Splunk Enterprise Security Reviews

We provide services to our clients as a security operations center and we utilize Splunk Enterprise Security for enterprise security purposes, encompassing various use cases based on client requirements. These include network attacks, malware-related attacks, inbound traffic-related attacks, recurrent activities, web-related detections, internal detections related to root flows, and service account-related use cases.

We are working to secure the enterprise's networks, devices, and infrastructure, as well as enhance overall security. Our goal is to monitor and protect against all types of external cyber-attacks. We will diligently monitor the systems and address any issues at the earliest stage possible.

Splunk Enterprise Security can be deployed both on-premises and in the cloud. We have primarily deployed the solution on Splunk Cloud.

We utilize Splunk Enterprise Security for monitoring multiple cloud environments. By employing an API, we can deploy various forwarders within Splunk. These forwarders gather logs from diverse cloud sources and other types of sources. Consequently, we have the ability to install an API from the Splunk store, enabling us to seamlessly connect with cloud sources such as CloudWatch, AWS, and other similar platforms. Splunk Enterprise Security offers comprehensive visibility across numerous environments.

Splunk Enterprise Security offers excellent threat detection capabilities to help our organization identify unknown threats. Additionally, we utilize threat feeds that index various anomalies. We have integrated threat intelligence platforms, which provide indicators such as advisories and engagement in case of compromises and attacks. This integration assists us in preventing attacks within our environment. Initially, we can obtain this information through the threat feeds. Consequently, we can restrict and block operating systems either within Splunk itself or through other security tools.

We also utilize threat intelligence. We have access to threat feeds from various sources, such as VPN. The threat intelligence management feature allows us to collect detailed information in the event of a data breach affecting an organization on other websites or within the dark web itself. We receive such information, along with details of any attacks or incidents occurring in different environments worldwide. We can obtain these threat feeds instantly through the cyber news channel mentioned.

The threat topology and MITRE ATT&CK features are integrated, allowing us to obtain the tactics, techniques, and processes necessary to solve any remediation process. By deploying the TTP MITRE ATT&CK framework in any use case, we can acquire a detailed explanation and determine the appropriate course of action to follow. Checking the MITRE enables us to easily resolve and remediate any issues. This helps us address any errors or crashes effectively, by following the simple steps outlined by MITRE. It allows us to easily identify and rectify issues, without the need to involve a senior person if they are unfamiliar with the specific use case. Additionally, it enables us to quickly verify and provide remediation, specifically tailored to the respective team that needs to take action.

Splunk Enterprise Security's ability to analyze malicious activities and detect breaches is advantageous to me. When compared to other tools I have used previously, it involves a straightforward SQL query, allowing me to quickly modify the reports in less than five minutes.

Splunk Enterprise Security has helped us detect threats faster. We can integrate multiple security tools, and we can retrieve logs at any time using simple queries, utilizing various indexes and forwarders. These components handle log parsing and aggregation, enabling us to easily identify all the security rules detected using Splunk. For instance, if we provide a hostname or IP source, we can obtain a list of the security details detected in that specific instance.

Splunk Enterprise Security has helped our organization reduce the threats and breaches from security attacks across various threat factors.

Our clients quickly realize the benefits of Splunk Enterprise Security, which is why they have continued to use it for so many years.

Splunk Enterprise Security has helped us reduce our alert volume. The total reduction in volume depends on the new use cases or devices that are onboarded. Initially, there may be a high alert volume, but we will analyze and work based on those alerts. Through this process, we cannot definitively state the exact percentage reduction, but it does significantly reduce the number of false positives in the environment, thanks to fine-tuning the use cases.

Splunk Enterprise Security has helped accelerate our security investigations. Splunk also offers the Phantom SOAR, although I am not currently utilizing it. However, I am familiar with the Splunk platform, which can automate the process and promptly detect and block various types of actions. We can also easily analyze the Splunk programming language.

Splunk can save our analysts ten minutes of additional time compared to our previous solution when resolving alerts, provided that we have the necessary query knowledge. 

