Splunk Enterprise Security Reviews

My main use cases for Splunk Enterprise Security include extensive security operations.

Splunk Enterprise Security has helped improve my organization's business resilience. The more I know, the more I can see, and the better my security stance becomes due to inherent visibility.

We did use risk-based alerting in Splunk Enterprise Security. We had to refine the data model based on the initial risk-based alerting model as, when we fed it raw data, the data models built, and there were many endpoints and network devices that had a high-risk score just because the data was new. Those risk scores carried over with weights, so we had to go back in and cleanse the risk score model and rebuild it once we had good data and logs going into the ES platform.

If they could implement an out-of-the-box solution, it would be almost an AI data onboarding system that automatically identifies the fields that are SIM compliant, Common Information Model compliant, and then immediately applies those to a data model, builds a data model, and starts the SIM searches against those data models. A lot of the work for Splunk Enterprise Security happens on the back end, not the front end, so that's where you can really trim down your resource need and expertise if you supplement that with automated or artificial intelligence.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat protection are integration with other platforms and noise. Alerts from Splunk Enterprise Security generate many alerts, which take time to move through, assess, analyze, and determine whether they are true or false positives, and then go back and redundantly tune.

I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be cumbersome. Custom use cases are also cumbersome. You need someone very skilled at Splunk and data modeling to get to a point where you create something inside SPL that allows you to detect what you want.

There is not much predictive analysis happening in Splunk, and I hope that with the new AI toolkit allowing for the deployment of custom AI models and large language models within Splunk, along with additional advanced mathematical capabilities for vector analysis, the prediction and ability for Splunk Enterprise Security to add value to detections will increase.

I have a lot of experience using Splunk Enterprise Security.

I would assess the stability and reliability of Splunk Enterprise Security as typically very good, with minimal downtime or crashes.

We haven't expanded our usage of Splunk Enterprise Security; we used it by default from the start. The expanded usage is simply adding more information and logging to gain better insights.

I evaluate customer service and technical support as normally very good. When it's not, I reach out to my sales representative and my SE. I have a great SE, Jonathan Wilson, who jumps right in to solve issues when we need help or engagement.

Customer support has room for improvement, particularly in terms of speed and the ability to escalate issues to more senior personnel. I understand the need for a tiered approach, but I believe some issues should move more rapidly to a senior person.

Prior to adopting Splunk Enterprise Security, we were not using any other solution to address similar needs.

It's the human element there. It's helpful to have the expertise and the people to really take those data models and build them, refine them, get everything into the common information model on the back end so that, on the front end, you're getting the best data possible and you don't have to rebuild those models like we had to do with the risk score.

I have seen a return on investment with Splunk Enterprise Security. We went from almost no visibility to significant visibility across the enterprise, allowing us to see threats that were previously unknown or unregistered, which increased our security stance and made us understand we needed to look beyond the perimeter for internal threats and for lateral movement, east-west versus just north-south.

I helped negotiate the cost. Our sales rep is is really good, and we had a good understanding. The more you know about the product, the easier it is to negotiate. If you're not aware of how the product works, what the ingestion's like, especially Splunk Cloud with the SBC units and AWS, and how impactful that can be to queries and optimization and just general operations, it becomes very difficult if you're trying to maintain a certain price point for cost effectiveness. It it can be difficult to get an optimum amount of credits and SBCs in order to run what you need to run.

My advice to other organizations considering Splunk Enterprise Security is that while not everyone needs the top breed, ensure you have the resources and time to invest in it if you decide to use it. Anything off the shelf won't be as valuable as something you invest in and put time into, so the more you put in, the more you get out.

I would rate Splunk Enterprise Security overall as probably an eight out of ten; it is industry-leading.

My main use cases for Splunk Enterprise Security are cloud-based use cases.

The features I appreciate the most are the content. I use the content, enable, and see how that works. They give me ideas on how to tune something or determine if that use case is proper for us, or I can take the idea of that use case and customize it based on our needs. 

Splunk Enterprise Security has helped improve my organization's business resilience.

I do use disparate security solutions that integrate or import data into Splunk Enterprise Security. The integration of these solutions supports our security operations. That's the part I work on with the architect. I'm not fully familiar with that, but when we talk, he mentions those integrations and that seems to be good from that perspective because we are separate. We have separation of duty between the architect, security engineer, and analyst.

I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be good. My organization uses risk-based alerting in Splunk Enterprise Security for three or four use cases. We have one active for user, cloud users, with data from Microsoft 365. We elevate the risk of users based on behavior and conditional access. It gives us visibility of which users are at real risk based on the configuration we have.

My security ops team takes around 30 minutes to one hour to remediate security incidents with Splunk Enterprise Security compared to a previous solution. They previously did everything manually with the last solution, opening tickets manually and jumping between platforms, the ITSM platform, the same platform. Now with Splunk Enterprise Security, we have everything in one place. The notables are created automatically, but they can also create their own notables based on the investigation. That improved and reduced about 50% of the manual work that was done before versus what we are doing now.

In terms of how Splunk Enterprise Security can be improved, based on the last version I'm seeing here, as we are a bit behind,is the Mission Control. It is something that I have heard and tested on a couple of labs that is very good for unifying everything. There are additional features I would want to see included in the next release. We're planning to incorporate UBA and SOAR. It would be good to have everything in one place.

I have been using Splunk Enterprise Security for two years.

The stability and reliability of Splunk Enterprise Security that I would assess depend on our on-premises setup.

Splunk Enterprise Security scales with the growing needs of my organization; however, that's more the architect's domain. We had licensing for 500 gigabytes, then we extended it to 1 terabyte. Now we have 1.5, and we are going to extend to 2.5.

I would evaluate customer service and technical support as good, rating them a nine out of ten. I'm usually not the one who opens tickets. The couple of times that I have opened tickets with Splunk, they were very good. The only thing I was expecting is that they would follow up with me.

