logging in one place, where we create rules or alerts that generate when there is a match. We are using that tool as a necessity and for compliance as well.

View full review »

Currently, we are monitoring all logs for retention as well as real-time monitoring using Splunk Enterprise Security, and there is a log management component that utilizes the retention period. These are the things we are currently doing.

Threat detection in Splunk Enterprise Security is more than 60 to 70% faster compared to other tools. The main advantage is not only detection but also proper analysis, as other tools sometimes miss fields, while here we can search the raw logs for detection as well as evidence, which is very helpful.

Currently, Threat Topology and the MITRE ATT&CK framework in Splunk Enterprise Security are helpful, but we have not explored them in-depth.

The integration of threat intelligence directly into the TDIR workflow in Splunk Enterprise Security allows us to block more than 50% of threats, but due to our maximum customer environment, we cannot adopt it directly, so it is not fully automated right now.

View full review »

In my organization, there are many use cases for Splunk Enterprise Security, including potential risk, brute force attack, malware attack, ransomware attacks, and firewall-related use cases. We also have switch-related, inbound traffic, outbound traffic, login failure, and successful login use cases. I estimate there are more than 150 use cases in our organization.

View full review »

Splunk Enterprise Security is used for many different things. Primarily, it is used to create alerts for different use cases that need to be monitored, and then investigations can be created. At a high level, that is where many investigations start from. View full review »

As a SOC analyst, I use Splunk Enterprise Security primarily for real-time threat monitoring and incident investigation, and my main use case involves correlating logs from various endpoints, especially integrating alerts from CrowdStrike.

View full review »

My main use case for Splunk Enterprise Security is for security alerting, triage, SIEM, and incident response.

We use Splunk Enterprise Security for incident response with an MSSP that will triage findings or events, and then they will escalate them up as investigations in which our analysts will then respond to them. We then take in and start doing our investigation, adding notes, and eventually closing with disposition. If the incident comes from external to Splunk, we typically just conduct the investigation through Splunk and document it externally via our IR processes.

View full review »

In our organization, we use log management tools that collect data from multiple types of devices such as system applications and network devices like firewalls. We can collect logs from these network devices, analyze them, and report findings to the client side. We primarily use this for security purposes.

For our business improvement, we manage security for multiple clients on our side. This supports greater business development and improves our security posture. We can improve system reliability and reduce downtime while providing real-time operational insights. This helps our organization make data-driven decisions to improve customer trust, ensure compliance, and reduce operational costs.

We have achieved improvements by enhancing dashboard performance, reducing search execution time, and simplifying complex queries. The queries we work with are very complex. We have also benefited from better AI-driven threat detection and improved data management. These are areas where Splunk Enterprise Security can be further improved.

View full review »

I have been using Splunk Enterprise Security for about seven years.

My main use case for Splunk Enterprise Security is building dashboards, monitoring our data centers that we have built, using containerization to build dashboards, looking for anomalies, and testing for cybersecurity issues in real time.

A specific example of how I have used Splunk Enterprise Security is during a recent exercise for the students where they simulate a DDoS attack in AWS, observe what they are seeing, check the problem in the logs, and then troubleshoot and fix the problem from there. I use Splunk mostly for teaching, but of course, to monitor our data center environments as well.

I do this to teach young people Splunk, and our students have grasped the concept very well, going from not knowing what Splunk was to building high-quality dashboards that I referred to earlier.

View full review »

Splunk Enterprise Security gives us the foundation for collecting, indexing, and analyzing data, while Splunk Enterprise Security adds more security-specific capabilities like threat detection, correlation search, risk analysis, and investigation workflows. We use it to monitor security events from different sources such as authentication systems, endpoint, and network devices. It helps us identify suspicious behavior, prioritize notable events, and investigate incidents more efficiently. The advantage is that we can still customize detection and dashboards based on our environment instead of only depending on different tools.

View full review »

I have worked extensively with Splunk Enterprise Security for centralized log ingestion, security monitoring, and detection engineering. My objective is to improve enterprise visibility, reduce alert fatigue, and operationalize attack detection that is capable of identifying authentication abuse with lateral movement, PowerShell misuse, and privilege misuse in Linux environments and suspicious network activity.

My recent project focused heavily on enterprise security engineering and detection engineering, IAM Governance Analysis, which is identity and access management, cloud security operation, and resilience validation. This platform aligns directly with the areas I am actively expanding deeper into. At the end of all my logs and documentation, I link them to MetaTask, ISO 27001, and SOC 2. I have a couple of frameworks I use to analyze all of these topologies.

I was able to reduce unmanaged firewall exposure from over five thousand rows to eight hundred and fifty significantly. This was one of my enterprise projects I did on Zero Trust Security, all documented on my LinkedIn portfolio.

View full review »

When we talk about Splunk Enterprise, I have seen clients using it for their data analysis, collecting the logs and preparing meaningful insights out of it, like having dashboards created from the data that they ingest into Splunk. Apart from that, there is a SaaS platform that Splunk provides which is called the Splunk Cloud platform; it provides similar functionality, but the end-to-end config management is handled by Splunk directly. You just have access to the Splunk search head where you log in and can search the data you ingest into Splunk Cloud. Regarding Splunk Enterprise Security, I have seen customers using it for security use cases and to ensure that the environment or organization is not impacted by any SOC threats; basically, they use it for detection and mitigation both.

Customizing and developing new detections in Splunk Enterprise Security are quite simple since I have got experience with it for more than four years. I am quite familiar with it and enjoy working through that as well.

I do use disparate security solutions that integrate or import data into Splunk Enterprise Security.

The security operations are supported on a very great scale because let's say we have written n number of detections; we also need to ensure that we don't get alerted or notified on false positives. There is a dashboard in Splunk Enterprise Security that displays all the detections identified as a potential risk or alert to the environment. From there, you can triage the work to investigate deeper into it, and from the dashboard, you can drive it towards closure, with different drill-down options to investigate how a particular event was identified as a risk event and whether it was a false positive. If it wasn't a false positive, you can dive deeper into it using different response actions as well; all these customizations can be done and they support any third-party response actions that you want to apply to the Splunk Enterprise Security detection you have.

View full review »

Splunk Enterprise Security is used for our SOC, the Security Operations Center, which provides 24/7 monitoring. I am using disparate security solutions to integrate or import data into Splunk Enterprise Security. We use Splunk Enterprise Security to ingest the logs and do the monitoring.

As for alerting, especially risk-based alerting, it works well. It supports the use cases that we are looking for. Splunk Enterprise Security supports my SOC in terms of developing any new use cases. If we have any custom integration requirements or any custom use cases, we can easily develop that in Splunk Enterprise Security, and that's how we are able to leverage Splunk Enterprise Security for any custom use cases.

View full review »

Splunk Enterprise Security serves as our security tool, specifically functioning as a SIEM product.

View full review »

My main use case for Splunk Enterprise Security is risk-based alerts. I have a lot of scenarios, custom scenarios that add risk to a user. When it hits a certain unacceptable limit, we trigger the alert. There are many of these specific risk-based alerts.

View full review »

The clients who are using Splunk Enterprise Security are primarily using it for security as a SIEM solution, or they are also using Splunk Observability.

Generally, when you have the complete set of solutions such as EDR or DLP and then on top of it, if you have a solution such as SIEM, which is collecting logs and everything and then correlating that particular data, it takes somewhere around five to ten minutes to identify and start working on that particular issue.

View full review »

At the moment, we are using Splunk ITSI (IT Service Intelligence) with Splunk Enterprise Security suite solution to create the use cases. We have criteria to create use cases in such a way that as soon as we receive a request from a customer or internally, we need to see based on the MITRE ATT&CK frameworks and techniques and tactics. Based on that, we are going to create use cases in Enterprise Security. We will consider a few things, such as what the severity is and what it is based on the group, whether it is end-user support or application support. Based on that, we will create the urgency and all.

View full review »

Splunk Enterprise Security is primarily a security solution used for device monitoring. If there is any suspicious activity happening, Cisco will capture that and get you the alert, then your SOC team can analyze the issue and take necessary action to avoid the breach.

Analysis is the first point when suggesting the best features of Splunk Enterprise Security.

I think the firewall and all these network devices and security devices—routers, switches—they all need to be connected to Splunk Enterprise Security in some way, so that it can get the data from all these devices, and then SIEM can analyze that data and get us the alert. There are a few tools such as Snowflake Security Data Lake which integrates with Splunk Enterprise Security, and Splunk Enterprise Security has its own security data lake. There are multiple tools that integrate with Splunk Enterprise Security.

In the context of risk-based alerting in Splunk Enterprise Security, company-wise, they have different policies, but risk-based alerting is definitely a great feature that multiple customers utilize.

View full review »

I have been using Splunk Enterprise Security for the last five years, mainly building use cases for the SOC team. My role involves analyzing logs and writing vulnerability alerts based on what I observe. When security alerts are triggered, the security team receives notifications and takes appropriate action.

For the initial deployment of Splunk Enterprise Security, I cannot say this is easy. It is somewhat complex because when you purchase the product, you have a lot of data. You need to align all of your data so that it fits Splunk Enterprise Security standards. Splunk Enterprise Security has custom data models and custom correlation searches that are already defined. You need to modify or set your data according to Splunk Enterprise Security standards. Once you complete this setup, the product is amazing and will do all of the work.

View full review »

I verify users who have permissions to certain files, losing, or moving data. I use this for an overall view of the court system for our users.

View full review »

My main use case for Splunk Enterprise Security involves new detections and correlation of events. I use data points that are submitted via information-sharing communities and use those as artifacts, TTPs, and IOCs to build my own detections for behavior in my logs. Using those detections I can identify suspicious or malicious behavior.

View full review »

Splunk Enterprise Security was the major use case that I had.

View full review »

We use Splunk Enterprise Security for our security monitoring and incident management. This is our global application that we are using for security monitoring and compliance.

View full review »

My main use case for Splunk Enterprise Security is detection and engineering. We are looking for all different kinds of threats with Splunk Enterprise Security and then we ingest data sources from different telemetry to look at our posture, starting from MFA to everything else. That is our main use for Splunk Enterprise Security.

View full review »

My main use case for Splunk Enterprise Security involves log aggregation, anomaly identification, visualization of potential issues, errors, and threat modeling.

I create specific reports or dashboards to measure log patterns or events that fall outside of our specific thresholds, such as user logins multiple times a day or users attempting to hit protected routes that they don't have access control for.

View full review »

I work with Splunk as a service provider as well as a customer because we use Splunk internally.

This is used to run the Security Operation Center to conduct 24/7 monitoring for any security alerts and incidents for our use cases and use cases for our clients.

We do use some disparate security products that integrate or import data into Splunk. We have integrated Splunk with many threat intelligence sources, including external threat intelligence sources. We have a direct Splunk integration with CrowdStrike, and we have many other integrations with Splunk itself.

We have integrated Splunk with many log sources, including firewalls and other devices. From those firewalls and log sources, we have configured alerting in our Splunk environment. This helps us in detecting and alerting any security incidents.

View full review »

Our main use cases for Splunk Enterprise Security are to find the root cause of any applications, to see the dashboards, to see the logs, and to centralize some logging systems.

View full review »

Splunk Enterprise Security is mainly used for detecting and monitoring log analysis, threat detection, and incident investigation. It is primarily used for failed login detection where multiple login failed attempts occur from the same source IP. Brute force attacks are another common use case. Splunk Enterprise Security use cases can be extended through visualization on data dashboards, setting incident triage, and Windows event log analysis in SOC environments. I use it from a SIEM perspective in my organization.

View full review »

My main use case for Splunk Enterprise Security is visibility. I use Splunk Enterprise Security for visibility specifically for the IR team for cybersecurity incidents. Splunk Enterprise Security helps my incident response team detect and manage cybersecurity incidents by being the only tool they use for finding incidents.

View full review »

I am still working with Splunk Enterprise Security. We are a reseller of Splunk Enterprise Security, providing it to our customers.

On a daily basis, we use Splunk Enterprise Security for advanced threat and ransomware detection, providing it to our customers for threat detection and ransomware detection, as well as for detecting insider threat anomalies and for continuous monitoring and log analysis.

We provide Splunk Enterprise Security both internally as we are an MSSP, managing our customers and our internal operations.

Splunk Enterprise Security Essentials has contributed to a reduction in analyst burnout or fatigue by addressing the issue of receiving thousands of alerts, with nearly half being false positives, which creates a psychological burden and desensitizes analysts to warnings.

The integration of threat intelligence directly into our TDIR workflow helps us identify false IOCs based on external data, normalizing and correlating it with our internal networks, with Splunk Enterprise Security operationalizing TI feeds through highly structured workflows that manage multiple threat feeds effectively.

