Splunk Enterprise Security Reviews

With the use of Splunk, we were able to identify a brute force attack against a "switch" network device. An external attacker attempted to connect multiple times using multiple usernames. Splunk was able to detect these attempts and immediately blocked these attempts.

Splunk has facilitated the correlation of information security logs to look for incidents which could cause damage to the company's infrastructure, as well as financial losses from leaks.

Splunk's ability to receive all types of data and identify it correctly. It obtains a correlation of the logs and identifies incidents.

Splunk can improve regex/asset analysis as we do not want to crawl until it is done. I could not find a timestamp for when the log was processed and generated.

We primarily use it to correlate logs throughout the enterprise for both searching and use in investigations.

We previously did not have a good centralized solution which could ingest just about any log type, which has been a plus.

The search application has been the most useful. We have also liked the reporting features and dashboard capabilities.

The Enterprise Security app could be improved. We have had trouble with it working from the first day.  

Yes, there have been issues with the Enterprise Security application instance.  

No issues.

It has been a weak point, but has improved over the years. It can be tough to get a hold of somebody depending on the complexity of the issue.  

Years ago, we did use another solution, but I am not sure it exists any longer. We have been using Splunk for many years.  

We had professional services set it up, as it was quite complex.  

Vendor implementation, and I would rate them as a seven out of 10.  

Excellent overall. 

It can be expensive, especially the licensing costs. However, there is added value in what it can do, not just log aggregation.  

We evaluated Trustwave and QRadar.

It is a great product overall. I would like to see improvements on the Enterprise Security app/SIEM functionality.  

I work with Splunk, as a contractor, so I use it in many different areas. Most often it is used to get performance insights on applications or servers. Recently, I have used it in more of an endpoint security mindset. 

My whole organization is built around Splunk. We provide Splunk PS to many different companies. If Splunk did not have such a good presence, we could not exist.

The best features would have to be the ability to ingest any data and display it in a way that anyone can understand.

It needs more thoroughly tested releases. Every new big version (6, 7, etc.) has had so many bugs that it makes me wary of customers upgrading right away.

Splunk provided me a platform to analyze both infrastructure loads and application performance for quick troubleshooting saving a load of time. Versatile apps at Splunkbase helped me to better configure and enhance visualization of the KPIs in my application.

• Splunk has reduced application downtime by helping identify the point of failure.
• It has helped in identifying information streaming bottlenecks. 
• Its machine learning capabilities along with custom script implementation has helped the organization a lot.
• Visualizations helped the organisation have a better understanding of its KPIs. 

Its huge, versatile AppBase helped me to configure and bring data from different sources to a unified platform. 

• Custom visualizations are real hard. While the default visualizations are good, creating enhanced visualizations are complex.
• Configuring a few apps is complex, not straightforward.

No stability issues.

No scalability issues.

Splunk setup is easy and straightforward. 

Splunk is a bit pricier, but the benefits and ROI are huge.

We also evaluated ELK, Dynatrace, and New Relic, but Splunk provided a comprehensive solution to fit our all around needs.

• Log monitoring and alerts
• Looking up information 
• Dashboards for nice, fast information about various application servers.

• It is easier to find problems and exceptions.
• It is used by any factor in the firm.
• Easy dashboards creation.
• The visibility is amazing.  

• Regex for fields creation is great.
• High availability
• Easy to use in any environment.

Make it easier to include roles and user controls, as it is horrible now.

Not even Splunk's support guy, who came to our firm, could help with defining proper role management.

It is a pretty high cost solution, but if your organization has the funds, it can bring many benefits.

The primary use case is to analyse and monitor big data, creating various dashboards, alerts, etc.

• We can do things in minutes instead of days.
• We solve issues that we previously could not since we now have the data.
• We can quickly search for almost anything across many log sources in seconds.
• Teams have the dashboards or alerts that they need.

There are too many features to list, but here are a few:

• Schema on the fly

• Ease of onboarding data

• Machine learning

• Apps or Splunkbase.
• Great list of apps to use and build upon once you learn more about how Splunk works.
• Ease of correlation, creating correlation searches (easy), and you can combine multiple sources with little effort.

• Data Models Acceleration for super fast searches across tens of millions of events.

• Common Information Model

• Security Essentials App

• Enterprise Security

• Splunk SPL (Search Processing Language) is easy to learn and has IDE like capabilities.

• Log storage or compression is great and retention is not an issue.

• Dashboards are simple to create and has input options, like time range and text.
• Drop-downs are simple to create.

• The integration with cloud solutions is great and keeps getting better.

The GUI could be improved to include some of the capabilities that other BI solutions have. The layout is a little restrictive where you can’t resize all the panels to exactly how you would like them without tweaking some XML code. Over the years, they have really been improving in this area. I would think that will continue and this will become a non-issue.

Also, AngularJS/ReactJS inclusion could be made easier in GUI.

Personnel costs are saved by not having to involve domain developers from multiple teams when tracing a problem that spans multiple platforms.

We build many of our own apps by leveraging the logic in others.

Although my company uses Splunk extensively, my use case is primarily the Enterprise Security add-on.

Splunk has enabled us to utilize many different data sources and is easy-to-use. It has a rapid response search environment in the event of an incident.

The correlation searches (properly configured) populate the Incident Management dashboard and provide me a quick birds-eye view of my most important concerns.

ES is very powerful, but it requires a mature security posture at the company to take advantage of it currently. The use cases provided by Splunk are a good starting point, but could cover many additional topics to ensure that a smaller or less experienced shop might maximize the value of an ES deployment.

We were using a different SIEM, which was old-fashioned and very structured.

We use Splunk primarily to provide our security and ops groups with important insights to more efficiently make decisions and take action.

My favorite example of improving of organization is saving a $60k/mo in payroll fraud and $10k/mo in wasted API credits by using simple searches and clear reports.

Splunk's schema on demand is incredibly useful. I do not have to worry about what my users will need when we onboard their data. They can make connections that we could not have foreseen. They dig deeper when they are searching.

Some of the terminology can be confusing, even for seasoned vets. Renaming components at this point would be a serious undertaking. However, it might be beneficial in the long run.

While Splunkbase (the app repository) has a lot of great content, some apps are terribly old and could stand to be updated or purged.