Recently, Splunk upgraded to version 9.0.02, which includes excellent data dashboards and visualization effects. This upgrade makes it easier for me to implement all the dashboards. I have created a dashboard that showcases all the VPN monthly data in one place, which is a beneficial feature of the new visualization effects.

There are deployment servers and other servers, and sometimes Splunk may encounter issues if there are non-reporting devices. We will receive alerts only for the administrators and deployment servers, but not for all servers.

When upgrading Splunk, we encounter certain issues. For instance, it does not accept older versions of the other tools we use. This is the main problem. For example, if we are using a ticketing tool or any other XDR or EDR solutions, we need to upgrade them when we upgrade Splunk. During this process, we will encounter some difficulties, resulting in delays. Ideally, the upgrade process should first accept the current versions and then prompt for an upgrade, allowing us sufficient time to upgrade the other solutions. This helps ensure business continuity, although it may introduce some delays in upgrading all these processes.

I have been using Splunk Enterprise Security for five years.

Splunk Enterprise Security is stable.

We are satisfied with the scalability of Splunk Enterprise Security. It can increase its capacity and functionality based on our demands.

Splunk technical support is good.

Positive

I used ArcSight for Level 1 monitoring in my previous company, and my current company was using Splunk Enterprise Security when I joined.

We have witnessed a 60 percent return on investment due to the security that the solution offers to our organization.

Unlike other security tools, Splunk provides a fixed amount of gigabytes per day, and we are required to pay for any additional usage beyond that limit, in addition to our monthly cost. I believe this pricing structure is reasonable for medium and large organizations.

I rate Splunk Enterprise Security nine out of ten.

An organization that wants a CM solution but prefers to go with the cheapest option may work for a small organization, but not for medium and large ones. Splunk Enterprise Security is worth the cost for larger organizations.

Splunk Enterprise Security is deployed in a single location where it collects logs from various assets, infrastructure, and security tools. It serves as a monitoring tool, allowing us to view all the logs in a unified platform, including security tools, network scanners, portability management tools, and other infrastructure components such as Windows servers, Mission servers, and devices. Integration of these components occurs through different platforms like SCM or other platforms, enabling us to monitor everything in a single user interface using Splunk.

Maintenance is necessary for updates and patches. Additionally, we must be prompt with deployments as we need to monitor the health checks of the devices reporting to Splunk. It's crucial to remain active in this process to avoid any potential impact, so we should be mindful of that. Two admins are usually enough for maintenance, and if we encounter any issues, we can contact Splunk client support.

Resilience is important to capture all threat activities and threat speeds, such as IOCs, but we primarily focus on the ESF application. We integrate various threat intelligence platforms, including Splunk, which provides threats from different sources.

I recommend Splunk Enterprise Security as long as it fits within the budget.

Splunk Enterprise Security's single pane of glass enables us to easily monitor everything from one centralized location. Additionally, with its simple query language, we can retrieve all the logs in one place and generate reports quickly. This is exactly what security personnel require: fast reports and comprehensive log monitoring. It allows us to efficiently check all the security tools simultaneously. 

For incident detection, this is the main purpose for which I can use the product. That is the only use case for my team. It may be different for my team who is actually processing the incidents and a bit different for me, as I am a manager. For me, the most important aspect is making statistics over a period, seeing who did what, and extracting all the needed information. It is quite easy and intuitive.

Incident detection is the positive impact I have seen from Splunk Enterprise Security. It probably saved the company from financial losses because of the early detection of the incidents. I cannot say about ROI because I am not involved in financial matters, so I cannot estimate any kind of cost.

There are so many products and features that it may be quite hard sometimes to find something that you are looking for. Search capabilities or maybe some kind of AI assistant helping to find what you want would be beneficial improvements.

I have been dealing with the product for about seven years.