Over the course of using Splunk Enterprise Security, it has helped us grow our business and attract more clients due to its low mean time to respond and various analytic engines that help us address threats daily, resulting in positive customer feedback and satisfaction.

View full review »

I work with a couple of security solutions as well as devices. We have companies such as IBM, Splunk, QRadar, and many other SIEM solutions. I have worked with technologies such as DLP firewalls, proxies, file transfer solutions, and monitoring via security monitoring solutions. I am from a security analyst background.

Regarding Splunk Enterprise Security, we have both this product and Splunk as a SIEM solution with us.

Regarding Splunk's real-time capabilities, I have been using it from the monitoring perspective. We have been onboarding our customers over to the Splunk platform, gathering log details from the security monitoring perspective, and building alerts over the Splunk platform. It serves as a SIEM solution and SIEM provider by Splunk. Splunk is one of the most powerful SIEM platforms due to its flexibility, scalability, and advanced search capabilities as it uses the SPL language.

Splunk has interactive dashboards with cloud detection and cloud integration platform capabilities, having their own built dashboards which help to get all details with the VPC flows and AWS data, showing how much data has been thrown, what the detections and vulnerabilities are, and we can easily access that information.

View full review »

My main use cases for Splunk Enterprise Security are detections and incident response.

View full review »

The main use of Splunk Enterprise Security in my organization is for threat hunting activities, digging through logs by doing statistical searches and, as a result, having the ability to get results fairly quickly so I can then chain together searches or cross-reference information.

For example, I get bulletins with indicators of compromise from a vendor or an entity, a public administration in France, and then I search for the IOCs and from there, step by step, starting from that information I find, I cross it with other information to know, typically, whether the IOC that was found means that the user was compromised. Did the user go all the way, and what is the root cause of the malicious activity?

I am in pre-sales, so it is mainly for demos.

View full review »

My main use cases for Splunk Enterprise Security are event correlation and risk-based alerting.

View full review »

My main use case for Splunk Enterprise Security is log analysis and incident response.

I use Splunk Enterprise Security to review logs and see additional information about traffic at the firewall, which users are associated with which IP addresses, and what devices they used. Additionally, I use it for hunting through the analyst dashboard to review quarantined email and conduct foreign travel analysis.

View full review »

The typical use case for Splunk Enterprise Security is to meet regulations and requirements for critical infrastructure. It is used to audit changes and authentication logs. The second purpose is for security operation center management and security management.

View full review »

Splunk Enterprise Security is used primarily for reviewing notables and security events as a SIEM. My daily work involves reviewing notables across our environment, such as network traffic. For example, if one of the devices from our network reaches out to an IP that has suspicious or bad credibility, it gets flagged. I investigate that communication to understand why it is reaching out to that malicious IP and determine if it is something actionable or if it was blocked by the firewall. I review the logs and use Splunk Enterprise Security to conduct our incident response.

View full review »

My use case for Splunk Enterprise Security is mainly for enterprise defense, including cyber threats and cybersecurity threat detection, as I have worked at an administrator level within the security model which utilizes multiple feeds including Elasticsearch.

View full review »

Splunk Enterprise Security serves as our main security information and event management solution for our SOC. We have a setup to pull alerts for our SOC, and then we use it to work through each of the incidents we discover. We also use it to develop SOAR and utilize the SOAR piece to develop playbooks.

View full review »

Splunk Enterprise Security serves as our SIEM.

View full review »

My main use case for Splunk Enterprise Security is for detections.

A specific example of how I use Splunk Enterprise Security for detections involves VPN use cases, where we deal with clients who have numerous third-party vendors supported on VPN, leading to scenarios where users might share their VPN credentials, allowing access from disparate geographical locations. Splunk Enterprise Security is particularly effective at detecting these logins from different locations over a short period and alerting on these events, indicating users who are sharing their credentials.

There are quite many use cases, and some are user-customizable; for instance, we might have someone wanting to know which users got SSH access to servers over working hours or who is accessing RDP outside of working hours. We usually cover traditional brute force attacks and network intrusions within the rules that we enable.

View full review »

Splunk Enterprise Security use cases drive the workflow from threat detection all the way through to incident response, giving an approach mirrored with technology. Depending on use cases, whether having a tool drive some approach or conducting discovery, or looking to facilitate an operational security operations role at your company, it is very much driven heavily on the scheduler, setting things up and then looking and deep diving when necessary. Splunk Enterprise Security does well by giving a good framework.

Risk-based alerting is enabled in Splunk Enterprise Security. However, because of custom applications, a lot of times it works but doesn't work. Some discovery on our own is required, conducting our own campaigns to do that.

The time it takes the SecOps team to remediate any security incidents with Splunk Enterprise Security depends on the situation. Splunk skips over the whole trying to figure out how to use the tool. That is the biggest thing. Using Elastic SIEM and using other SIEMs, there is a learning curve, whereas with Splunk Enterprise Security, even if there is no one on the team who has mastery in Splunk, there is enough support and enough tooling and things that people have done before to really deep dive right in immediately.

Splunk Enterprise Security helps tell a story and helps focus at the customer level. As a managed service provider, I can only speak from the security side of it.

As a managed service provider, consolidating networking, security, and IT observability tools with Splunk Enterprise Security can be difficult, especially when providing those tools yourself. What Splunk does, and really is why it is a choice platform, is that it speaks all of those languages, no matter what IT discipline you are in. You are able to surface and view data in a quantitative manner and also get insights into what you are looking for. That is a very strong aspect of a tool where it does consolidate.

View full review »

The main use cases for Splunk Enterprise Security are primarily threat detection and insight. We have more of a focus on the insider threat, and we have it as a requirement of this new media to address any type of alerts or malicious activity from a special endpoint. Now it's inside.

View full review »

Splunk Enterprise Security's main use case is for security. We examined it to scan our network and to provide any vulnerabilities and concerns that we may have within our network.

View full review »

Splunk Enterprise Security serves as my main SIEM with forensics and response capabilities. I use it for threat detection, vulnerability management, and incident response for observability. 

View full review »

Splunk Enterprise Security serves as my primary tool for security monitoring and log aggregation, allowing me to write correlation searches. I also use it for anti-money laundering purposes and have developed several use cases around that functionality.

View full review »

My use cases for Splunk Enterprise Security involve mostly standard use case detections. Essentially, whatever log sources we ingest into the platform, we define use cases for detecting anomalous behavior, with most of our use cases tied to that. 

Additionally, we utilize threat intelligence; we always use lookup tables or MISP integrations to enrich those use cases or create reports and dashboards to monitor them periodically, depending on how noisy those alerts are. 

Other use cases include compliance-based use cases for auditing purposes, as there are compliance policy breaches we want to monitor proactively on a 24/7 basis. We do that, often within a mix of MSSP environment versus in-house.

View full review »

I have been using Splunk Enterprise Security for about five years.

My main use case for Splunk Enterprise Security is building security alerting detections for our SOC.

A quick, specific example of a detection I've built with Splunk Enterprise Security is that we detect users clicking on a malicious phishing link and alert the SOC for it.

To build that detection, we used the email data model as well as the content and alerting framework that is built in Splunk Enterprise Security.

View full review »

Audit reviews, log analysis, and asset visibility.

View full review »

My main use case for Splunk Enterprise Security is being an engineer for the SOC and insider threat risk team, where I monitor threat detection, manage the queue for a SOC, and ensure Splunk Enterprise Security data it uses is working properly.

I give a quick specific example of how I use Splunk Enterprise Security in my day-to-day work by tuning detections, creating new detections, enabling any new features that come in, assessing identity, managing that, or RBA, and addressing any issues that arise that SOC analysts see, working on those with Splunk support or with the internal team.

View full review »

Splunk Enterprise Security has an upper hand when compared with other products. We can correlate multiple data sources for generating alerts through SPL. Although many find it complex, we found it much easier because recursive query hunting for identifying threats is straightforward and quick. Those are the aspects which we really appreciated.

For detecting threats, we have created use cases over Splunk Enterprise Security. We have onboarded multiple third-party products with Splunk Enterprise Security. On top of that, we have created multiple use cases correlating multiple third-party vendors. For example, if event A happens where data is B, we have defined those scenarios in queries to trigger the alert.

View full review »

My use cases include continuous security monitoring on our log management, forensic activity, and threat detection piece and analytics of Splunk Enterprise Security. We are using Cisco and Splunk all-in-one console, where I can get the indexes, forwarders, and logs to consolidate my data center security and cloud portions. All logs will move to Splunk Enterprise Security.

View full review »

My main use case for Splunk Enterprise Security is to achieve security-related outcomes, streamline data analysis, and implement advanced detections with enriched alerting, threat detection, investigation, and response workflow.

A specific example of how I use Splunk Enterprise Security for threat detection involves reviewing audit logs to identify man-in-the-middle attack attempts and detect foul play related to installations or phishing attacks.

View full review »

Splunk Enterprise Security's main use case in my organization is centralizing alerts and seeing the risk by asset. Centralizing alerts and visualizing risk by asset has helped us identify which assets are compromised and give them proper attention.

View full review »

My main use case for Splunk Enterprise Security is detection and SOC activities, so everything related to detection and security. Every day, I use Splunk Enterprise Security to trigger alerts and analyze the risks that are currently affecting our company.

View full review »

My main use case for Splunk Enterprise Security is searching and log aggregation. I use Splunk Enterprise Security for searching and log aggregation in my daily work by investigating alerts that come across through our SIEM. I engage in manual digging through logs, searching based off of alert criteria.

View full review »

Our main use case for Splunk Enterprise Security is to gather all the information that we need and also create some dashboards that can help us understand what's going on in the network.

For example, we would like to see if there are any failed logging attempts and, based on that, identify the systems or computers that were attempting to access resources, the time they were trying to access them, and obtain the raw data to further investigate.

We also need to create alerts when problematic events occur. Additionally, when a device is not sending logs, we need to be aware of that situation. We also must be aware of any malware installed on the network and alert on that as well. We would like to have all of this information available in Dashboard Studio.

View full review »

We are an MSSP, and some of our customers have Splunk Enterprise Security, and we run it for them.

View full review »

I have been using Splunk Enterprise Security for over seven years, and many of my use cases include monitoring user behavior, tracking system processes that go up and down, and determining necessary actions when dealing with Windows admin endpoints. I examine CVEs and the vulnerabilities that require triaging and remediation. One of the main features and functions for my use cases with Splunk Enterprise Security involves alerts built on user activity.

There are numerous ways to take data and events, correlate them, or review correlation searches to populate the necessary information across any industry and environment.

Splunk Enterprise Security is a wonderful tool to have for enterprise security.

View full review »

My main use cases for Splunk Enterprise Security are security operation center and incident response.

View full review »

My main use case for Splunk Enterprise Security is to review logs of our assets and interests, other data assets, and create tables for management review to make the best informed security decisions.

I use Splunk Enterprise Security to make informed security decisions by reviewing current logs of any data spillages that may happen, any deficiencies that we may see with our assets, and reviewing logs monthly to ensure we remain compliant.

View full review »

My main use cases for Splunk Enterprise Security include extensive security operations.

View full review »

My main use cases for Splunk Enterprise Security are cloud-based use cases.

View full review »

My use case for Splunk Enterprise Security involves onboarding data and then CIM complying and normalizing fields. We are also using the data models mapping and the add-on configuration. We also have some correlation searches which are running using the data models. Using that, we have some dashboards that give us useful information and ideas of what we can do.

View full review »

During the initial two years, I was an incident response analyst who used Splunk Enterprise Security as a SIEM tool, and in the recent two years, I work as an admin who handles the integration part, content management part, and the detection response engineering.

We use disparate security solutions with additional IDS, IPS, and EDR tools integrated into Splunk Enterprise Security for single-handled monitoring for the analyst's ease. We do not need to go to each tool separately; instead, we integrate all of them into the Splunk Enterprise Security interface, allowing us to monitor them via Splunk Enterprise Security.

Regarding Risk-Based Alerting in Splunk Enterprise Security, we used to tag alerts while creating correlation searches in Splunk Enterprise Security.

I work with both on-premise and cloud-based setups.

View full review »

I would like to discuss Enterprise Security, and I explain that the main use case for the product is to protect our customers and support various attacks.

Regarding threat detection, I explain that during investigations, most of our SOC-related customers use Splunk Enterprise Security to identify threats.

View full review »

I deal with the Palo Alto FO and then Cortex XSIAM. I work with Cortex XSIAM and Cortex EDR products. We recently adopted Cortex XSIAM from Splunk Enterprise Security as our SIEM product for log management.

I have two to three years of experience with Splunk Enterprise Security, but not continuously; this is just a tool used by me, not daily. We send logs from the firewalls to XSIAM and analyze the traffic logs to determine whether deny or allow for migration. We use both Splunk and Cortex XSIAM for log analysis. I have never dealt with Splunk support.