Positive

Prior to adopting Splunk Enterprise Security, I was using Microsoft Sentinel to address similar needs.

The initial setup process was good.

I have not seen ROI with Splunk Enterprise Security. 

I don't work with the numbers, licensing, and related aspects. The architect handles that part.

I wasn't in the organization when they made the decision, however, based on what I heard, the factors that led to the change were all the detection capabilities, and at that time, they were looking for a solution that was mature enough to implement. At that time, Microsoft Sentinel was not the right solution.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are related to the data. Onboarding the data, trying to get only what we want and what matters for security is a challenge every day. We're trying to onboard what matters and what is significant for security. We use Splunk solely for security purposes. Some people see Splunk as a data analytics tool, which it is, but changing people's minds that we use Splunk for security is an everyday challenge.

I am not using any new threat detection features in Splunk Enterprise Security currently. My impressions of its ability to predict, identify, and solve problems in real time are good, even though we don't use many things out of the box. We use most of the out-of-the-box features and customize them. We have just a few out-of-the-box use cases in place.

The advice I would give to other organizations considering it is to send people to training before getting Splunk Enterprise Security. You can use my real name when publishing my review.

On a scale of one to ten, I would rate Splunk Enterprise Security a nine.

The business case we use Splunk Enterprise Security for is internal security and organizational security purposes. We use it for all kinds of use cases, depending on the project.

We are satisfied with Splunk Enterprise Security, and it comes with a wide number of out-of-the-box applications which do help us to fix the problems. The out-of-the-box applications are majorly important for any log source onboarding. When you bring in log sources, you can do anything with it. It has inbuilt Security Essentials, which is the application that helps when you get a lot of log types onboarded, enhancing the use cases based on what you need. For example, after onboarding XYZ log sources, you can develop use cases based on that, such as security contents on that, then you can take it ahead. Those features are the best which we have.

After that, you can develop advanced dashboards or use the new AI feature that can translate something you say into SPL language, making it easy for us. Those features are better right now.

Splunk Enterprise Security has achieved a high level of product functionality. Improvements can focus on bringing various features together for easier use and potentially addressing human versus machine threats with AI-based detection, along with educating organizations about compliance.

I have been working with Splunk Enterprise Security for almost four years now.

Data ingestion is crucial, and I have mentioned this feedback in previous calls. Splunk Enterprise Security is stable and provides a good infrastructure for large organizations. For a Splunk Enterprise Security product in organizations with 20,000 to 80,000 people, it is very stable. However, for smaller organizations, the deployment and management can be expensive, leading them to choose other SIEM tools. For mid-sized organizations, Splunk Enterprise Security is indeed the best option, especially when ingesting a lot of data.

Data ingestion is crucial, and I have mentioned this feedback in previous calls. Splunk Enterprise Security is stable and provides a good infrastructure for large organizations. For a Splunk Enterprise Security product in organizations with 20,000 to 80,000 people, it is very stable. However, for smaller organizations, the deployment and management can be expensive, leading them to choose other SIEM tools. For mid-sized organizations, Splunk Enterprise Security is indeed the best option, especially when ingesting a lot of data.

We were previously using IBM QRadar and McAfee products, but right now we haven't explored that part because for a few years, I am working for an organization where we only explore Splunk Enterprise Security or Azure Sentinel or any freeware market SIEM solution. That is the kind of project I am doing right now, but I am not working with IBM QRadar.

The setup process for Splunk Enterprise Security is simple. An experienced technician can complete a systematic installation within a few weeks. Splunk Enterprise Security offers success partner provisioning for additional support and implementation.

We usually use Splunk Enterprise Security and Azure Sentinel, and we are researching Wazuh EDR and solution.

Right now we are working on Tines and Scramble, and there are few SOARs which we are looking at like LogRhythm and Sumo Logic source. We are assessing the products right now. We haven't adopted any of them right away.

There is integration between third parties with Splunk Enterprise Security. For example, we can connect a Tenable vulnerability assessment tool. It has inbuilt features to trigger automation actions. We have integrated a lot of products, and when you want to trigger SOAR or something of that nature, third-party applications are already available. For instance, when you integrate Tines, there are extensions available, making it a more powerful tool. This systematic integration is beneficial to us.

Regarding risk-based alerting in Splunk Enterprise Security, there are a lot of contents available from Splunk used as rules or searches. If we design systematic inputs and use cases, it does provide a lot of threat-based detection, showing what detection is happening right now and how advanced automation is expected to happen. Those visibilities are available with Security Essentials.

The resolution of security incidents using Splunk Enterprise Security is quite faster. However, faster remediation ultimately depends on the security operations. The detection with Splunk Enterprise Security is effective, but the story starts afterward. In the actual products, such as Splunk Enterprise Security, 20 to 30% of the time is spent on detection and investigation for incidents. The combination of Splunk Enterprise Security, ITSM tools, and SOAR on a single platform provides a value-add, allowing for a more efficient resolution process while considering costs for security teams.

For threat detection features in Splunk Enterprise Security, it is necessary to build use cases. SIEM tools are not purely threat detection tools; they are notification tools for threats detected elsewhere. We can do anomaly detection, but detecting actual threats requires specific signatures that we haven't explored yet in depth.

For threat detection features, it is vital to build use cases and compare anomalies such as a significant increase in login attempts. Anomalies can be detected in Splunk Enterprise Security, but defining signatures for threats is a task we still need to explore.

We work in both cloud and on-premises models, with our on-premises being integrated with cloud services from certain vendors. I would rate this product overall a 9 out of 10.

My main use cases for Splunk Enterprise Security include supporting production changes, which helps us ensure that we are not going to break the business from a DLP engineer standpoint. From an investigations and operations perspective, it allows us to look into all activities done by any individual, such as which emails they sent or what kind of data they have in their folders. We have logs coming from data at rest and data in motion channels, and all this combined is quite helpful for insider threat and data loss prevention activities.