From time to time, there are some glitches with stability. Some logs are missing, and we have an external SOC team handling this license for us. Whenever there is something wrong with Splunk Enterprise Security, they need to raise a ticket, and it can be time-consuming to wait for them to reply; this is also a disadvantage.

It is easy to scale up or down if you have the money. The solution is quite pricey not only because of the license but also when scaling it and maintaining it.

I have not raised any ticket myself, but I have heard some not very good stories about technical support from Splunk Enterprise Security. Support did not provide quick enough help.

Positive

I have not been using any other competitors.

I have no idea about installation because I took no part in it.

We have a dedicated team that is doing all the configuration of Splunk Enterprise Security for us. We are just managing what has been prepared for us.

It saved the company from financial losses because of the early detection of the incidents. I cannot say about ROI because I am not involved in financial matters, so I cannot estimate any kind of cost.

I heard the solution is quite pricey.

I have not been using any other competitors.

Users should know what they are looking for. Splunk Enterprise Security is probably customizable enough that they could achieve their goals, but they need to know what they want to get from it. On a scale of 1-10, I would rate Splunk Enterprise Security an eight overall.

Our use cases are mostly for security and detection, basic use cases. It's always been a security use case. We never used it for observability or ITSI. 

Our analysts use it a lot.

I like that it's a review panel, you can see all of your alerts. Another valuable feature is that it integrates with other apps like UBA and SOAR. 

I also like the guided alert creation. The guided alert creation is useful, especially for new people who don't know CPL. 

It's a premium app, it's easy to use and intuitive. 

Enterprise Security has one pane of glass for all of our alerts. We still use the Enterprise Security page where we keep track of everything. 

It's very important to us that Splunk offers end-to-end visibility into our environment. It has the ability to identify any security events or if data is reingested, we'll get an alert for that. End-to-end visibility is very important for a mature security program.  

Splunk helped to ingest and normalize data. Anytime that we put data in, we always normalize the SIEM model. ES runs off of that so it helps us to dot our I's and cross our T's. It helps us to use our data effectively.

It has tools to reduce our alert volume. We get a lot of alerts. It's more of a tuning thing than anything that the app can help with. 

It provides us with the relevant context to help guide our investigations. It's really useful in that aspect. 

It hasn't reduced our MTTR. SOAR would do that. It has helped our mean time to detect. 

It has increased our business resilience. It's a top-of-the-line SIEM security product. It's the best tool for our security analysts which helps them do their job better. That then protects our company from adversary actors. 

I have been using Splunk Enterprise Security for about five years. 

I've never had too many issues with the stability. Years ago we had indexes crash but that was more on us. We didn't understand how to properly size Splunk. If you work within the required parameters, it's stable. 

Their support is great. I've never had any issues with them.

Positive

The setup was pretty straightforward unless you add a search head cluster. Then it becomes a lot more complicated very fast. Other than that, it's not too bad. It's pretty simple and intuitive. I've done it before and it's not difficult especially if you have the docs to help you. 

I can't speak to the dollar amount but we see ROI in the way that it helps the analysts to better do their work. It helps keep track of things and having one pane of glass for all things data. 

I would rate Splunk Enterprise Security a nine out of ten. It's a top-of-the-line product. It allows analysts to do their jobs better. It's a single pane of glass. It's a fantastic tool that we couldn't do our work without. 

We use Splunk Enterprise Security for a lot of use cases. We use the predefined use cases and dashboards for AWS, notable events, endpoint detection network, and audit notable events.

The most valuable function is the notable events. When I joined the team, I asked them what they could currently see, and they said nothing. I was pretty shocked. I know that they were using Enterprise Security or at least they had purchased it. I told them that there are several dashboards within Splunk that we can leverage. There is also notable events where we can see potential incidents or potential alerts about the infrastructure and the network itself. 

The dashboards give us numbers for malware infection. So long as those dashboards are actionable, they help the SOC team a lot.

It's important to respond to incidents in a timely manner. Having end-to-end visibility across the board equips the team to make sure that whatever incident happens, it has a very minimum impact on the business. It also allows us to fix things that need to be fixed immediately. That's the asset of having end-to-end visibility across the board.