View full review »

My main use cases for Splunk Enterprise Security include supporting production changes, which helps us ensure that we are not going to break the business from a DLP engineer standpoint. From an investigations and operations perspective, it allows us to look into all activities done by any individual, such as which emails they sent or what kind of data they have in their folders. We have logs coming from data at rest and data in motion channels, and all this combined is quite helpful for insider threat and data loss prevention activities.

One of the use cases I leverage Splunk Enterprise Security's dashboards and visualizations for is looking into risky applications. Since we manage the web side, we look into emerging AI applications in the market. Splunk Enterprise Security provides access to logs that show which category of websites are being accessed and what those are. We can see that in a search, yet visualizations dashboards enhance this representation. Instead of writing an SPL every time, any team member can go into a dashboard, input the application name they're interested in, and access all relevant details. These are some use cases, and you can continually build your own with Splunk Enterprise Security providing the platform for those developments while limiting access to only those who need to see the information.

View full review »

As a security analyst, my main use cases for Splunk Enterprise Security involve reviewing notables. I receive all the alerts and notables in my queue, review them, ensure they're not actual security incidents, and triage them as either true positives, false positives, and so on. I then investigate the true positives.

View full review »

I work for a cybersecurity-based company. We have our own products and solutions that we build and deliver to our customers, primarily revolving around Threat Intelligence solutions, TIP platforms, SOAR platforms, and incident response platforms.

The majority of tools that I work with are centered around threat intelligence, so we share threat intelligence for actioning on end security tools. These end security tools that consume threat intelligence are primarily Defender technology stack, which is how the entire arrangement functions.

Cyware has its own threat intelligence platform called Intel Exchange. This is a central data lake for all threat intelligence that any enterprise or organization might want to collect. An organization using threat intelligence from multiple sources collects threat intelligence from different types of open sources, RSS feeds, news articles, and blogs. They consume feeds from regulatory bodies like CERTs and ISACs, and they also purchase premium threat intelligence from threat intel feed providers like CrowdStrike, Recorded Future, and Microsoft Defender Threat Intelligence. When a customer has been consuming threat intelligence from these different sources, we consolidate everything, ingest it into a single platform, normalize it, and bring everything into a single structure. Threat intelligence is further processed, analyzed, and forwarded to end security tools for proactive blocking. If I am a financial sector company seeing other financial sector organizations like other banks getting targeted by a particular cyber attack, I use that intelligence to proactively block these threats in my environment before such an attack can happen in my organization.

I am using different tools including the entire Microsoft suite, most of the time working with Microsoft Sentinel, Microsoft Defender for Endpoint, CrowdStrike, Zscaler, and Splunk Enterprise Security.

View full review »

My main use cases for Splunk Enterprise Security are detection, attacks, analysis, and investigation.

View full review »

My main use cases for Splunk Enterprise Security are basically triage, ensuring cyber threat defence, and improving speed when defending the organization. Since I am the only one currently in the security team, we are growing this year and next, and we're expanding. Splunk Enterprise Security is improving the process to defend, basically.

View full review »

I'm an end user, admin, and consultant. We use Splunk Enterprise Security internally in our organization, and I also use it for my personal studies. My usual use cases for Splunk Enterprise Security include monitoring several kinds of exchange server logs and Office 365 logs, among others, as we have multiple monitoring use cases based on our requirements in our environment. We were trying to solve multiple things by implementing Splunk Enterprise Security, particularly for monitoring our applications based on the insurance business, so we use Splunk Enterprise Security logs for security purposes and internal infrastructure monitoring, including logs matching security purposes in our Office 365 and exchange servers.

View full review »

My main use case for Splunk Enterprise Security involves advising on how integration should be done, what the architectural diagram should look like, what data we should see, assigning tasks for performing gap analysis according to MITRE ATT&CK and international standards, and similar responsibilities. I used to be an analyst investigating information security incident cases, and now I'm in a more managerial position.

I cannot describe a specific example in detail because it is confidential information, as I am under an NDA. However, I can say that integration with various systems was carried out, and there were moments when Splunk agents were failing for unclear reasons. In the end, we performed troubleshooting and realized that the problem was on the agent side, requiring us to update the agents.

In terms of integration with various systems, I encountered no problems during the implementation of Splunk Enterprise Security.

View full review »

My main use cases for Splunk Enterprise Security are threat detection use cases.

View full review »

My main use cases for Splunk Enterprise Security are log management and enterprise security. Those are the key.

View full review »

My main use case for Splunk Enterprise Security includes SIEM, SIEM services, network monitoring, detections and response, and data correlation.

We had an incident where we experienced command and control activity from an endpoint, which was a Citrix server that we had that is air-gapped or essentially firewalled off from our network. We used Splunk Enterprise Security to correlate the data and see the activity that was taking place with the threat actor.

Splunk Enterprise Security helped us piece together what was going on in that incident by making the investigation easier. It helped us build a report much quicker and helped us trace the activity much quicker.

View full review »

My use cases for Splunk Enterprise Security involve both security as well as data analytics.

View full review »

Our main use cases for Splunk Enterprise Security include security, detection, and incident response.

View full review »

My main use case for Splunk Enterprise Security is for SOC operations. I offer the SOC service to our customers, and Splunk Enterprise Security is a very powerful tool that provides all the framework and tools to correlate events, conduct investigations, and manage issues or alerts.

View full review »

My main use case for Splunk Enterprise Security is RBA for Risk-Based Analysis Scores.

I am currently working through activating intermediate findings from our ESCU content as we just switched from risk-based or risk rules to intermediate findings, and we have over a thousand to go through, validate that are correct, and implement.

I'm newer to that function, so my experience with handling those intermediate findings right now is limited but growing.

View full review »

My main use case for Splunk Enterprise Security is threat hunting.

A specific example of how I use Splunk Enterprise Security for threat hunting in my organization is identifying incidents and threats. When I'm identifying incidents and threats, I use self-created dashboards in Splunk Enterprise Security.

View full review »

Splunk Enterprise Security by our SOC organization to aggregate and triage alerts used to identify IOCs.

View full review »

My main use cases for Splunk Enterprise Security are mainly building SIEM for our customers, implementing it at customer sites, and using it for our own developments.

View full review »

My main use cases for Splunk Enterprise Security are being able to take our noisy level detections and using features such as risk-based learning that are built into Splunk Enterprise Security, and bubble them up into one larger alert, which makes it easier for us to go after and find adversaries throughout our network.

View full review »

My main use cases for Splunk Enterprise Security are detection and investigation.

View full review »

My main use case for this solution is to detect threats.

View full review »

My main use cases for Splunk Enterprise Security have evolved over various roles, primarily focusing on the correlation of external threat intelligence in the notables existing in Splunk Enterprise Security, where we currently emphasize making it easier for our customers to bring in external threat intelligence such as from Recorded Future and correlate that against their entire telemetry to create notables indicative of alerts that could have been missed through traditional defenses.

View full review »

My primary use cases for Splunk Enterprise Security are correlation searches and the workflow that enables our SOC analysts to work through an entire incident from start to finish.

View full review »

My main use case for Splunk Enterprise Security is developing use cases. A specific use case I have developed with Splunk Enterprise Security is click fix detections.

To develop those click fix detections in Splunk, I first look up whether there are any applicable detections in Splunk Enterprise Security content updates and if there are some viable detections, I use them.

I have a big challenge with my main use case since I administrate five different instances and do not have access to detection as code, so it would be helpful to find a way where you can administrate multiple instances at once.

View full review »

I have been using Splunk Enterprise Security for four years.

My main use case for Splunk Enterprise Security is for our preparation for our SOAR deployment.

I use Splunk Enterprise Security through dashboards and alerts for that.

View full review »

The main use cases for Splunk Enterprise Security are that the majority of my clients use it for getting complete visibility in their entire ecosystem, including IT, OT, and IoMT devices, by bringing telemetry from those sources, sending it to Splunk, and asking us to configure customized use cases and integration with some SOAR platforms, whether it's from Splunk or from third parties like Fortinet or Palo Alto.

View full review »

My use cases mainly involve using Splunk Enterprise Security to monitor security threats, checking the dashboard for any alerts, looking at logs to see what is actually happening, and using the built-in searches to identify suspicious alerts regarding security or suspicious activity.

View full review »

My main use cases for Splunk Enterprise Security include detection engineering tasks. I work with the SIM team handling various responsibilities, specifically ensuring uptime availability and correct log ingestion.

View full review »

My main use of Splunk Enterprise Security in my organization is to create detection rules for our clients.

Notably, the detection rule that I created with this tool is the RBA rules, Risk-Based Alerting, that we have used for many clients.

To implement an RBA rule with Splunk Enterprise Security, we took the templates provided by Splunk and adapted them to our needs, allowing us to detect things we were not able to detect before, such as pen tests.

View full review »

My main use case for Splunk Enterprise Security involves knowledge object development, detection engineering, data normalization, and alerting.

A specific example of how I use Splunk Enterprise Security in my day-to-day work is creating Splunk TAs to map non-normalized data to the Common Information Model.

View full review »

My main use case is for log management and checking the logs. We have rules running in Splunk Enterprise Security. We are using it as a main SIEM solution for our customers.

View full review »

We primarily used Splunk Enterprise Security for data and cloud ingestion. We also leveraged it for enterprise security use case engineering, which encompassed malware analysis, threat management, detection, and the integration of threat and vulnerability intelligence, culminating in comprehensive reporting and dashboards. This was the principal use case for our SIEM platform. In recent years, we have also employed Splunk for user behaviour analytics to bolster insider threat protection.

We implemented Splunk Enterprise Security to improve security monitoring, threat detection, and incident response.

View full review »

Splunk Enterprise Security serves as my main security solution. We raise notable events and pass them to the SOAR for security purposes. When I raise notable events and pass them to the SOAR, I track insider threats and external security incidents.

View full review »

My main use case for Splunk Enterprise Security is reviewing incidents in the Mission Control dashboard for our clients. When an incident occurs, my analyst team and I review every incident and conduct investigations to view logs and perform formal investigations.

A specific example of how I have used Splunk Enterprise Security recently is when an incident in the Analyst Queue occurs or triggers. We review every property of the incident, including the host name, the user involved, and any risk events. Meanwhile, we work in an investigation file, and for the client, we deliver this as a PDF file or a Word file. Everything that we find in the alert or in the logs, we build a timeline so that when an incident occurs, we provide the client with the scope. When we deliver an investigation, the client knows what happened, who did it, and other relevant details.

I have been using the RBA framework increasingly. When an incident is happening, we review many things in this dashboard. When a host is involved, we review the most recent incidents in the risk framework, and when we review the alert, we know what was happening with this host.

View full review »

My main use case for Splunk Enterprise Security is investigations. A specific example of how I use Splunk Enterprise Security for investigations is diving deeper into triage alerts.

View full review »

We use it for real-time monitoring and alerts for all instances and servers on our sub-prod instances. It helps in monitoring, getting alerts for specific errors, and identifying various logs. We also use it for log analysis, which is very beneficial.

My use case is more related to production issues. Threat detection is taken care of by another team.

View full review »

I use Splunk Enterprise Security as a SIEM, and I mostly like to correlate whatever logs we see to view all the logs for the alerts.

We have everything that involves the apps in the company within Splunk logs. We have identity logs, vishing, and phishing. We also have some remote access and a bunch of alerts. Splunk's capabilities give the opportunity to see everything and have a timeline on the alerts.

View full review »

My main use case for Splunk Enterprise Security is creating dashboards and general overall system health and maintenance. For system health or maintenance, I build dashboards for threat intelligence across the bank environment.

View full review »

My main use case for Splunk Enterprise Security is security eventing.

View full review »

My main use case for Splunk Enterprise Security is web uploads.

View full review »

My main use case for Splunk Enterprise Security is cybersecurity for one of my government agency customers. In my role with my agency customer, we have alerts that come in, and junior analysts review them. As a senior analyst, I help develop new alerts and then triage ones that cannot be handled at the lower level or review ones that were handled to ensure they were done correctly.

View full review »

There are a thousand use cases covered. Splunk Enterprise Security covers the MITRE ATT&CK framework for initial access, remote executions with malicious codes, and many other attack vectors. All use cases are covered by MITRE ATT&CK, including initial access, executions, discovery, and credential access.

View full review »

As a threat detection engineer, my main use case for Splunk Enterprise Security is to create content to find anomalous activity in our environment. Splunk Enterprise Security, via the content management interface, allows us to create correlation searches, take advantage of summary indexes where we can correlate multiple findings per host, per user, whatever anchor point you want to use, and get those alerts to our analysts in a timely manner, where they can be triaged based on alert severity and criticality.