One of the use cases I leverage Splunk Enterprise Security's dashboards and visualizations for is looking into risky applications. Since we manage the web side, we look into emerging AI applications in the market. Splunk Enterprise Security provides access to logs that show which category of websites are being accessed and what those are. We can see that in a search, yet visualizations dashboards enhance this representation. Instead of writing an SPL every time, any team member can go into a dashboard, input the application name they're interested in, and access all relevant details. These are some use cases, and you can continually build your own with Splunk Enterprise Security providing the platform for those developments while limiting access to only those who need to see the information.

Splunk Enterprise Security plays a role in our organization's strategy to combat insider threats and advanced persistent threats by allowing us to examine how users are affected and the various egress points they are hitting. From my perspective, this is essential as I work in a specific area within cybersecurity.

As a DLP Engineer and Assistant Vice President at a US bank with about 50,000+ employees, I manage the Data Loss Prevention tool, configurations, and deployments. We work across the globe in multiple regions and work on multiple different kinds of tools. Splunk Enterprise Security is leveraged quite heavily to support our DLP functions by creating SPLs for our DLP operations. We also create dashboards and reports that are required, where Splunk Enterprise Security is the single point of connection that allows us to send all the logs across and use the data as we need and see fit.

Due to my role, I have limitations on what I can do in Splunk Enterprise Security, yet for whatever access I have, it's been a very useful tool for detections and investigations. From a DLP standpoint, we look into enabling blocking, and we want to make sure that we are looking into what's happening there and how many people would be affected. Splunk Enterprise Security gives us access to that data, while the DLP platforms themselves provide data too, however, Splunk Enterprise Security's integrations with various inputs from identity and asset management create a single point for all information.

I appreciate the statistics feature of Splunk Enterprise Security since it helps showcase numbers to management. While we can share a long spreadsheet, that's not a good way of sharing data. Although we still share spreadsheets, having statistics, visualizations, and dashboards to showcase security benefits is much more effective.

Any new tooling we bring in and adding that data set helps create much richer data. Different integrations enhance our ability to find the right context for threat analysis and insider threat analysis.

I don't have any metrics regarding how Splunk Enterprise Security has helped reduce our team's average mean time to detect. However, I can think of the practical aspect: we have four different tools with their alerts. When we go into each of those tools, we can see what a user has done. With Splunk Enterprise Security, we can just pop in an SPL, search for the user, and find all the details from different sources in one spot, making it much easier to dive into investigations.

I have many good ideas for how Splunk Enterprise Security can be improved. Our Splunk team attended a session, and it was really good. I see that AI integration would assist analysts in seamlessly looking into data without relying on engineers to write an SPL. With AI integration, they can search different kinds of data that they have access to. The UEBA side looks good, and the Splunk Enterprise Security UI indicates that we are on the right path. I look forward to using and sharing what I've learned with my team regarding different tools in Splunk Enterprise Security that we can leverage to improve processes, provided they are not already using them.

One major return on investment for using Splunk Enterprise Security, from my perspective, is the feedback I provided to the product research team about creating a UI that helps specific team members extract value from the platform. For instance, if a DLP operations analyst accesses the platform, it should guide them to navigate predefined content for their role. That's something I've already mentioned to them, and I'm eager to see what happens next. Currently, it's a blank slate where users can explore, which is good, however, some people might need a push. Training can either be done from start to finish, or with AI integrating everywhere, users could ask questions that would return answers, from creating an SPL to providing results.

I have about ten plus years of experience in IT and security. The last seven years, I've been focused on data security. I've worked on probably more than seven DLP platforms, data loss prevention platforms. And from what I've seen, almost all these companies that I work with, a lot of them leverage Splunk.

I am happy with Splunk Enterprise Security's stability and reliability so far. I haven't seen any drawbacks, although sometimes the search takes a while to return results. That's often due to how I design the search, not the platform's fault. I have fantastic team members who assist me with specific SPLs, which makes it easier. It's just about navigating and understanding the right way to do it.

Splunk Enterprise Security scales well with the growing needs of our company. We have a massive team that supports this, with an amazing team managing all the work around Splunk Enterprise Security ingestions. I keep hearing that the use cases are increasing, and we look forward to what more comes in.

Before adopting Splunk Enterprise Security, we did not use any other solution to address similar needs in our company.

I know that our SOC team does use Splunk Enterprise Security to prioritize and investigate high-fidelity alerts, however, I'm not sure how it helps them specifically. I can say that many different teams in the business use it very heavily.

We do utilize UEBA in our company, yet not Splunk Enterprise Security UEBA from my understanding. I'm not part of those teams, so I wouldn't have an answer for how it specifically functions.

I would rate Splunk Enterprise Security a ten out of ten.

I advise other companies considering Splunk Enterprise Security to recognize that it is utilized by massive companies and is more practical. I would suggest finding what works for their environment and evaluating all related costs as those are important factors. Overall, Splunk Enterprise Security delivers, which is what truly matters.

We are consuming Splunk Enterprise Security because Wells Fargo routes all alerts and logs into it. I work on the reporting side that leadership uses to see the alerts and logs. Whenever threats or alerting occurs, we have kept a couple of algorithms based on which we can assume that this is not normal behavior on the server or any other devices that we are monitoring. It will alert to our systems, then we'll capture all the logs and present them on the reporting side through a dashboard.