Enterprise Security really helps us normalize our data because it comes with predefined dashboards, so we only need to ingest the logs and Splunk will do the work to display what we need to see on a day-to-day basis.

When we started using Splunk, we had tons of false positives. We reduced our alerts by 90%. Most of our alerts now are actionable.

I would like to have fraud detection features. Fraud is within the same turf as with security operations. Fraud and cybersecurity work hand in hand. I would like to have detection capabilities, or at least dashboards in Enterprise Security for fraud. 

There's already a fraud offering from Splunk for fraud use cases but it's different. I need to get professional services for me to get that feature. It would be much more cost-efficient for customers if all those dashboards could be readily available within ES.

I have been using Splunk Enterprise Security since I joined my company in 2019, so it's been roughly five years.

Cisco just acquired Splunk so I expect the stability to still be the same since Cisco is established. 

I would rate support a nine out of ten because there's always room for improvement. 

Positive

I would rate Splunk Enterprise Security an eight out of ten. To make it a perfect ten, I would like to see them implement the fraud detection features. 

We usually use the solution for the same functionality, which includes setting up alerting and making notables. We also use it for the workflow from ingestion, alerting, and response.

Splunk Enterprise Security serves as our SIEM, providing security alerts, operational alerts, and even some logging that we probably need to check in on from time to time. It basically serves as an alerting platform for our enterprise.

The solution's most valuable feature is the criticality of alerts. Some alerts can be noise, and others will be more high-level and warrant a higher-level response than others.

The solution's automation could be improved. It would be better if we could automate ingesting and alerting for low-level events.

I have been using Splunk Enterprise Security for seven to ten years.

I rate the solution’s stability a nine out of ten.

For the times I've had to set up incidents from critical to lower ones, the technical support team has been fairly responsive. Sometimes, the support team has had a two to three-hour turnaround time for critical incidents. Usually, you would like to get to someone sooner rather than later for critical incidents.

Positive

I've previously used other SIEM tools like ArcSight, QRadar, and Elastic Security.

We have seen a return on investment with the solution.

The solution helps us see what's actually happening in our environment. Some things we might not expect at times, and others we do expect. The tool helps us respond based on what we see from our logs. I've seen and thoroughly liked some AI, automation, and single-pane-of-glass updates coming to the solution.

It is very important to our organization that Splunk Enterprise Security provides end-to-end visibility into our environment. You can't respond to what you can't see was ingested. So, the visibility provided by the tool into our logs and alerting environment is critical.

From an ingestion point of view, the solution alerts you to what you'd tell it to. It's pretty agnostic log-wise.

Splunk Enterprise Security has helped improve our organization’s ability to ingest and normalize data.

It has helped reduce our alert volume. You're getting the same alerts. You can see what's noise, what's actionable, and what's not as actionable.

Splunk Enterprise Security provides us with the relevant context to help guide our investigations. We see what's coming into the environment, including specific logs that we wouldn't expect as much. All of that gets filtered into alert data, potentially operational data, and sometimes even billing data, so we can adjust and move forward with that in the environment.

Splunk Enterprise Security helped reduce our mean time to resolve by somewhere between 20% to 35%.

Splunk Enterprise Security has helped improve our organization's business resilience for some ingestion purposes.

The unified platform helps consolidate networking, security, and IT observability tools. Splunk is pretty log-agnostic. All of your logs, tools, and sometimes even dashboards can get ingested into one specific tool. That way, you have a single platform where you can view all those logs and respond based on that data.

Overall, I rate the solution a nine out of ten.

The solution is primarily for security incident investigation. Whenever a customer wants to monitor the environment for any security incident or events that are occurring, and they want to analyze the incident when virtual issues happen, that's when we propose Splunk. Otherwise, it's difficult to understand what kind of security event is arising in the environment.

The primary feature that is the most valuable is the correlation feature, which helps you analyze the data. If there's a lot of telemetry data at some point, Splunk can take advantage of it. It can handle a large volume of data. 