View full review »

My usual use cases for Splunk Enterprise Security involve creating notables, use cases, and dashboards. We are creating the use cases as per the defense of depth in all the security layers, such as the network layer or data link layer, DLP protection, and network protection. We are using firewalls and proxy, as well as IPS, and we are using Defender as Cloud App Security of 365 and EDR. We are using Defender as a single pane of glass, collecting all the logs from all the security devices, writing the correlation rules, configuring the notables, and monitoring 360 degrees of the organization's security.

View full review »

My main use cases for Splunk Enterprise Security include finding out excessive login failures, any compromised accounts, any compromised emails using phishing tactics with Proofpoint, network anomalies, User Behavior Analysis, and detecting rogue assets.

View full review »

My main use case for Splunk Enterprise Security is incident response.

View full review »

My main use cases for Splunk Enterprise Security are mostly for SOC, detection engineering, and incident response.

View full review »

Many of my use cases for Splunk Enterprise Security involve integrating with our networks and systems to troubleshoot and streamline our capabilities.

View full review »

My main use case for Splunk Enterprise Security is network security.

View full review »

My main use cases for Splunk Enterprise Security are security, general security, and SIM.

View full review »

My main use cases for Splunk Enterprise Security are insider threat, application security, incident response, and risk forecasting.

View full review »

My main use cases for Splunk Enterprise Security are threat alerts.

View full review »

Our purpose for using Splunk Enterprise Security is SIEM.

View full review »

I have been using Splunk Enterprise Security for five years.

My main use case for Splunk Enterprise Security is reports and dashboards.

I use reports and dashboards to show vulnerability information.

It helps my day-to-day work or decision-making by speeding up decision-making and making it easier to see trends to make decisions.

View full review »

My use cases for Splunk Enterprise Security are extensive in production. I utilize it for all available functions including observability, asset management, vulnerability management, threat detection, network security, identity management, and various other capabilities.

View full review »

My main use case for Splunk Enterprise Security is log analytics. I use Splunk Enterprise Security for log analytics in my day-to-day work by checking for failed logins from specific users, whether or not they're a known user or an unknown user, and seeing if this is abnormal behavior or someone who just forgot their password.

We also use Splunk Enterprise Security for tracking vulnerabilities and mitigations.

View full review »

Currently we are using Splunk Enterprise Security for monitoring the jobs and along with Splunk Enterprise Security, we are using DataDog where it will be used for monitoring the servers and our URLs.

Currently, we are using it only for monitoring because that is going to be decommissioned very soon. So we have only had it active for monitoring for the last four years.

Currently, we are using the on-premises and we are slowly going to be migrated to the cloud, and then we can use that for whatever we have existing. We can utilize it in the cloud.

Splunk Enterprise Security is only used for our MFT tool purpose, which is integrated with our MFT tool.

View full review »

After the acquisition by Cisco, we are focusing on our partnership with them as a Gold Partner and Tier One reseller. Following the acquisition, we also shifted our focus to Splunk. I am a system integrator implementing Splunk for customers in their environments.

View full review »

My main use case for Splunk Enterprise Security involves security and analyzing things using Splunk Enterprise in a SOC, and also building searches and findings there for our clients.

We utilized Splunk Enterprise Security for building new findings, and those findings are being analyzed right now by our clients, our bank client analysts, who are doing their best with Splunk Enterprise Security.

I cannot share anything unique about my main use case because I am under NDA, but we are trying to implement new products from Splunk, such as adding Splunk SOAR to Splunk Enterprise Security environment. We came to this conference to learn the best ways to implement it and to take experiences from other people who might share it with us.

View full review »

My main use cases for Splunk Enterprise Security include insider threat hunting, supporting operations, and Threat Intel integration for security; I have a lot of use cases.

View full review »

My main use cases for Splunk Enterprise Security include cybersecurity threat, incident response, and security events.

View full review »

Typically, the standard approach for Splunk sizing involves gathering data from the entire IT environment, regardless of whether it's hardware, virtualized, or application-based. This data is then collected and monitored through Splunk as a comprehensive security solution. We also work with Splunk-related platforms like Application Performance Monitoring to provide a holistic view of system performance. Recently, we implemented this solution for a bank in Jetar. Splunk excels at collecting high-volume data from networks, making it ideal for performance monitoring and scaling. During the sizing process, it's crucial to calculate the daily data ingestion rate, which determines the amount of data Splunk Enterprise needs to process and visualize for security purposes. Several factors need consideration when sizing Splunk: tier structure hot and cold buckets, customer use cases for free quota access, and storage choices based on data access frequency. Hot buckets typically utilize all-flash storage for optimal performance and low latency, while less frequently accessed data resides in cold or frozen buckets for archival purposes. In essence, the goal is to tailor the Splunk solution to meet the specific needs and usage patterns of each customer.

One challenge that our customers face is slow data retrieval. Customers may experience delays in retrieving call data due to complex search queries within Splunk Enterprise Security. These queries can sometimes take up to an hour and a half to execute. Our architecture incorporates optimized query strategies and customization options to significantly reduce data retrieval times. This enables faster access to both hot and cold data. 

Another challenge is scalability constraints. Traditional solutions may have limitations in scaling to accommodate increasing data volumes. This can be a significant concern for customers who anticipate future growth. Our certified architecture is designed for easy and flexible scalability. It allows customers to seamlessly scale their infrastructure based on their evolving needs, without encountering the limitations often faced with other vendors' solutions.

The final challenge is complex sizing and management. Traditional solutions often require extensive hardware configuration and sizing expertise, which can be a challenge for many organizations. This reliance on hardware expertise can hinder scalability and adaptability. Our architecture focuses on software and application administration, minimizing the dependence on specific hardware configurations. This simplifies deployment and ongoing management, making it more accessible to organizations with varying levels of technical expertise.

Our architecture leverages Splunk's native deployment features, including: 
Index and bucket configuration. Data is categorized into hot, warm, and cold buckets for efficient storage and retrieval. Active/passive or active/active clustering. This ensures high availability and redundancy for critical data. Resource allocation. Data, compute, and memory resources are distributed evenly across clusters for optimal performance.

For high-volume data ingestion exceeding 8 terabytes per day, we recommend deploying critical components on dedicated physical hardware rather than virtual machines. Virtualization can introduce overhead and latency, potentially impacting performance. Utilizing physical hardware for these components can help mitigate these bottlenecks and ensure optimal performance for large data volumes.

View full review »

We use Splunk Enterprise Security for security monitoring.

View full review »

My main use case for Splunk Enterprise Security is detection engineering and detection and response.

A specific example of how I use Splunk Enterprise Security for detection engineering or response is detecting potential account compromise, DLP, and insider risk.

Splunk Enterprise Security helps me detect those issues by enabling us to develop detection content based on threat intelligence research, and then we use the frameworks available to us in Splunk Enterprise Security to enrich those detections to provide analysts with contextual information to help them triage and respond to the alert.

View full review »

My main use case for Splunk Enterprise Security is using the SIEM for detections. A quick specific example of what kind of detections I use Splunk Enterprise Security for includes mostly the built-in ones, with one that comes to mind being possible travel.

View full review »

I have conducted research for some of our clients since I work in a consultancy firm, and customers sometimes have specific products. I made research on customer preference which usually leads them to go with Splunk.

We usually deal with Splunk for log management as a SIEM solution, where customers have logs on-premises and on the cloud and want to have a consolidated view. We recommend Splunk in these scenarios.

I am not very much aware of Splunk Enterprise Security; I research this and put it in my proposals mostly for log management.

Some of our customers are using the product.

I would generally recommend Splunk Enterprise Security for companies which are highly regulated or have to mandate certain compliances.

I would generally recommend it for bigger companies, not for smaller or mid-sized ones.

There are sometimes issues with availability where you have to wait a bit longer.

We deal with Splunk Essentials for certain customers, especially banks, who only need a SIEM solution.

View full review »

My main use case for Splunk Enterprise Security is getting observability and insights in order to meet compliance objectives.

View full review »

I work in a SOC team where I study threat hunting and threat determination. Most of my work is based on looking for malware traffic or suspicious traffic in Splunk Enterprise Security. I belong to the SOC team.

View full review »

My usual use cases for Splunk Enterprise Security include normal reporting.

View full review »

We use Splunk Enterprise Security for security monitoring purposes, and we have many security use cases configured to detect cybersecurity-related risks. We have 100+ use cases related to brute force attacks, ransomware, credential access attacks, et cetera.

We use it for the extra security layer since we want to be very proactive and monitor our infrastructure fully end-to-end.

View full review »

Main use cases for Splunk Enterprise Security include using it in the SOC environment, and currently, we have been using it for correlation searches, a lot of triaging within the correlation searches, and the visualizations and dashboards that it has available.

Currently, we use AWS for our workloads; the majority of the workload is within a cloud environment for us, and we also have a lot of EC2 instances that are set up within the environment for AWS, along with the RD2. We use all of that within Splunk.

My team uses cloud services on a day-to-day basis within the AWS environment, so we have migrated to be completely off-premises onto a cloud now.

View full review »

My use case for the project is thin.

View full review »

My main use cases for Splunk Enterprise Security are responding to alerts, looking for logs, and for investigations.

View full review »

My main use cases for Splunk Enterprise Security are detections and security.

View full review »

I lead a team that does Splunk administration. We mainly worry about the platform itself, ensuring everything works, log sources are coming in, and assisting with searches. We have a dedicated security team that represents the user side, the consumers of that data. We try to get all the log sources in for them so they can create detections, alerts, dashboards, and their own custom app integrations. We support them as much as we can in the platform, and they do their security work based on that.

View full review »

We have customized use cases for Splunk Enterprise Security as per our environment, due to our infrastructure related to cloud, virtualization, and a few application servers, along with Active Directory management, where we look for user interface and access management. We receive alerts related to any password breaches or unauthorized user access, or if any applications stop running. 

Consequently, we created multiple customized use cases, and accordingly, we receive alerts on Splunk Enterprise Security. It integrates with other tools for threat intelligence and anomaly detection. We are enjoying a good experience so far, and our admins ensure that the use cases are well-maintained. Additionally, they perform fine-tuning as needed. 

We have some database servers integrated for alerting us about unused services. We communicate with our database admins regarding incidents related to data management issues. We suggest actions to the database admins based on these alerts for better data management.

View full review »

We deploy Splunk for law enforcement agencies facing attacks from threat actors in China, Iran, and Pakistan. It helps plug the gaps because Splunk can easily identify malicious traffic.

In this instance, Splunk was only deployed for a specific department, not the entire ministry. However, this department has multiple cloud clusters for their operations, storage, and computing. Splunk is monitoring all of these clusters. It started as an on-premise solution, but then the department decided to go for cloud-based services that require a connector. Now, it's more of a hybrid solution.

View full review »

I am currently using Splunk Enterprise Security to gather various infrastructure metrics. This includes data from SQL databases, Oracle databases, applications, and APIs. All of this data is collected and sent to a Kafka stream, using a connector to feed it into Splunk. My responsibility is to analyze this data to meet observability requirements. For example, I need to visualize the data from Oracle databases and other applications to identify issues. Depending on the metrics, I aim to pinpoint servers that may be experiencing problems, such as high CPU usage, disk issues, or memory overload. By analyzing the Splunk dashboard, I can quickly identify the problematic server.

I am focused on creating a Splunk dashboard that allows users to easily identify issues at a glance. This will enable users or operations teams to promptly address any server problems. My work also involves using Excel queries and other tools to enhance this process.

I am also working on anomaly detection for one of the services we have, but that is just beginning. We have just started with the anomaly detection part where machine learning can be utilized, but it is still in POC work.

View full review »

The use cases depend on how you want detections to be set up. For example, you can have specific use cases for Office 365 alerts, Carbon Black, or more extensively towards MITRE ATT&CK framework. You can enable different analysis stories and alerts based on these use cases. You can individually go ahead and enable them. 

View full review »

I have created various correlation searches to develop use cases for detecting security threats. For example, I have created use cases to identify brute force attacks, unauthorized access, denial of service attacks, and distributed denial of service attacks. To date, I have developed a total of 190 use cases for our environment using Splunk Enterprise Security.

View full review »

Through Splunk Enterprise Security, we have implemented extensive login integration. This allows us to monitor and restrict access for sensitive accounts, such as superuser and master accounts when password rotations occur. If a login attempt is made for such an account, Splunk triggers a real-time workflow that automatically generates a P1 ticket for the Help Desk and IAM Operations teams to investigate and take necessary action.

Beyond real-time monitoring, we have established additional security measures. We utilize locks within JBOS to control manual account check-ins and user server activity, such as password verifications. Splunk ingests logs from any configured PAM solutions, enabling auditors and our technical team to readily access and analyze all privileged activities. We can also generate reports for session management, session logs, and audit logs.