Security monitoring, threat detection, and risk-based alerting are the key features that we use daily. Because this is a cybersecurity project, leadership wants to get alerts about what is happening overall at the enterprise level, whether there are any threats, and how to improve cybersecurity. There are a number of applications that are customer-facing, and they are under compliance, so we monitor those applications closely for any cybersecurity threats or issues. If there is something detected, we alert the application team that there is a vulnerability in their systems and these are the measures they can implement. It is a complete cycle. When we detect a threat or potential vulnerability, we report to the application team stating which vulnerabilities exist in their application and what they have to work on. Automatically, that dashboard vulnerability points get captured into a service board and from service board to the application team's Jira board. This is also called TCI activity.

My job and responsibility involves pushing the data to the corresponding team whenever we get an alert. The alert mechanism and all the algorithms have been completely designed by the admin team and the architect teams. As an analyst, I focus more on the data side. This is my source of record for my reporting. I access the Splunk web-based application directly through an API. I verify whatever comes to my database to ensure it is correct and check all the logs. There is a particular index that we use to check. We have a dedicated index for authentication-related items or data-level encryption items. All threats get alerted in the logs, and it is completely based on the risk score, which is an algorithm created for threats with a specific score. We track mostly scores where the score is more than 20.

A score of 50 will show in red. Suspicious network activity gives around more than 40 points. We track above 20 only, as 20 is a warning for us, but above 20 is an issue that we have to work on. It gives a priority based on the points, and leadership also tracks it the same way.

I access data through the search command only. I use a correlated search command on the events on the particular index and get the output. We have two instances: one runs on-premises and one runs on cloud. On-premises runs on a Windows server, and cloud runs on AWS as of now. Soon the Windows will get decommissioned, and everything will go to the cloud.

We do real-time monitoring, so within no time, we send alerts to the respective teams and they can start working on it. By this, the risk has been minimized, and it is completely automated till the end with the back tracing workflow as well. There is a middleware team that tracks closely for all these vulnerabilities and gets them resolved on time, or it becomes an escalation to the team if the app team is not able to resolve it within the timeframe.

We capture logs that applications generate. For cybersecurity purposes, we also monitor people who have logged in using Windows logs, DHCP logs, and DNS logs. For example, if someone is based in London but has logged in from a different country or region, such as Germany, we identify it. We alert that the person has logged into Germany without informing their supervisor. These kinds of alerts we do against compliance and company policy. For these reasons, including logging or remote logging through VPN, we capture VPN data from Splunk as well. We do two types of reporting on Splunk Enterprise Security. One is log-based reporting to identify if a user is based in one location but their activity is showing from a different country altogether, then it shows as a flag and goes back to their supervisor.

In terms of improvement, the dashboards are not up to the mark. If you compare with Tableau and Power BI reports, they are more customized, more user-friendly, and more interactive. Therefore, we have to do an ETL pipeline to inject those logs into an intermediate system, which is a SQL server, and from SQL server, we do reporting for the leadership.

Actually, there is a feature that got updated, but it is not working on our board. Splunk 2 has not been updated, but we have received AI-related features that are not working as of now. Convert to SQL2 is the new feature they have added, but it is not working as of now.

We have been using Splunk Enterprise Security for around 10 years.

Splunk Enterprise Security is very much reliable and pretty reliable. Sometimes we used to face peer issues on-premises, but when we migrated to the cloud, I do not see any issues. For one index, data has multiple peers. If any one of the peers is down for five seconds, the retrieval of logs will fail or be incomplete just due to one. When we migrated to the cloud, since then I have not seen any of those issues.

In terms of scalability, I think they have come up with something, but Wells Fargo has not implemented it. I attended the training as well, though it was almost a year ago and I do not recall the details. It was a two-day training. When we talk about scalability, it depends on the business requirement and the use case. It varies.

I am not familiar with all aspects of Splunk Enterprise Security as I am more focused on the alert and reporting part. The admin and principal engineers handle most of the other work. My work involves reporting and the alert part of it.

We run special Splunk queries on two indexes. One is threat intelligence and I believe that is AI-based, though I am not sure what the mechanism is behind it. I have heard in conversations that they are working on the threat intelligence, but it has not been rolled out yet.

I believe that is an AI-based tool that they are working on. Beyond my pay grade, I just raise a request for getting access and pricing information. Because I work for Wells Fargo, which is a big enterprise with a lot of hierarchy, I am not familiar with certain decisions. The requirements come from the leadership level, and if they say this is the tool and I need to get the required data from it, then I have to go for it. I cannot ask why this or that because it is beyond my pay grade. In a huge organization, we have to work on the requirements that come from leadership, even though there are many features that I am not aware of because other team members handle them. My knowledge is based on requirement to requirement and use case to use case. I have explained the two use cases I am working on. In the future, if there is something coming up, I am happy to explore, but as of now, I have two use cases that I have already shared.

At the enterprise level, there are different use cases. Some other developers have different use cases for Splunk Enterprise Security beyond what I am working on. I rate this product a 9 out of 10.

Splunk Enterprise Security has been used by my company for the past four to five years. I have been with the company for about a year, so I have approximately one year of experience with Splunk Enterprise Security.

Splunk Enterprise Security has various complex use cases. In our environment, the most common use case is SIEM, which stands for security information and event management. This involves security monitoring, including various attacks monitoring and logs coming from firewalls and other devices. We monitor all the devices and networks as well, which is a very effective use case for Splunk Enterprise Security. Another important use case is threat hunting. Since SIEM has all the logs from all the devices, it makes threat hunting very easy and helps us find the source of all attacks or potential attack attempts.

The best part is the user interface, which I would say is very easy to understand compared to other tools. The log ingestion is another feature that I particularly like. It supports almost every device, whether Windows, Linux, firewalls, cloud platforms, media tools, or APIs. Splunk Enterprise Security has a good amount of log ingestion sources. Detection engineering is another valuable feature. It has very good correlation searches and excellent measurement of MITRE ATT&CK mapping. It maps attacks to MITRE techniques in a very good manner.