Now, with big data, AI, and all those things, the amount of security data that is generated is too high. Generally, the other SIMs face trouble when handling big data. However, Splunk itself is a very strong solution for handling lots of data. It helps the SOC team analyze data very well, and it does not crash on handling a large amount. That's a key benefit.

Our customers usually monitor multiple cloud environments. It's not very difficult. There are two ways we use Splunk. One is that they can be multiple cloud environments. The second is that it can be an on-prem and a cloud environment. We are mapping it to our one solution. 

Splunk is very flexible and it's integratable with other solutions

If you want to understand how it can analyze or find out incidents, the visibility is good. The best visibility would always be in the on-prem environment. Then, the cloud, since Splunk is not a native cloud solution like Microsoft's Sentinel, is used. We don't see a lot of challenges if we do a hybrid kind of setup, however.

I'd assess Splunk's insider threat detection capabilities to help find unknown threats or anomalous user behavior at an eight out of ten. Splunk itself uses another agent or another module to do it. Splunk does the job. It's not that it will not do the job; however, it will require more refining than other solutions in the market.

My team uses the Splunk Mission Control, topology, and attach framework features, which are really helpful. We've used it for multiple customers. We take their existing SOC or detection use cases and try to map them to the framework. From a security point of view, it obviously makes a solution more superior. With Splunk, you can catch more security incidents. From a best practice standpoint also, it is a good thing as we can configure the solution, and, according to that configuration, the entire performance is better in terms of security. 

It's very useful for assessing malicious activities or detecting breaches. It's a robust solution. 

We've been able to help customers detect threats faster. It might be 5% to 10% faster in some cases. And since we can analyze large volumes of data, we're not missing any particular data point or data set. That gives us an advantage.

Splunk helps reduce alert volume. You can reduce your alert volume based on your configuration, and it's highly customizable, so it can help you reduce alerts by a lot. It's helped us improve the quality of incidents we receive. 

It's helping customers speed up security investigations somewhat.

It improves the resilience of a company thanks to its ability to quickly analyze data.  

While it's costlier than other solutions, it's highly stable. 

The security orchestration response requires a bit of improvement. 

We'd like to see a more seamless cloud-based integration.

Their mobile features for iOS and Android could be improved in terms of quality of performance. 

I've been using the solution for three and a half years. 

It's a highly stable product even for large customers with diverse environments. For companies that have huge amounts of data even, it does not crash. It's the preferred option when a lot of data is involved. It offers good resilience and improves performance. 

I'd rate the scalability seven out of ten since it is not cloud-native.

Technical support is good. We purchase premium support services.

Positive

I was not involved in the initial setup of the solution. 

The solution is deployed wherever your appliance is. You deploy it where your software team wants to monitor from. Typically, that's headquarters or a company's security center. Splunk then has agents that help devices connect across geographies. For example, while Splunk may be primarily in the UK, it can cover devices via agents across Europe, and the agents can monitor other environments.

We have between two to five people who handle maintenance activities, depending on the client. 

There is a threat intelligence management feature. However, customers don't use it in our case. Typically, customers want something superior in that nature.

Price is a major concern for most customers, big or small. However, price should not be the determining factor when seeking a solution. Users need to think about performance and quality. They need something that will help them prevent security incidents, and they need a product that will be stable. If you can monitor your environment better, you can prevent incidents that may lead to financial loss - and when incidents happen, companies can spend far more dealing with an extended phishing attack than they would on a service like Splunk that will protect them effectively. When it comes to security, while it's not necessary to have the most expensive solution on the market, you should at least seek out a solution that's best suited to your company and its needs.

I'd rate the solution eight out of ten. It's a great option for enterprise-level companies. However, a smaller customer with a smaller budget may not be a good match. They may not need such a powerful solution in any case. That said, if a customer is about to grow a lot, I might suggest Splunk as a primary option. I'd advise potential users to look at the environment size and complexity, consider the budget, and then decide if Splunk makes sense. 