View full review »

We typically suggest Splunk IT builds for customers with significant EPS requirements and large-scale data environments. While other solutions like Foundry and IBM QRadar may be popular, they often have limitations in handling big data effectively.

View full review »

I use other types of security solutions that integrate or import data into Splunk Enterprise Security, such as EDRs, firewalls, and other security products. The integration supports my security operations by providing one clear view of threat detections from firewalls and imported data.

View full review »

We are using the SIEM platform in our security operations center. We use it both for internal purposes, for monitoring the alerts coming from our network, as well as we have built security operation center services for our B2B customers. We are using QRadar, Splunk Enterprise Security, and more recently, we have added Elastic on top of it.

View full review »

I work in the pharma industry, and I use Splunk to aggregate all my reporting logs for my firewall and Active Directory logs. We have anti-spam, web application firewalls, and other solutions to secure our perimeter. We use Splunk for log management and have a stack to transpose a log from the firewall to a VM. When we directly feed the firewall logs to Splunk, they become intermittent and freeze. 

View full review »

I am on the intelligent engineering team responsible for onboarding logs and operationalizing Splunk Enterprise. We have a separate team for creating use cases and other stuff. I onboard logs and manage the infrastructure. When you onboard various logs, it creates different data models and normalizes the fields for compliance.

View full review »

We use Splunk Enterprise Security to secure our client's network and provide clear visibility.

Our client lacked an SIEM solution to comply with regulations, so we recommended Splunk Enterprise Security, and they agreed to implement it.

View full review »

I use the solution in my company to deal with certain migrations from a legacy SIEM solution to a new product like Splunk Enterprise Security or from on-prem to cloud migrations. Another use case involves implementing a new SIEM solution like Splunk Enterprise Security from scratch.

View full review »

We mostly use the solution for compliance, logging, log storage, and root cause analysis. In 2015, we had AIG as a client, and they only had Splunk. Splunk Enterprise Security is one of the oldest solutions that did the logging and storage.

View full review »

Splunk Enterprise Security provides us with both log monitoring and alerting capabilities from a centralized interface.

View full review »

We use Splunk Enterprise Security to analyze log data for log monitoring, creating use cases, onboarding, and incident response.

We wanted a single security tool that could immediately identify notable events that could be reported as security breaches, and then enable us to take intelligent action without having to purchase additional security tools.

We have two customers with hybrid cloud solutions. Neither customer is fully cloud-based. Our implementation is based on the customer's requirements, such as compliance, data ownership, and administration. We plan the implementation of Splunk cloud or hybrid models based on these requirements. We discuss the benefits and solutions with the customer to ensure that we are not breaching any compliance policies and that we are selecting the right model for their needs. Because we have multiple customers, we must also consider how to manage this process effectively.

View full review »

As a Splunk engineer, I collect data from various sources, including Universal Forwarder, Heavy Forwarder, DB Connect, and Syslog to monitor application logs. This data is used to create dashboards that visualize application health and identify potential security incidents. Additionally, I configure alerts to notify teams via Slack or email when CPU or memory usage reaches critical thresholds, allowing for prompt resolution. Furthermore, I use Splunk to create KPIs and NDDs for various aspects of the organization, including a custom ITSI service for Microsoft 365. This service monitors child entities like Teams, Outlook, and Edge within a parent application, tracking metrics like team member logins and meetings, CPU usage, and memory usage. All this information is consolidated into a three-page ITSI report.

Splunk Enterprise Security helps us detect malicious activity, such as failed login attempts by unauthorized users. These attempts, whether brute-force attacks or phishing attempts, trigger alerts with detailed information about the incident mapped to the MITRE ATT&CK framework. This allows our security team to investigate and take appropriate action quickly.

View full review »

We use Splunk Enterprise Security to enhance our overall security posture by proactively managing our threat profile across the enterprise. This enables us to see valuable insights and effectively monitor all OEM devices.

View full review »

I utilize Splunk Enterprise Security to create alerts within various use cases, including data onboarding, gap analysis, and business testing. I ensure that the use cases adhere to the defined criteria and address any changes or requirements raised by the client. Additionally, I handle any necessary backend modifications in Splunk by deploying code to appropriate environments, including the production environment.

We implemented Splunk Enterprise Security to capture more effective alerts. We create alerts to utilize advanced filtering capabilities. Additionally, we employ Sentinel as our endpoint security application. I have created all instances of the query as intended and have mapped them to Splunk. However, the corresponding alert is not being generated. These are the areas that require attention.

My expertise lies in Splunk Cloud and Azure. While I have worked with AWS in the past for a short period, my current focus is on GCP and Splunk Cloud. My responsibilities involve troubleshooting, alert verification, and key generation. Based on specific requirements, I employ my self-generated queries to identify the relevant fields, such as email or location. Next, I implement lookup conditions and pinpoint the table containing the desired field type. This process allows me to determine the specific requirement of the use case and define the search parameters accordingly. Finally, I conduct a time-bound search to identify any defects.

I deploy to Splunk Cloud, GCP, and on-premises environments. I have experience working with both platforms. When working on the cloud, we don't have the same level of visibility as we do on-premises. For example, we cannot directly access the fraud department systems. In the cloud, we must make all changes and deployments through the Splunk UI. This is relatively straightforward, as there is no backend to manage. However, it requires a thorough understanding of the configuration files and the data fields we need to modify.

View full review »

We use Splunk Enterprise Security for various security use cases, including writing correlation searches. This has significantly improved both our use cases and correlation searches. We can leverage existing resources, making modifications as needed, rather than starting from scratch each time. Splunk Enterprise Security provides diverse use cases across different environments, including AWS, Azure, and multi-cloud setups, while also integrating with Microsoft Sentinel. Additionally, we can integrate Splunk's service orchestration product for further automation. Overall, this allows us to automate tasks that security analysts previously performed manually, such as reviewing incident dashboards. We can fine-tune alerts based on analyst feedback. Splunk's research team ensures that use cases are updated with the latest security content, enabling us to understand and implement necessary steps while customizing them to fit our company's needs. This is what makes Splunk Enterprise Security so popular; it streamlines processes compared to legacy security products that often rely on manual scripts. Clients, including government agencies and banks, are transitioning to Splunk Enterprise Security due to its reduced training requirements and comprehensive features. Everything is consolidated, simplifying training and certification. Additionally, integrating Splunk's service orchestration product further automates tasks and improves response times. The substantial investment in Splunk indicates its staying power; no other product on the market currently offers comparable capabilities. Cisco's acquisition of Splunk reinforces its potential for success, combining APM, data logging, and security portfolios. In one financial project involving 600,000 users, we were able to monitor all incoming traffic, identify security activities, and distinguish between legitimate and malicious traffic, including phishing attacks and potential identity-based threats. Splunk enables tracking individual identities, crucial for detecting attacks where perpetrators hide behind compromised identities, often leading to data breaches and other security incidents.

We implemented Splunk Enterprise Security to assist with AWS security, which includes GuardDuty, CloudTrail, CloudWatch, and Inspector. These AWS components generate compliance and security alerts, which we correlate and use to create dashboard reports and identify security events for various use cases. We then enable the out-of-the-box use cases and send notable events to the dashboard. The implementation is currently in its early stages.

View full review »

I mostly use the solution in my company for incident response, ticket management, and integration with other endpoint products.

View full review »

We use Splunk Enterprise Security as our SIEM solution.

The log sources are in multiple cloud environments, but the deployment of Splunk is on-premises.

View full review »

There are lots of use cases such as finding threats, attack factors, and logs. It helps with rogue DNS or brute force attack detection. We have logs related to why a particular account was created. There is alerting. We can get some false positives, but by fine-tuning some of the things, we can reduce false positives.

Splunk is a security monitoring tool. It helps with incident handling, data logging, and observability of metrics. Splunk can handle all these things. Splunk Enterprise security is a premium app of Splunk through which we can have all the threat intelligence and incident reviews. It helps in finding all the attacks and Advanced Persistent Threats (APTs).

We also have dashboards. We can collect logs from different sources and applications. We can also troubleshoot issues. If we are having any issues with an application, we can go to that particular index to see what is the cause. If any application is failing or giving an error, we can troubleshoot the issue. We do not have to log into the server to find the error.

View full review »

My role is to design and implement and manage a strong environment. I need to ensure the available insights can be extracted efficiently and I use the solution for that. I also configure the Splunk custom dashboard and optimize searches to meet specific business needs. We also do a lot of troubleshooting and upgrading.

View full review »

The solution is used in my company to help the security operation center in work areas like detection, response, and investigation while maintaining cybersecurity standards.

View full review »

We use Splunk Enterprise Security for threat detection on our network devices.

View full review »

There are many use cases. Most of the use cases are related to security, data integration, and data sources. 

View full review »

I work in security and use Splunk for endpoint and application security, use case development reports, etc. I haven't used Splunk much for threat intelligence. We have a threat intel feed configured, and we create use cases based on those and the recommendations by the threat intel team. If something isn't covered, we create a use case for it. For example, if an application has an authentication interface enabled, we check all their authentication mechanisms and all the login policies. 

View full review »

I use Splunk Enterprise Security to analyze logs and data. When it comes to hybrid or multi-cloud, Splunk Enterprise Security has helped me find events. I use event logging and event IDs, which has helped me.

View full review »

For incident detection, this is the main purpose for which I can use the product. That is the only use case for my team. It may be different for my team who is actually processing the incidents and a bit different for me, as I am a manager. For me, the most important aspect is making statistics over a period, seeing who did what, and extracting all the needed information. It is quite easy and intuitive.

View full review »

My use cases are SIEM basically, which means using Splunk Enterprise Security as our SIEM effectively. We are taking all of our data from on-prem and some of our cloud services and importing them into Splunk Enterprise Security, then creating and generating alerts and reports based on some of our security use cases.

View full review »

We use Splunk Enterprise Security to track threats and errors and receive alerts and notifications.

We implemented Splunk Enterprise Security to improve our troubleshooting, mean time to detect and resolve issues, and our alerting system.

View full review »

The main use cases are with the firewall, DNS, and Windows events. These are the three basic ones to start with. Once they're done with all the compatibility and introductions, custom use cases will follow.

View full review »

I am a SOC lead, and we use Splunk Enterprise Security for alerting and working on incident review and incident response.

We have a hybrid environment. We have multiple clouds, and I am not sure if I know all of them. We have Azure Labs that we run for our students. We have cloud infrastructure. We have cloud applications on which we need visibility.

View full review »

I'm part of the Splunk operations team, which means I support Splunk functionality and occasionally conduct threat management onboarding. We assist various teams with threat-related tasks. If they need help bringing log sources into Splunk, we guide them through the process. Once the logs are onboarded, we create correlations to identify threats, troubleshoot issues, and help mitigate potential risks.

View full review »

I use Splunk for visualization, reporting, monitoring, log aggregation, and other security purposes. We gather various logs into one place and analyze them based on specific business use cases to get high-level insights that inform decision-making at every level of the organization. We also use it to aggregate other IT logs — not just security. 

Our organization is working in a massive on-prem environment. We're one of Splunk's oldest clients. It's convenient to migrate everything to the cloud, and we would have more flexibility. However, we currently have our resources and everything established to use Splunk on-premises, so we aren't switching to a cloud environment.

View full review »

Splunk Enterprise Security offers a wide range of capabilities that benefit our organization. This includes user behavior analytics, which helps us identify suspicious activity. Additionally, Splunk Enterprise Security allows us to create custom alerts for various internal security needs.

View full review »

We use the solution for detection, basic building searches, and creating many dashboards for investigation purposes. We have also been using it recently to create some RBA detection rules.

View full review »

We use Splunk for monitoring and investigation and recently integrated it with ServiceNow. It's a SOC tool, and any malicious activities on the client's side trigger an alert here. 

View full review »

We use Splunk daily to find the root cause of attacks and analyze users attempting to access our system. We create incidents and address 5 to 7 simultaneously. Once we analyze and record the activity, we can delete the incident. Our admin team will verify whether it originated externally or internally. 

We use Splunk to respond to security incidents and for data analytics. We conduct custom correlations for the customer and write reports on any attacks. We set alerts for user behavior to discover threats, like if someone is constantly attempting to access our internal domain. The admin will identify that threat and block it. 

View full review »

We use Splunk Enterprise Security for security correlation and event management.

Splunk Enterprise Security is deployed as a hybrid model where the core component is on the cloud and is integrated with an on-premises solution.

View full review »

I utilize Splunk Enterprise Security to gather logs, and subsequently, I provide the team with access to the servers through a change management ticket or incident. I wasn't involved in the installation process during my tenure as a Windows server lead. I also verify whether all our actions adhere to the compliance framework.