Splunk Enterprise Security has helped us with faster threat detection compared to other tools since it has centralized logs from all devices and sources. This helps us catch alerts and incidents faster. There is a term for this called Mean Time to Detect. The Mean Time to Detect is very much faster with Splunk Enterprise Security. Since we can detect incidents earlier, the Mean Time to Response also becomes less, which helps us confine and consolidate incidents faster.

In my experience, Splunk Enterprise Security detects incidents approximately 20% much faster than other tools. Since detection is fast, we can analyze and respond to incidents much faster than other SIEM tools.

I really appreciate Splunk Enterprise Security, but I do have some complaints. One complaint is that it is very expensive for organizations. This is a common complaint, but it does perform very well, so that expense becomes an investment. For small teams, it is very hard to manage. There has to be a dedicated team of analysts or engineers hired to manage Splunk Enterprise Security overall. The tuning takes up some time, particularly detection tuning and response mechanisms. I have also heard from my clients that it is resource intensive on their devices, taking a lot of resources which sometimes hampers their work.

The search and query functionality in Splunk Enterprise Security needs to be much faster in the future because it still needs some work. It can be improved significantly. Additionally, one thing that I observed was the time range functionality was not very helpful for me. I wanted it to be very specific and precise, but it included logs from other time zones as well, which was a hassle. Splunk Enterprise Security needs regular updates and upgrades. Instead of doing this quarterly or half-yearly, I would prefer patches to be released as soon as there are any new incidents. Alert fatigue was a complaint recently, but it has been resolved. The AI detections were detecting very false positives, which caused our analysts to experience alert fatigue, and this was not helpful for real incidents.

Splunk Enterprise Security has various types of scalability features and options. Since my company and our clients have demands where they are adding more devices and new servers, with other SIEM tools, we would need some time duration for deployment. With Splunk Enterprise Security, I would say within two to three days, it is easily deployable and easily connected to the client's console and can start monitoring. Splunk Enterprise Security has good scaling possibilities.

We raised some questions to Splunk Enterprise Security support team because there were some incidents which required certain help and it was very urgent. Splunk Enterprise Security community has helped us a lot, but the support team has medium-paced responses. They are not fast enough and not slow enough, but they have medium-paced response times. However, the responses are very detailed and very correct. We did not have to follow up on anything because we got all the answers in one response only.

I did hear that there were pricing options in the support team as well. There was some premium support available at a much higher price. I would say that is a disadvantage because support should be equally accessible to all. There were a few cases which took some time, but overall it was a timely response. If I were to rate the support team, I would give them an eight out of ten.

When I started deploying Splunk Enterprise Security onto my client's environment, it was the first time for me, so I was a complete beginner. From a beginner's perspective, it was very difficult for me. However, once you get hands-on experience and spend some time with it, it can be moderately easy. The deployment of TI feeds was very easy and had no problems. I think if one has enough experience in deploying it, it can be very easy. However, if someone is a beginner, it will be a bit hard for them.

As an analyst, I look at ROI in a different way. I consider how it is actually helping me and whether it would also help if I used some other SIEM tool integrated into my environment. Splunk Enterprise Security has faster detection and response rates. It is approximately 20 to 25% faster than other SIEM tools, which in turn helps in detecting and responding to alerts faster. Overall, if the query search and performance improve even more, I would say it will be a total good investment and we will get our full return on investment.

Apart from Wazuh, there is QRadar. I have some experience with QRadar and Microsoft Sentinel as well.

AI-driven detection is a hit or miss at best because we get hundreds of alerts daily. There are a few incidents where AI-driven detections do give us false positives, but 90% of the time it has helped us in detecting attacks faster and taking action on it.

AI-driven detection basically analyzes patterns and identifies suspicious patterns. Many traditional rules or traditional alerting mechanisms may miss these patterns. This has helped us in making decisions based on incidents which even human analysts cannot determine clearly. This could have happened because AI has all the log sources and all the patterns, making it very easy for AI to correlate these logs and identify a pattern. AI indicates to the analyst that this could be an attack and to please look into it. If a human had to do it, it might take them a lot of time compared to AI.

In my experience, risk-based alerting has been very helpful. In my company, we have set it in a certain way that when we have set certain parameters, if there is some amount of risk, we trigger an investigation or incident or escalate this incident to L2 or L3 accordingly. We have a mechanism where if it is above 50, we alert L1. If it is above 75, we alert L2s. If it is above 90, we alert both L2s and L3s. Risk-based alerting has helped us in segregating these alerts, and because of that, the time of analysts is divided and they can focus on other areas of their expertise.

MITRE ATT&CK mapping, as I have mentioned before, with any incident we get, it easily maps it to MITRE ATT&CK and gives us the whole log or storyline that shows which MITRE attack it is mapped to. Threat topology is based on certain incidents. For example, if it is an unusual user login, it gives us a detailed topology of who the user is, which host the user has logged into, how many login attempts they made, and whether the source IP is known or unknown. Threat topology helps us in these aspects, and MITRE ATT&CK mapping helps us in auditing as well later on.

The credit mainly goes to AI-based detection because of how fast it correlates and works on the logs. The speed at which AI identifies patterns and gives us an alert based on that, indicating this could be a potential attack, is one major reason. Real-time log ingestion from different sources of devices like firewalls, endpoints, EDRs, and network devices is another factor. Since this is happening in real-time with no delay in between, we can catch AI-based attacks which will happen in the future, helping us get an advantage over them. Risk-based alerting also helps in a certain way. Since we know it is of a particular risk level, if it is about 85 or 90 risk, we have to take certain action on it depending on the risk level.

Essentials has helped accelerate detection because it has avoided pre-built correlation rules and MITRE mappings, providing MITRE mappings with dashboards and use cases that can also be built. We do not have to build everything from scratch. It is built on its own, which is a good thing. This helps us with faster deployment and reduced time in creating dashboards and other things.