Our security relies on Splunk Enterprise Security to analyze data models for malware, threats, and MITRE ATT&CK techniques. Pre-built dashboards and multiple correlation searches help us identify anomalies. Any suspicious events flagged by the MITRE framework are categorized and assigned as tickets to our engineers for investigation and mitigation.

Splunk has streamlined our incident response by automating key processes. For instance, alerts trigger upon exceeding three failed login attempts, automatically assigning tickets for review. Similarly, unauthorized access attempts from unfamiliar regions are automatically blocked. These automated data-driven responses significantly improve our overall incident response efficiency.

The customizable dashboards offer great visualization and extra add-ons.

Splunk Enterprise Security helps us to easily monitor multiple cloud environments.

Mission Control lets us monitor and manage our security from a single panel.

Based on my short experience, I would rate Splunk Enterprise Security eight out of ten for its ability to analyze malicious activity.

Splunk Enterprise Security helps reduce our alert volume.

Splunk Enterprise Security streamlines our security investigations by providing a central platform and offering a growing library of add-ons that expand our investigative capabilities.

Splunk Enterprise Security stands out for its ability to integrate with existing security tools, provide informative dashboards, and offer IT Service Assurance functionality that goes beyond basic threat detection to include service performance monitoring.

Splunk Enterprise Security offers a vast amount of information to learn and comprehend, resulting in a challenging initial learning curve.

Extracting logs from Splunk for analysis in other applications is crucial for me. This would allow me to identify correlations between data sets and make informed decisions about next steps. Unfortunately, the current Splunk workflow seems to hinder data verification.

The licensing cost could be more competitive, as some of our competitors offer lower prices.

I have been using Splunk Enterprise Security for one year.

We have encountered issues when updating features where Splunk Enterprise Security doesn't work properly. I would rate the stability of Splunk Enterprise Security seven out of ten.

The technical support team is always supportive but their response time and knowledge can be improved.

Positive

The initial deployment was straightforward.

The license for Splunk Enterprise Security is expensive.

I would rate Splunk Enterprise Security eight out of ten.

We have Splunk Enterprise Security deployed across multiple locations.

The resilience Splunk offers is good.

I recommend Splunk Enterprise Security to others.

Splunk Enterprise Security is used for security monitoring. It helps manage the governance of the security monitoring from the start of an incident to the resolution.

Splunk Enterprise Security offers excellent visibility across multiple environments. It's a flexible platform with virtually no limitations.

The actionable intelligence provided by the threat intelligence management feature is good.

Splunk Enterprise Security does a good job analyzing malicious activities and detecting breaches.

Splunk Enterprise Security helps us detect threats much faster than before.

Depending on the client and their configuration, Splunk Enterprise Security can help reduce their alert volume by under 50 percent.

Splunk Enterprise Security helps our clients expedite security investigations. It achieves this by streamlining the process of finding evidence and incident logs within Splunk's data module.

Splunk Enterprise Security offers two valuable features: the Common Information Model and arrangement modules. The CIM helps standardize data for efficient searches, while arrangement modules automate incident log processing by enriching them with contextual client information.

While Splunk offers SOAR as a separate product, integrating it into the next version of Splunk Enterprise Security as a unified solution would be beneficial.

I have been using Splunk Enterprise Security for 2 years.

Splunk Enterprise Security is stable.

Splunk Enterprise Security is scalable.

The technical support experience is moderate. It can take a long time to resolve issues, and I often need to explain the problem to multiple support representatives. Ideally, I would have a single point of contact assigned to my ticket throughout the entire process.

Neutral

The initial setup of Splunk Enterprise Security involves moderate complexity. Deployment time can vary significantly, ranging from one hour to one month, depending on the environment's complexity.

Splunk Enterprise Security is expensive.

I would rate Splunk Enterprise Security 7 out of 10.

I suggest integrating SOAR with Splunk Enterprise Security.