Our deployment of Splunk Enterprise Security was all on-premises.

View full review »

We use Splunk Enterprise Security to identify and resolve critical issues and errors within our environment.

View full review »

We use Splunk for log analytics, blocking dangerous files, etc. It helps to shape our security policies. Splunk is managed by our service provider, but we regularly get security insights from them.

View full review »

We mainly use the Splunk Enterprise Security app to use Splunk as a SIEM. I have worked with Splunk on-premises, which is Splunk Enterprise, and I have worked with Splunk Cloud as well. 

We mostly use Splunk for the SOC environment. We use Splunk for security incident monitoring.

View full review »

We use the solution for tracking successful and unsuccessful logins. We track privileged account activities and also a variety of other things, like developing use cases for data exfiltration or integration with ETRs and other security tools for data analysis. 

View full review »

We use Splunk Enterprise Security to detect different anomalies and alerts based on our infrastructure. I work in the telecom industry. We have multiple network and security devices that collect logs. We create use cases to collect logs from all these devices.

View full review »

My main use case for Splunk Enterprise Security is centered around threat detection and incident response. I’ve configured correlation rules and alerts within the SIEM to proactively detect suspicious activities. The environment includes multiple servers and security devices from which I collect log data using forwarders. These logs are ingested into Splunk, parsed, and analyzed to identify anomalies, security issues, and performance concerns. This setup helps streamline investigations and reduce response time to potential threats.

View full review »

We have an engineering team working on the back end to receive data, they do data modeling, and create dashboards. That's been pretty useful.

View full review »

There are tons of use cases for Splunk, but our main one is insider threat.

View full review »

I work on the engineering side, so we build for the SOC. The use cases revolve around how the SOC can better leverage the toolset and how we can improve the tool for the SOC to better identify threats within the environment.

View full review »

I have used the solution in my company since I was an admin for Splunk. Most of the people involved in the use cases associated with the product are those in the SOC team.

View full review »

I use the solution in my company, and most of the use cases are security-specific. My company uses it to transfer from our detection engineering team to our incident response team. For observability, our company is looking for security events within the tool, and we are logging all the critical security infrastructure and security-relevant logs to a platform for security operations.

View full review »

Our primary use case is for detected malware. 

View full review »

We use the solution for monitoring and detection and for threat hunting.

View full review »

We use the solution to find systems acting strange or having strange services and security attacks.

View full review »

Our SOC is using Splunk Enterprise Security as a SIEM. There are multiple use cases because it is the main tool for SOC analysts. We have plenty of use cases. It is being used for IT security monitoring. We also have some custom use cases for securing applications, and then we have some of our internal customers developing their own use cases, but the main purpose is for the SOC. 

We also have additional work that is much more tricky. It is related to using AI to detect insider threats.

View full review »

We use Splunk Enterprise Security for our security analysts for them to be able to view incidents. They are not 100% dependent on Splunk Enterprise Security as their incident source. They do have other tools that they use and other things like whois data, threat intel, and lookups for our domain. They are able to quickly look at the activities done for the assets that we have.

View full review »

We use Splunk Enterprise Security to monitor our network environment for abnormal activities and threats.

View full review »

The primary focus of our work with Splunk is on security incident monitoring and security log monitoring. This involves utilizing it to analyze and respond to security events effectively. Additionally, compliance with regulatory requirements is another crucial aspect of your role. We also extend Splunk's functionality to custom applications by writing custom parsers and handling logs specific to those applications. This includes the development of unique dashboards tailored to the needs of each application.

View full review »

I use Splunk Enterprise Security for monitoring, threat hunting, and quick response. By implementing Splunk Enterprise Security I aimed to address security challenges and threats for both myself and my clients.

View full review »

We use the product mostly just to pull out the reports, medical investigations, et cetera. As a security analyst, we can look at and pull data. You can make a central hub for a lot of different sources, including servers and endpoints. It makes it easy to check logs for every device connected.

View full review »

Most times I use Splunk Enterprise Security for log analysis, and I also use it to create alerts for any security incidents. There are some alerts I set up on my endpoint, and once the alert is triggered, I get a notification. I also use it for visualization. I create my own dashboard to send to my managers for analysis, for reports, and all of that.

View full review »

Our use cases are mostly for security and detection, basic use cases. It's always been a security use case. We never used it for observability or ITSI. 

Our analysts use it a lot.

View full review »

We use Splunk Enterprise Security for a lot of use cases. We use the predefined use cases and dashboards for AWS, notable events, endpoint detection network, and audit notable events.

View full review »

We monitor secure events and notable events in the system and watch for outside intrusion. We create a lot of dashboards to respond to these events. It's used to monitor our live system, and as things occur, such as alarms and other notifications, it's really helpful.

View full review »

Our use cases are for creating security analytics for our SOC team.

View full review »

We use the solution to build correlation searches around insider threats and exultation of data. We also use it for DLP (data loss prevention) and to get more visibility on what's happening in our environment that could increase risk.

View full review »

We wanted the solution to enhance the SOC ability. We were having trouble with some of our data being SIEM-compliant.

View full review »

There are a lot of use cases for Splunk Enterprise Security. The main one is when you are trying to detect an authentication attack. There are lots of people trying to get access to a system, so they are constantly trying to authenticate. Splunk Enterprise Security can quickly detect that through its correlation engine. If there is a specific attack of the anomalous amount of users trying to log into a system, it generates an alert. Our SOC is then able to analyze that alert and determine whether it is a false positive or a true event. If it is a true event, they can work towards containing that attack. If anything is a success, they can quickly provide that information to our incident response team.

View full review »

Our security relies on Splunk Enterprise Security to analyze data models for malware, threats, and MITRE ATT&CK techniques. Pre-built dashboards and multiple correlation searches help us identify anomalies. Any suspicious events flagged by the MITRE framework are categorized and assigned as tickets to our engineers for investigation and mitigation.

View full review »

Splunk Enterprise Security serves as our primary tool for endpoint detection.

View full review »

We are using it for our SOC. We integrated it with our SOC.

View full review »

We use Splunk Enterprise Security to monitor the network. We use the solution wherever there's a problem with the cell phone tower.

View full review »

Splunk Enterprise Security is used for security monitoring. It helps manage the governance of the security monitoring from the start of an incident to the resolution.

View full review »

We use Splunk Enterprise Security to teach our students about security awareness in a more positive way. We can show them how these tools work and the benefits they bring. This will help them understand the importance of using Splunk Enterprise Security, not just for our clients, but for ourselves as well.

View full review »

We currently use Splunk Enterprise Security for security monitoring. Previously, we relied on AWS native monitoring tools. In that setup, logs were forwarded to a Splunk dashboard which was also used by our L1 and L2 support teams to evaluate incoming support cases.

View full review »

I've been building SOCs for multinational banks across Asia and Australia, the Middle East, and right now in the United States.

It's the tool that we use to build SIEMs to meet logging requirements and to identify security issues across larger states of data sets.

View full review »

We essentially use Splunk for our Security Operations Center (SOC). All of the notables that we create for the SOC are done in Splunk Enterprise Security. It is our SIEM.

View full review »

We use Splunk Enterprise Security as the main SIEM system for our operation center. We use it for monitoring detection, and alert management.

We implemented Splunk Enterprise Security to help detect attacks on our network.

View full review »

We provide services to our clients as a security operations center and we utilize Splunk Enterprise Security for enterprise security purposes, encompassing various use cases based on client requirements. These include network attacks, malware-related attacks, inbound traffic-related attacks, recurrent activities, web-related detections, internal detections related to root flows, and service account-related use cases.

We are working to secure the enterprise's networks, devices, and infrastructure, as well as enhance overall security. Our goal is to monitor and protect against all types of external cyber-attacks. We will diligently monitor the systems and address any issues at the earliest stage possible.

Splunk Enterprise Security can be deployed both on-premises and in the cloud. We have primarily deployed the solution on Splunk Cloud.

View full review »

We use Splunk Enterprise Security to ensure the security of our endpoints, including corporate workstations, tracking proxy logs, and all of the other benefits that Splunk Enterprise Security brings, including observability and visibility into the environment.

We run Splunk Enterprise Security on a single search head, and it talks to about nine separate clusters. It's a hybrid environment of on-prem and AWS. Ideally, we will migrate that to a search head cluster for Enterprise Security for high availability. Then, in the upgrade process, we generally have about two hours of downtime when we upgrade Enterprise Security. Ideally, moving to the cluster environment will allow us to mitigate that entirely. So, we did some assessments earlier in the year. We've gotta do some finalized testing, but we're hoping that will eliminate almost the entire two hours of downtime for our customers when upgrading. Then, it's two hours from start to finish to get the search head back up, and that does not include backfill time or anything like that. It could be a good full workday. So getting that workday back is going to be very important for us, and that's where I think we're gonna end up evolving for the Enterprise Security environment.

View full review »

The primary use case is for failed login attempts. I typically stick to the security use cases.

View full review »

Our primary use case is mostly for monitoring security events. We have different endpoints, like router switches. It collects a lot of data and we create reports. 

We also use Enterprise Security to send alerts out. I'm still relatively new. I mostly work for the SPL side of things.

View full review »

We use Splunk for identity protection, threat defense, vulnerability scanning, zero-trust, and user entity behavior and analytics.

View full review »

I use Splunk to get logs from the on-prem servers and create dashboards, alerts, and visualizations.

View full review »

We use Splunk Enterprise Security for 24-hour monitoring and security log checks.

View full review »

We're using the solution for log analysis and our internal infrastructure. We may use it for customer offering at some point, but currently, it's completely internal.

View full review »

The solution is used to detect and protect against threats using a hypervisor infrastructure that works with artificial intelligence. 

View full review »

We provide comprehensive infrastructure support and ingest mine data in three ways. The first is Agent-based where the information is sent from client machines to an agent. The second is TCP port forwarding where data is sent to Splunk through an open port. The third is the HEC token. We then use the Splunk DB Connect app to ingest data as per the client's requirements.

View full review »

We gather all the security logs from all the endpoints, network appliances, and the security filter. We have set up automatic alerts that are sent to system administrators, so we have pretty much real-time alerts about anything that happens. 

View full review »

Our primary use case is SOC operations. However, we do have a lot of people sprinkled around that deal specifically with data analytics.

View full review »

Splunk Enterprise Security is a SIEM solution we use for security compliance and threat detection. 

View full review »

We primarily use Splunk Enterprise Security for security incidents and event management. The solution is deployed in one department, but it covers multiple locations worldwide. 

View full review »

We use Splunk to monitor unusual user behaviors. For example, if any user onboards from a different domain, it will trigger an alert. We also get alerts and high traffic when the ADI server is down. Splunk will monitor that behavior or when users make repeated wrong login attempts.

My full-time job is managing the IAM product. Splunk is one of our security monitoring tools. Most of my work is on IAM tools like CyberArk and SailPoint, etc. 

View full review »

Our primary use cases are for detection and remediation.

View full review »

The primary use case is computer network defense.

View full review »

Our primary use case is to find brute-force attempts on our systems. 

View full review »

We develop use cases for Splunk Enterprise Security all the time. I mostly work with the SOAR platform to ingest those use cases.

View full review »

Generally, we leverage it to correlate all of our threat intelligence data with all of our log events to make researching them simpler.

View full review »

We usually use the solution for the same functionality, which includes setting up alerting and making notables. We also use it for the workflow from ingestion, alerting, and response.

View full review »

We use it for alerting. It also helps our analysts triage.

View full review »

When we identify a threat in the environment, we try to track down whether it has moved from one system to another or there is any lateral movement. When we are trying to figure out how it got started and where it came from, we use Splunk to identify those logs. Palo Alto is our biggest index for the firewall, and we can look into those logs, see the relevant data, and correlate it into something that makes sense, so we can track down the problem.

View full review »

The solution is primarily for security incident investigation. Whenever a customer wants to monitor the environment for any security incident or events that are occurring, and they want to analyze the incident when virtual issues happen, that's when we propose Splunk. Otherwise, it's difficult to understand what kind of security event is arising in the environment.

View full review »

We use Splunk Enterprise Security to monitor our environment.

View full review »

We use Splunk Enterprise Security for security log investigation. It is a SIEM platform. Many cybersecurity and technical alerts generated by Splunk turn out to be false positives. We then analyze these alerts to determine if they indicate a genuine security threat.

View full review »

We use it in our company to log everything. We use tools like XSOAR to take appropriate actions to mitigate threats.

View full review »

We mainly use the solution as a reseller. We give our users the latest version of the product. 

View full review »

As a software analyst, I utilize Splunk Enterprise Security for security purposes, including threat hunting on developed and customized applications for vulnerability management. I also use it to display dashboards, analyze data, and address alerts.