In percentage terms, Essentials has improved the time taken to detect or respond to an alert by approximately 25%. It is a rough estimate between 25 to 50%. We do depend moderately on Essentials helping us detect alerts faster.

We have built custom threat intelligence feeds in my company which help for certain clients. We built these custom threat intelligence feeds in-house first, and when we insert them into our environment, they specifically look out for malicious IPs or hashes which we provide in the threat intelligence feed. Based on that, if we get any incident or any malicious IP which traditional Splunk Enterprise Security or Essentials cannot detect, the TI feed works well in that case and helps us block the IP and gives the analyst an alert that a malicious IP was found and to please look into it.

It has helped me in prioritizing things. We can prioritize easily. If there is a hit from the TI feed, we can look at it first because it was custom built by us and we know how malicious or bad the reputation is. The best thing is that it reduces the load of checking every time the reputation of an IP or a hash. For example, if we get a normal incident, we have to check the IP and hash to see if it is malicious, check certain platforms or Splunk Enterprise Security or other tools. The effort and navigation fatigue gets reduced, and the TI feed gives the analyst the information directly that this is malicious with references or that this hash is malicious and has been found malicious by these websites. We have also built correlation rules based on the TI feeds. If we get a hit from a TI feed plus AI-driven detection also gives it a suspicious rating that the patterns are suspicious, then it is automatically escalated to our L2s and L3s and they look into it carefully.

Operational visibility is another important aspect. It detects service failures, app crashes, or if any firewall is down or if any devices are down. We will get an alert as soon as possible after a certain time if a device stops responding. The operational visibility is pretty good so far. Compliance support is another benefit. We have many audits quarterly, and it helps in generating reports based on compliance protocols and procedures, whether HIPAA, NIST, or PCI DSS. We get reports very easily.

It gives me more context since it combines all the logs from various sources. One major thing is log validation. One log can be verified across various sources against another source. If we get only failed logins or if we get a failed login incident, we can also see which endpoint it is from or which firewall is connected to it or who is connecting to it and what the user privileges are. This builds stronger confidence overall.

SOAR has helped us a lot in our environment. Consolidating SIEM, SOAR, and UEBA has improved visibility, detection, response speed, and efficiency. SIEM's main use cases detect the alert, UEBA adds some context to it, and SOAR does the rest by automating the alert generation and the required processes that need to be done.

UEBA gives us very deep insight into the behavior of certain users or certain devices. It helps to make a baseline for behavior. UEBA learns the normal user and host behavior. It knows when it is a normal time for a user to log in and when it is unusual. It detects deviations and anomalies such as unusual login time, impossible travel, VPN usage, unusual process execution, or requesting higher privileges.

This happened last week. UEBA helped us detect an impossible travel for a user who was present in the office working with us. UEBA detected that another login was observed from the Philippines, which was very unusual because the user was with us at that moment. We asked the user if they had logged in from a VPN. The user said they did not log in from a VPN. We had to look into it very carefully, and L3s and L2s were brought on to investigate it very carefully. It was then later realized that the user was indeed using company VPN but was not aware of it.

I would say it is a very good tool that everyone should get experience with Splunk Enterprise Security. However, I have heard that it is not accessible to everyone because of its cost, but it is a very good tool and every analyst should have some hands-on experience with it. My overall rating for Splunk Enterprise Security is nine out of ten.

As a security analyst, my main use cases for Splunk Enterprise Security involve reviewing notables. I receive all the alerts and notables in my queue, review them, ensure they're not actual security incidents, and triage them as either true positives, false positives, and so on. I then investigate the true positives.

The features of Splunk Enterprise Security that I appreciate the most include the SPL search. It allows me to get all the data I need, make it beautiful, show it to my boss, and show it to less technical people. It's easy to display the data.

When we have a major incident, we need to move fast and answer quickly. Also, we need to inform non-technical people, so it's easier to show them.

Instead of showing them a raw log that's ugly and hard to read, we can show them a very concise point such as 'This insider threat with this IP address accesses this system,' and pivot wherever needed. It's really useful for data presentation.

Dealing with incidents depends on the type of incident; a major incident can take a few months, while a smaller incident can take from five minutes to five hours. We use Splunk SOAR, and we're starting to use that in Splunk Enterprise Security to automate our response. It's made my life easier because repetitive tasks can be automated with a playbook, and everything gets done in the background without manual triage.

Splunk Enterprise Security helps improve my business's resilience by protecting our enterprise. Every time there's something not working, it's our central log space. Every incident and everything that's not working is in Splunk. The factors that led to adding Splunk involve our relationship with the sales team and our technical contact. We have a very good relationship with them, which helps considerably.

The integration of these security solutions supports my security operations by providing us with better visibility into various types of endpoints. We have custom detections that we make on Splunk, and we also integrate Microsoft Defender alerts into Splunk. I have one place to investigate them all instead of going from product to product.

Splunk Enterprise Security can be improved mainly regarding the UI, which can be daunting at first for newer employees. It's hard to find everything, such as menu locations, dashboard access, and dashboard creation. It's still very complicated and takes a few weeks to understand. The UI could be more user-friendly.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include skills. I've been using it for four years and I don't know everything yet. Finding information and writing complex SPL queries can be challenging. I tried to use external AI, ChatGPT, but they're not very good with it. I know now there's SPL with AI, and we're going to test that.

I have been using Splunk Enterprise Security for about four years.

I would assess the stability and reliability of Splunk Enterprise Security as generally good. We had a few performance issue bugs with very specific use cases, and they were handled quite fast. We reported them to our technical contact, and within a week, it was fixed.

Splunk Enterprise Security scales effectively with the growing needs of our organization. We expand continuously, always adding new detection, new logs, and new systems. In Splunk Cloud, it's very scalable. We never have an issue with that, and we have terabytes of data coming in.

I would evaluate customer service and technical support for Splunk Enterprise Security as very good. This is probably one of the reasons why we have a good relationship and we keep Splunk around.

Positive

Prior to adopting Splunk Enterprise Security, I always used Splunk. At the same time, we use Microsoft Defender Endpoint, however, we don't use their SIEM solution. I use MD alerting too.

I use disparate security solutions that integrate or import data into Splunk Enterprise Security.

I am not directly involved in pushing new detection in Splunk Enterprise Security. However, I do tune detections; if a detection is firing too much or I feel we could edit the detection, I find it quite easy to do. My organization does not use risk-based alerting in Splunk Enterprise Security yet; we're working on it.

The advice I would give to other organizations considering Splunk Enterprise Security is to contact them, contact the sales rep, the tech rep, and ask them for a PoC trial. They're very open with this and even with new features. Before we buy anything new, such as SOAR, Splunk offers us to do a PoC. They give us a license to try it for free for a few months and give feedback if interested or not. For any enterprise thinking about it, I would contact them and get them to do a free trial for a while.

On a scale of one to ten, I rate Splunk Enterprise Security a nine.

My main use cases for Splunk Enterprise Security are security operation center and incident response.

The Mission Control feature of Splunk Enterprise Security benefits my organization by providing quick alerts, making it easy for the SOC team to navigate events and find threats quickly.

I use disparate security solutions that integrate or import data into Splunk Enterprise Security. This integration supports our security operations effectively because we work with different tools, and Splunk apps support many integrations, so we don't need to write custom ones; it's available by default.

It has supported our SOC by improving it; in looking through many alerts, we can look at only the critical alerts, and the number of alerts investigated by SOC has changed drastically. Currently, my security ops team remediates security incidents with Splunk Enterprise Security within 45 minutes compared to our previous solution.

I would be using Detection Studio, which is one of the new threat detection features in Splunk Enterprise Security that I'm interested in. Splunk Enterprise Security has definitely helped improve my organization's business resilience; it has helped us to pass our SOC 2 audit, and we have good monitoring about security alerts and threats happening.

I assess Splunk's ability to predict, identify, and solve problems in real time as very good.

I would definitely improve the risk-based alerts in Splunk Enterprise Security, helping SOC analysts to get to the drill-down searches.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include writing detection rules for new threats, finding out about the SPL logic, and writing correlation rules. In ES8, we are experiencing some issues with crashes, and whenever we open the correlation rule, it gives a Java error requiring a refresh. We had not seen that error before, however, we are seeing it more frequently in ES 8.1.

I have been using Splunk Enterprise Security for five years.

Splunk Enterprise Security scales absolutely with the growing needs of my organization; it has caught up with our needs, and we use the tool without any pain.

On a scale of one to ten, I would rate Splunk Enterprise Security overall as eight.

We have definitely expanded our usage over the five years; our utilization of Splunk has totally changed.

I would evaluate customer service and technical support as good and satisfactory because it was not satisfactory a few years back, however, now I see some positive changes, which is good.

Positive

I used IBM QRadar.

I would describe my experience with deploying Splunk Enterprise Security as easy thanks to the cloud.

I have seen a return on investment; though it is an expensive tool, we did see return on investment. The integration is a specific example where we see value; the basic integration with different data is easy and more adaptable. As we use more different tools, Splunk Enterprise Security is able to integrate all those things without needing to create custom integration.

My experience with pricing, setup cost, and licensing for Splunk Enterprise Security is that it is expensive.

I made a change because IBM QRadar was on-premises, and we were transitioning; we had many challenges with the tool when dealing with big data, and it was not able to catch up, which is why we moved to Splunk Enterprise Security.

I would advise other organizations considering Splunk Enterprise Security to use it and also utilize the built-in ES Content Pack, where you have many rules ready, instead of trying to figure everything out. Use that content pack to start, and once you have the basic fundamental detection rules, then you can expand on it.

On a scale of one to ten, I rate Splunk Enterprise Security an eight.

My main use cases for Splunk Enterprise Security are basically triage, ensuring cyber threat defence, and improving speed when defending the organization. Since I am the only one currently in the security team, we are growing this year and next, and we're expanding. Splunk Enterprise Security is improving the process to defend, basically.

The features of Splunk Enterprise Security benefit the organization. You can see threats much faster, helping detect something that the antivirus may miss. Splunk Enterprise Security can work with this, and when the antivirus has a hard position, by using proper detection rules that are well-configured, you can see what's going on in real-time, both endpoint-based and network-based.

The features of Splunk Enterprise Security that I find most valuable include Mission Control, which I really appreciate, the way accelerated data functions, making it really fast to see, the integration with SOAR, which is something really cool and integrates with automated processes, and the way to ingest threat intelligence feeds, which is an amazing feature as well.

Splunk Enterprise Security has helped improve my organization's business resilience, as we were able to detect an attack that was happening after hours and prevent it thanks to the detections. We stopped it immediately in a matter of about 30 minutes. Splunk Enterprise Security has improved my ability to predict, identify, and solve problems in real-time; it's not just proactive, but also really predictive. My organization uses Risk-Based Alerting in Splunk Enterprise Security, which speeds up our process to detect and our mean time to respond. It's very helpful, and after we improved the configurations, we have RBA working fine, something that will always be maintained; it may not be perfect, but we do our best to maintain it.

On average, my security ops team takes less than five minutes to remediate security incidents with Splunk Enterprise Security compared to our previous solution, which used to take hours because we needed to see different sites. We are using new threat detection features in Splunk Enterprise Security by ingesting a lot of threat intelligence feeds from our main vendor, which has significantly improved the indicator of compromise, the IOCs detections. We also use Sigma detections and adapt to Splunk.

The on-premise integration with SOAR could be more simple; the cloud version integrates with SOAR very easily, but the on-premise SOAR and on-premise Splunk Enterprise Security are really not that easy, so I would appreciate if that could be improved. 