We implemented Splunk Enterprise Security to consolidate all our security data into a single platform. This has enhanced our visibility into our security posture and the potential threats we face.

View full review »

We have many use cases for firewall logs in our system. We collect logs from these firewalls and customize our use cases.

View full review »

We primarily use the solution for SOC purposes.

View full review »

We use Splunk Enterprise Security for continuous monitoring, ensuring compliance, and advanced threat protection.

View full review »

I have worked in a couple of areas of Splunk. Initially, I was part of a monitoring team that used it for security information. I used to monitor security alerts which we used to get on Splunk, which was based on the use cases and we set up specific rules for it. Currently, I am part of the administration of Splunk. Now I onboard different log sources to Splunk. We pass over the logs so that it can be used for the security team.

View full review »

We have integrated different tools to get files from various types of endpoints. We also have Check Point. There are a few Windows use cases for brute force and code block attacks, and we use Splunk to detect when a user is logging in from another country where we don't do business. Splunk is integrated with our AWS environment, so we ingest logs from Amazon CloudTrail, GuardDuty, and other solutions. 

View full review »

Our SOC uses the solution to monitor our corporate and franchise environments.

View full review »

Being in an air-gapped environment, we pretty much look for insider threats and other notables related to improper configurations and against security best practices.

We are 100% on-prem and in an air-gapped environment, so there is no Internet connection.

View full review »

Our customers utilize Splunk Enterprise Security for either their cybersecurity program or their data warehouse program.

View full review »

The primary use case is security and data analytics. In general, we manage and maintain it for our customers.

View full review »

We implement Splunk Enterprise Security for our clients. It's a security tool that centralizes data in one location, so we can gain some insights from it. We can also use it to create alerts. For example, let's say we want to find an incident in real-time, but we can't sit in a single place and stare at the screen. We can create alerts that send us an email notification or automate a response. 

View full review »

We use it to provide both operational and security dashboards based on our clients' equipment. We use it for infra monitoring and threat analysis.

We have multiple rules for analyzing malicious activities and detecting breaches. We get the notable events from the logs and from there we drill down into the cause. We correlate that with the framework and get a score. Based on that, we proceed to the investigation.

View full review »

We use Splunk Enterprise Security as our primary security event manager. We collect data from various log sources into our Splunk SIEM to build context around what is happening in our environment. We then use the capabilities of Splunk Enterprise Security and other tools to enrich this data and help us manage the data, events, and detections.

View full review »

Our technical teams are demoing various enterprise tools to develop experience and knowledge so we can better serve our clients. In addition to Splunk, we are evaluating IBM QRadar and one other solution. One of our customers is asking about the Splunk MSP model.

View full review »

I use Splunk Enterprise Security for threat hunting.

View full review »

We use the solution in our SOC to support SOAR. We use its alerting capabilities and integrate them with our SOAR platform. Additionally, we tie it in with cyber threat intelligence, cyber threat hunting, and adversary emulation tools to identify gaps in our environment and alert us to notable events.

View full review »

We use it alongside some endpoints to detect log ins outside of scheduled work hours. If someone logs in outside of that range, we generate an alert for the security team to review.

View full review »

We use Splunk Enterprise Security for insider risk and security operations centers.

View full review »

I implement Splunk products in customer environments. I am not an end user. I implement the product on customers' cloud stack.

I have full experience in the implementation part. I know the end-to-end configurations in Splunk. I know how to configure it, index the data, and then how to use it to get some alerts.

View full review »

We are using Splunk Enterprise Security for collecting and analyzing logs. We are keeping up with the SLAs with Splunk Enterprise Security.

View full review »

I use the solution for data analysis and log collection. 

View full review »

We employed Splunk Enterprise Security for one of our projects. Integrating it into our environment involved opening network ports and making necessary connections.

View full review »

We use Splunk Enterprise Security for monitoring. We've been using it for monitoring our network. We've created some rules and use cases and we get alerts based on rules. 

View full review »

We are using the solution for security. We can use it to track what has happened in our network. We can check via dashboards and alerts. We can use it for load balancing and high-performance tasks. We use it to analyze data and logs. It normalizes logs and we can detect attacks, such as brute-force attacks. We can receive information from our firewall, our Fortigate. Since we receive a lot of traffic, we have to investigate events using the solution. It provides updates on attacks. The solution helps us report on what happens in our network.

View full review »

At a high level, its use cases are related to security monitoring, log aggregation, and a little bit of analysis related to incidents or fraud.

View full review »

We use it mostly to generate notables, and then we can use other tools, such as ticketing systems or other SOAR platforms, to investigate.

View full review »

My use cases are very limited. I use the product mostly to detect internal threats like data exfiltration.

View full review »

We use it for a lot of compliance work and incident reviews. We are also using it for remediation and tracking assets.

View full review »

We use the product to analyze security anomalies and research specific threats that we get on our network.

View full review »

I am the branch chief. I use Splunk Enterprise Security depending on how swamped the team is. I use it for anything from basic searches to DDoS attacks, which is a big thing right now. So, DDoS attacks and phishing emails are a lot of what I am using it for.

View full review »

Our primary use case is for cyber security, tracking logs, and incident response.

View full review »

Splunk Enterprise Security provides more visibility into endpoints in our environment.

View full review »

The use cases are mainly around monitoring for our clients' security operation centers and correlation of events and analytics for incidents that have been identified.

View full review »

Splunk helps us to be proactive and it integrates with many devices. It offers visibility from many different levels, areas, zones, and devices rather than from a single system. We can use this intelligence to create correlations, system solutions, etc. Splunk reduces the risk factors and helps us in many ways beyond just collecting logs. Though Splunk is costly, it has many features like threat intelligence which is very useful. It helps us be proactive about reducing risks.

View full review »

We use Splunk to monitor our private cloud, data center, and other applications.

View full review »

I went to a cybersecurity boot camp through Penn University, and we went over this topic for a decent amount of time. It was more of a testing environment where they gave us different file formats that we had to go through. We would upload those files to Splunk, and it would give us good examples of what it would look like under different circumstances, such as when an organization is getting hacked, when there is a DDOS attack, and so on.

View full review »

We are using Splunk in the standard information security use case. We're also using it for various application use cases around identity management, windows active directory, and those types of use cases.

View full review »

When configuring our use cases and describing the overall purpose of Splunk Enterprise Security, I would focus on the main use cases that I encountered with this tool.

View full review »

I'm a technical support engineer for Cortex XDR at the moment and in my company, we are selling the Cortex XDR solution to other companies. 

I also have experience with Splunk Enterprise Security and CrowdStrike too; we are using those products in my company. For Splunk Enterprise Security, I am using the Enterprise Security module and base Splunk for developing rules.

View full review »

My customers subscribe to many different tools, like CrowdStrike. They ingest all that into Splunk and use it as an aggregator to launch their investigations into any threats detected.

View full review »

We will have clients that generate events through our platform and wish to export those events as data points to Splunk.

View full review »

I used Splunk ES when I worked for a retail company. I worked mainly in the security operations center. I have also worked in healthcare and federal spaces.

View full review »

There is a lot that we monitor with it. We monitor outbound URLs. We monitor unusual traffic, unusual user logins, and excessive user logins. We monitor whether or not users are logging in from VPN or not, what IPs they are accessing, or whether a user is signing in from multiple IP addresses minus the VPN. 

View full review »

Our primary use case is for security but we also use it as a soft tool. It gives us an advantage over traditional SOC or security tools. We get to use the existing data in Splunk to make use of the security. 

View full review »

Our primary use case is for security audit log collection correlation. We wanted something that the security team could focus on versus going directly into our enterprise. We had some initial use cases to supplement our IT ops security into one product. We had a SIEM but not one that was as customizable as Splunk Enterprise Security.

View full review »

We primarily use the solution for monitoring, intrusion detection, and prevention. It is mostly a lot of security and network and server monitoring.

View full review »

We primarily use the solution for log management and security purposes.

View full review »

I work for a government agency and we use Splunk to monitor our Cisco equipment. I'm a senior network engineer and we are customers of Splunk. 

View full review »

The project we are working on with Splunk is short as the customer has given us two months to implement. My company is a Splunk partner.

View full review »

I need the product for SIEM, Security Identity Event Management. I also need it for security operations, automated response, as well as mapping adjusting of security components as well. It helps us with how best to look at various events, and orchestrate between various different hyper-scalers.

View full review »

We are using it for information assurance, system alerting, and compliance. We are using its latest version.

View full review »

Our initial use case was for security investigation, with the intention of creating some use cases. We ended up adding operational aspects, monitoring certain operational activities, such as high CPU utilization or any other applicational basis. 

This is obviously a cloud solution, but it does have some presence on-premises as well, so it's hybrid. 

View full review »

We are currently using it with SIEM, and SOAR which is Security Orchestration, Automation, and Response.

Splunk is primarily used for security, incident response, and security analytics.

View full review »

I have some experience with the solution, since I am working with customers who are interested in part time help monitoring their network and have been helping them fine-tune the rules in the solution's platform. The way the primary task works is to watch for and then respond to the threat. Should there be a need, I usually work with a team in fine-tuning the rules on this platform. We are providing the products.

I recently started working primarily on the Playbooks of the Splunk Phantom, so I've been creating some of these to help the customer automate the process of responding to the threats.

View full review »

In our organization, Splunk is used in our data centers.

We have integration services and other types of systems in our new IoT architecture. We're using it to capture information.

We use Splunk as an aggregator for monitoring information from different sources, however, for our protection suite, we're using Comodo.

It's designed to collect data from different points. It has a lot of integrations built into it and that's why we're using it.

We use it for our enterprise more - such as for messaging. There's a lot of stuff we do on our integration services layer that we use Splunk for. For security purposes, we're using Comodo. Therefore we're not using Splunk for security purposes. We're using it for monitoring what's happening at our integration services layer.

View full review »

We typically use it for centralized log management and SIEM functionality.

I am using the most recent version of it.

View full review »

It's the mainstay of our monitoring solutions that we have for auto-logging, et cetera, for our enterprise solution.

View full review »

As there is no SIEM solution here at present, we are building it up through the assistance of a vendor. In the past I worked in the Splunk Cloud, which was seven-point something. With QRadar I worked on version 7.3. 

We use Splunk Cloud as a SIEM solution and to monitor traffic and the network for detection purposes. We can create use cases so that if the solution picks up on anything entering our organization, the malicious IP can be blocked. 

In respect of ones which are suspicious, based on the logs we pull from the data source, we can build the use cases accordingly and have our analysts work on these. 

View full review »

We are using Splunk as a SIEM tool. We're using it for monitoring.

View full review »

We use Splunk on-premise. We mostly use it for log analysis and fraud detection. We are also testing using it in machine learning and other solutions. We have 10 people managing Splunk and we have approximately 150 people using the product in total.

View full review »

I use Splunk on-and-off — I started with in-house projects, then moved up to commercial projects. 

View full review »

We are a software development company and Splunk is one of the products that we have implemented for our clients. It is used for log analytics as well as the mobile SDK for checking the stability of mobile applications.

View full review »

Since we have an IT services company, we have been using Splunk for the deployment to the customer locations as well. Sometimes the customer will come back to us and say that we need to have a SIEM tool, and when we do the benchmarking, we'll do a couple of deployments on the Splunk side and at the customer's locations as well.

As an example use case, we deployed Splunk to a banking institution a few years ago. There the use case was basically this: the customer wanted to set up a security operation center, and they wanted to have a pretty large deployment in terms of the number of endpoints and number of switches and routers. There were many regional branch offices and they have data centers and therefore, many assets in terms of endpoints. They had 30% of their assets are running on the cloud and they needed a complete solution from an incident monitoring and management perspective. That's why we deployed Splunk. 

They wanted to reduce the MTTR, and meantime resolution, and maintain detection. They didn't want to add more SOC analysts into their SOC as the organization scaled up. They have a plan to scale from 5,000 endpoints into 15-20,000 endpoints. They're very particular about deploying the SOC operation center.

Splunk has since acquired Phantom as a SOAR platform. Therefore, we have tried to manage the security automation using Phantom with the help of Splunk deployments. It helps us meet the customer's requirements.

View full review »

We are using the mobile SDK to check the stability of mobile applications.

View full review »

We are using it for logging and monitoring.

View full review »

We use Splunk Enterprise Security for our enterprise security.

View full review »

I used it in the SOC environment to get logs, create dashboards, and filter out data.

View full review »

Splunk just acts as an extra presentation layer, and we tried it because of the plugins they have to try and get more logs into the environment.

View full review »

I use Splunk for testing purposes. It is used for school research and to learn how to use Splunk. 

Splunk is mainly used for collecting logs and dashboards.

View full review »

We are using Splunk for querying data from different sources.

View full review »

We work with Splunk. We use it for our own services, and we also integrate and resell Splunk. It is used for cyber security. 

Different clients have different versions. They have Splunk Cloud and Splunk on-premises with different versions.

View full review »

We are a solution provider and Splunk is one of the products that we distribute.

The primary use case is for SIEM and we have approximately 35 customers.

View full review »

There are many use cases for Splunk, we commonly use it for log management and analytics.

View full review »

Our company is an IT service provider. We are resellers of Splunk. One of our clients that we monitor is a laboratory that uses this solution.

Splunk is a change management solution. We use the solution as a log collector, and to analyze and provide alerts from the IT instructor.

View full review »

We use it for security operations and management.

View full review »

The solution is primarily a SIEM tool and it basically helps companies with security.

View full review »

My primary use case is for log management. It's mostly deployed on-premises, but it can be cloud-based as well. 

View full review »

We are resellers. We provide solutions to our clients.

Splunk is primarily used for developing CM solutions that are based on the Splunk platform for future security operation center development.

We are concentrating on assisting in the development of a security monitor as well as analysis.

If I am not mistaken, it's a standard CM system for identification, security verification, and event monitoring.

View full review »

We use the solution for monitoring systems. We also use it with servers and CG routers from the data center, as well as for collecting the ADL from all networks which are located in our regions of the country.

View full review »

We primarily use the solution for security and operations monitoring.

View full review »

We typically use Splunk to collect and check all the logs and events around the diverse network environment which includes, firewall, switches, and routers. For example, we have traffic that needs to go from one part of the network to another and if we think there is a firewall blocking it along the path, rather than log in to all the firewalls to see what is happening, we simply go into Splunk and the check traffic going across the parts of the network to see where it is being dropped and what is the likely reason it has been dropped.

View full review »

We use Splunk for analyzing data.

View full review »

Typically, we use the solution for critical infrastructure companies. 

View full review »

We're using the solution to try to build a virtual network and put Splunk inside it and do some kind of transcentralization with a log server. Our aim is to track connections, network traffic and some personal databases. I'm the founder of the company and we are customers of Splunk.

View full review »

I use this solution for data visualization.

View full review »

We primarily use the solution for monitoring and security.

We can use the solution to try to find some correlational data. For example, in banks, there is usually a protocol whereby users cannot withdraw more than a certain amount of money from an ATM. However, we find that, when people are on holiday, they are trying to withdraw more than the allowed amount. It's a use case we can deploy in our country. You can set certain rules and watch the data in order to gain insights.

View full review »

We are using it for security information and event management (SIEM). We have started to use Splunk recently, and we are in the implementation phase as of now.

View full review »

We are using Splunk for cybersecurity operations.

View full review »

We are a solution provider and Splunk is something that we provide as a service to our customers.

View full review »

Security. We have built SIEM solutions three times from the ground up (not ES) using Splunk for some of the largest companies in the world.

View full review »

We have multiple use cases, almost 200 plus use cases. An example, travel activities where you log in.

View full review »

My reason for implementing it was just to learn more about the product. I wanted to learn about the Splunk programming language, how to pipe searches, add logs, verify the logs, create fields, extract data into fields, build dashboards, and to get hands-on experience with the product.

View full review »

The primary use case of this solution is to monitor Cyber Mission databases.

I create the diagrams to create an architecture that is then implemented. However, creating these diagrams are for my own learnings since these implementations are usually already available in the cloud office logs.

View full review »

I'm the CSSP manager and we are customers of Splunk. 

View full review »

We primarily use the solution for monitoring our infrastructure.

View full review »

We use Splunk for security and also PCI compliance.

We have installed and implemented this solution for several clients in Bolivia with our team. We have received training from Splunk directly, and we have also provided training to our clients.

We deploy two versions: one for on-premise and one for the cloud.

Most of our customers purchase Splunk because they required a tool for gathering and collecting all of the logs from the infrastructure in order to make a correlation between data and to spot patterns surrounding security incidents.

View full review »

We are using Splunk to look at the logs, and see what is happening.

View full review »

We use a lot of sales metrics. We use machine learning models to provide sales forecasting. We create database connections and run a query on the database. The next step is to place the data into Splunk. We create indexes to get the data into the Splunk dashboard.

View full review »

We use Splunk for log analysis and security monitoring.

View full review »

The solution is primarily used to monitor the operating system for threats, specifically related to login threats. If someone trying to log-in, or somebody trying to break into the system, the idea is it will check that and catch things. It's mainly for external threats to the operating system.

View full review »

Our primary use case of Splunk is for log monitoring and infrastructure monitoring. If we want to diagnose any issue in our application, we just push our application logs. This is on any client server using the universal forwarder logs on the Splunk server. After indexing, we can create a base log, and create attractive dashboards that are simple to understand and use. I'm a system administrator and we are customers of Splunk. 

View full review »

It's the primary place where I'd go to do an investigation if I want to see what's going on within an endpoint, or on a network, or with a user.

View full review »

Our primary use case is for monitoring and cybersecurity.

View full review »

We were using Splunk for our networking to know exactly what kind of the traffic was going from one network to another network because we had a lot of the connections on other sites.

View full review »

We need something to collect all our logs in a centralized solution. We have several servers but we don't have any log collection system.

View full review »

Log collection and search.

View full review »

Testing for insider threat behavior.

View full review »

We use it to do SIEM. 

View full review »

• Log collection and analysis
• Reporting for the whole enterprise environment.

View full review »

Our primary use case is reporting from the Windows administration. We have SCCM that configures the manager to update every PC workstation and server in the company. We have a lot of PCs and servers in our environment and we use Splunk for the gathering of the PCs and Windows service. We also use it to collect information from the security tools, for example, to provide the management information about how the everyday connection is. 

View full review »

We use it for security incident event management and for IT service intermediates.

View full review »

Our primary use case of this solution is as a centralized lab collection.

View full review »

Our primary use case was really as a client organization, like the government and the IT industries, we are in the telecoms sector. We analyze security reports. We use Splunk to order them and put them in a system and we use the various kinds of integration with Oracle Cloud which is helpful.

View full review »

• SIEM
• Security information 
• Event management

View full review »

Splunk is our central locale for cybersecurity and protection.

View full review »

In the beginning, we just wanted to collect the logs from the different devices, like the nano storage, Linux, Windows, and VMware. We tried to get the uniform solution to collect and analyze all of the system logs.

View full review »

We use it for logging and troubleshooting.

View full review »

We use it for log aggregation. 

If you have a large number of devices, you need to aggregate log data to make more sense of it for parsing, troubleshooting, and metrics. This is all we use it for.

If I need to track logs for certain application, I will push all of those logs to Splunk so I can run reports on those logs. It is more about what you are trying to do with it and what you need from it.

View full review »

We use it for searching logs in a production environment.

View full review »

It is mostly centralized logging, a whole bunch of BI metrics, and an aggregation point, which we have adulterated for some PCI data.

It does meet our use case for the most part.

View full review »

We use it for application log monitoring.

It is a logging product. Our application generates log files, then we upload them to Splunk. We run their agent on our EC2 instances in AWS, then we view the logs through their product, and it is all stored on their infrastructure.

View full review »

The primary use case is for log analytics. Although, we have been using it as a hammer which hits all the nails. We have sort of overused it in some areas where it doesn't need to be used.

View full review »

We use it mostly for log monitoring, and also for trying to raise alarms.

View full review »

We primarily use it for SIEM.

View full review »

We use it for log analysis and alerting, and our stock analysts use it.

I have used the product for more than five years. Then, in the cloud, I have used it for probably a year. It scales better in the cloud than on-premise.

View full review »

• Log mining
  
• Log analysis

View full review »

We use it for logging, essentially for auditing and troubleshooting errors in production and finding out what happened.

I have used the product personally for five years and at my current company for a year and a half.

View full review »

It helps increase our productivity.

View full review »

My primary use case for Splunk is for log file visualization and monitoring alert management.

View full review »

I work in the HIPAA industry. I work at a healthcare company in Puerto Rico. HIPAA requires us to go over security risks. Our use case right now is to be compliant.

In our hierarchy, we have 1000 servers and 16,000 endpoints. We also have 100 entry points and 3000 VPN connections. It's huge.

View full review »

• Cybersecurity defense
• Web app monitoring
• VMware monitoring
  

View full review »

We use Splunk for a few different use cases:

1. We package it as part of one of our on-premise software offerings which includes our in-house customized dashboards.
2. We use it for Application Monitoring of many of our back-end systems. Monitoring is done completely through Splunk by forwarding application and other logs to Splunk and many configured customized alerts and dashboards for the Ops, Dev, product, and management teams.
3. We created a custom anomaly detection data model to monitor the activity of our back-end services on an hourly basis relative to the past three months of activity.

View full review »

Splunk is a SIEM, a Security Information and Event Management solution. It is used, for example, for monitoring security logs and security information in companies and organizations. It is also used for correlation, meaning making policies, for detecting/monitoring attacks, and the like; for monitoring security logs, security events, preventing hackers from attacking. It's really for business continuity.

View full review »

We use Splunk for infrastructure monitoring, application monitoring and in the security space for our organization as well as for our customers.

View full review »

• IT Ops
• Security
• Compliance

Many IT groups and non-IT groups use the product to gain insights into their environments.

View full review »

With the use of Splunk, we were able to identify a brute force attack against a "switch" network device. An external attacker attempted to connect multiple times using multiple usernames. Splunk was able to detect these attempts and immediately blocked these attempts.

View full review »

We primarily use it to correlate logs throughout the enterprise for both searching and use in investigations.

View full review »

I work with Splunk, as a contractor, so I use it in many different areas. Most often it is used to get performance insights on applications or servers. Recently, I have used it in more of an endpoint security mindset. 

View full review »

Splunk provided me a platform to analyze both infrastructure loads and application performance for quick troubleshooting saving a load of time. Versatile apps at Splunkbase helped me to better configure and enhance visualization of the KPIs in my application.

View full review »

• Log monitoring and alerts
• Looking up information 
• Dashboards for nice, fast information about various application servers.

View full review »

The primary use case is to analyse and monitor big data, creating various dashboards, alerts, etc.

View full review »

Although my company uses Splunk extensively, my use case is primarily the Enterprise Security add-on.

View full review »

We use Splunk primarily to provide our security and ops groups with important insights to more efficiently make decisions and take action.

View full review »

Security analysis to identify issues and for use in incident handling. Correlating logs across over 1000 servers with different operating systems and applications logs to provide security insights. 

View full review »

We started using Splunk to serve as a SIEM. In addition to correlating security information, we have begun to use it as a developer and customer advocate by analyzing user behaviors and system response times. 

View full review »

Security and incident management, which is helpful when organizing the data from different systems and running analysis on all the data together.

View full review »

• Monitoring IT and other processes for a large university.
• Leveraging alerts and dashboards to detect and predict security breaches and other events.

View full review »

Splunk is our monitoring and investigating Swiss Army knife for key applications and systems. If we run it, we Splunk it.

View full review »

IT service analytics: 

• Server machine data
• Monitoring data
• Alerting data
• ITSI KPIs
• Real-time reporting
• Month-over-month reporting.

View full review »

Operational intelligence monitoring for several different systems. We collect logs from applications and performance data from hardware, as well as information pulled from databases.

View full review »

Primary use is business intelligence. 

View full review »

We primary use Splunk for log aggregation and search across multiple systems with Splunk Enterprise Security layered on top. 

View full review »

We use Splunk for operations, application monitoring, and security. We are both cloud and on-premise based, so it has been very versatile for us. 

View full review »

We use Splunk for both monitoring and SIEM. Our security operations group uses Splunk to track user accounts which may have been compromised as well as follow those accounts through the organization.

View full review »

Central repository for log collection and analysis in a complex environment. We have used it for a variety of use cases involving SIEM and operational support.

View full review »

We used it to create a full security operations center (SOC) for our IT department by adding all network and security devices, the AD, and mail servers to it. Then Splunk started to receive their logs, it analyzed them, and provided useful reports.  

View full review »

• Searches the logs for all network devices and server. 
• Monitors clients' hardware, networking, and security operations. 
• It is good for the administrator to use it when maintaining the whole IT Infrastructure.

View full review »

Our primary use case of Splunk has been on the implementation side for clients. Splunk has proven, on multiple occasions, to be extremely useful in the proactive monitoring of clients' hardware, networking, and security operations. Some use cases that we have implemented include, but are not limited to, proactive account lockouts based on machine learning of a typical person's average number of failed login attempts, aggregation of a servers logs in order to predict downtime/maintenance/hardware failures quite accurately, as well as helping administrators of all sorts to gain a full picture of their environments under a single screen.

View full review »