Additional features that should be included in the next release of Splunk Enterprise Security are the ability to integrate with other software and tool frameworks, beyond Sysmon, to avoid ingesting Sysmon logs from the endpoint, which can be very noisy at times, resulting in more straightforward detection and less resource-intensive licensing.

I have been using Splunk Enterprise Security for four years.

I have experienced downtime, crashes, and performance issues with Splunk Enterprise Security due to a hardware issue, which we were able to quickly fix thanks to the backup recovery. However, it took about one day, and it highlights the need to move to clustering, which I've discussed with my leadership team.

I would assess the stability and reliability of Splunk Enterprise Security as needing clustering. It ensures it remains operational all the time, which means you can see cyber attacks. When it's down, you can't see anything. 

We currently rely on disaster recovery and backup recovery, which takes time to recover, during which you're basically blind, so I'm pushing my leadership team to switch over to a clustering environment for constant availability. Right now, the server we have meets the hardware requirements, and we have moved to new hardware. 

We're considering moving to cluster environments to scale in the future, probably in a couple of years.

I would evaluate customer service and technical support for Splunk Enterprise Security as excellent; when we open tickets for troubleshooting, 99% of the time, it relates to our Linux environment. I have no personal complaints about the support.

Positive

Prior to adopting Splunk Enterprise Security, Splunk was already in place when I came on board at Educational Federal Credit Union.

In the beginning, we were using disparate security solutions that integrate or import data into Splunk Enterprise Security. Now we are adapting to completely switch to the Splunk Enterprise Security side to have a single-pane-of-glass view of everything, minimizing the integrations with the vendors such as EDR, DLP, and the firewall.

I have seen a return on investment with Splunk Enterprise Security. My executive team has noticed improvements; we were able to save on other solutions, which increased budgeting for future projects thanks to Splunk Enterprise Security and the licensing optimization, allowing us to invest in other tools.

My experience with pricing, setup costs, and licensing with Splunk Enterprise Security has been challenging in the past due to the expensive licensing model, which was driven by Sysmon delivering a lot of unnecessary noise. We don't use Splunk just for security; we also use it for other departments. 

We have shared the license between security and development departments, making sure to minimize ingestion logs from the endpoints, including workstations and servers. We are currently leveraging EDR telemetry ingested to Splunk, which saved a lot of licensing money while allowing us to see what we're looking for.

My advice to other organizations considering Splunk Enterprise Security is that it's the leader in SIEM globally. You have a lot of customization and data normalization, meaning you can detect anything you want compared to other SIEMs. Splunk Enterprise Security is worth the investment because it provides exactly what you need if you are a true cyber defender. I also network with friends from a company, Next-Gen Systems, which is leading in detection and investing in developments and integrations with Splunk due to its scalability. 

On a scale of one to ten, I rate Splunk Enterprise Security a ten.

Currently, we are monitoring all logs for retention as well as real-time monitoring using Splunk Enterprise Security, and there is a log management component that utilizes the retention period. These are the things we are currently doing.

Threat detection in Splunk Enterprise Security is more than 60 to 70% faster compared to other tools. The main advantage is not only detection but also proper analysis, as other tools sometimes miss fields, while here we can search the raw logs for detection as well as evidence, which is very helpful.

Currently, Threat Topology and the MITRE ATT&CK framework in Splunk Enterprise Security are helpful, but we have not explored them in-depth.

The integration of threat intelligence directly into the TDIR workflow in Splunk Enterprise Security allows us to block more than 50% of threats, but due to our maximum customer environment, we cannot adopt it directly, so it is not fully automated right now.

The best feature I have in Splunk Enterprise Security is Mission Control, which enhances our SOC to real-time monitoring of incidents. The second notable feature is the threat feeds, which capture the IOCs very well.

The solution has improved my mean time to detect and resolve by about 20 to 30% in real-time for resolving an issue.

Risk-based alerting in Splunk Enterprise Security has impacted us because higher risk alerts are more critical and can be easily identified by our SOC team, providing a proper solution on that. The risk-based analysis is very good, but we need to apply this for all the correlation rules, which is not fully automatic and requires manual effort for risk.

From my point of view, the AI-driven detections in Splunk Enterprise Security scale at about 10 out of 6 in terms of helping improve the accuracy of my investigations, but I still miss a few correlation rules because the maximum correlation is based on the MITRE framework and other factors. There is still a need for improvement related to AI-based detection.

My thoughts on UEBA in Splunk Enterprise Security is that the user behavior analysis feature is very good, but it relies heavily on the identification of logs. We are capturing the data, and while Splunk Enterprise Security is good, proper integration with devices such as Active Directory, single sign-on devices, PingID, and multi-factor ID is essential, with configuration and data model creation being manual rather than automatic.

I have been working with Splunk Enterprise Security for six years or more.

Regarding stability, I rate Splunk Enterprise Security at 9 out of 10. Right now, it is stable, and the other components are much better.

I would rate the scalability of Splunk Enterprise Security at about 9 since the maximum component is on the cloud, so we encounter no issues with scalability.

In comparing Splunk Enterprise Security with other solutions or vendors, the timely support is one noticeable aspect, and I rate it a 7 out of 10. Some vendors provide good support, but I have experienced some delays with RCA when integrating other solutions such as QRadar, IBM, and other SIEM tools, indicating a lack of customer support.

I would rate the customer support for Splunk Enterprise Security at 7.

My thoughts on the pricing of Splunk Enterprise Security is that it is not cost-efficient. Splunk Enterprise Security is very costly compared to other market tools.

I have upgraded to Splunk 8.0, and it is currently running on version 10.3.2.

In our company, there are 20 specialists working with Splunk Enterprise Security.

Our clients are not small; they are enterprise businesses.

I would rate this review 7 out of 10.