Splunk Enterprise Security Reviews

Splunk Enterprise Security is used primarily for reviewing notables and security events as a SIEM. My daily work involves reviewing notables across our environment, such as network traffic. For example, if one of the devices from our network reaches out to an IP that has suspicious or bad credibility, it gets flagged. I investigate that communication to understand why it is reaching out to that malicious IP and determine if it is something actionable or if it was blocked by the firewall. I review the logs and use Splunk Enterprise Security to conduct our incident response.

One of the best features Splunk Enterprise Security offers is integrating everything into one platform. Having the ability to investigate events without leaving Splunk Enterprise Security allows me to stay in the same environment and access all information from other platforms and network traffic logs. I can complete my entire investigation through Splunk Enterprise Security without needing to go somewhere else.

Splunk Enterprise Security helps my day-to-day work by making it easier compared to other tools. It allows me to stay in the same tab and start running queries, find my investigation, and run everything without stepping away or taking time to log into another application to find information.

Splunk Enterprise Security has positively impacted my organization by enabling us to take action on notables. It streamlines everything, and all the other analysts know that we need to address those notables with urgency. It allows us to maintain that level of security within the company and investigate those security events, bringing everything under control and having visibility if something bad is happening within the environment.

Splunk Enterprise Security has helped our team by showing faster incident response times with the MTTR, or Mean Time to Respond. By tracking it, we can see how our analysts are able to target those incidents and resolve them with urgency and do them faster.

The improvement for Splunk Enterprise Security is happening now as they are implementing the agentic SOC, with agents helping with the mundane work for the analyst. If an agent is already looking through investigations and reaching the point where it is an actionable event, having the analyst look into it to ensure it is something we want to do is one of the biggest improvements I am seeing.

I have been using Splunk Enterprise Security for about five years.

Splunk Enterprise Security is stable.

The scalability of Splunk Enterprise Security is great. It is always improving, and we can use it and implement anything new that comes up.

The customer support for Splunk Enterprise Security is great. I have not had any issues with it, as they have always been there to support us, especially regarding any problems or if we wanted new training or resources. The Splunk representatives have been amazing. I would rate the customer support a 10.

When I came into the company, we already had Splunk, so I have not used a different solution.

I am not sure which options were evaluated before choosing Splunk Enterprise Security. The company already made its decision, so when I started working in security, I was already on Splunk and learning it.

I am not sure if we have seen a return on investment since we still have the same number of employees. However, Splunk Enterprise Security definitely allows us to be more efficient in what we do.

I am not sure about pricing, setup cost, and licensing since I am not the one making purchases for Splunk Enterprise Security. I am just using it.

My advice for others looking into using Splunk Enterprise Security is to go for it. You always get what you pay for, and I believe this product has everything you need to ensure it is a good investment for your company. I would rate this product a 10.

I have been using Splunk Enterprise Security for the last five years, mainly building use cases for the SOC team. My role involves analyzing logs and writing vulnerability alerts based on what I observe. When security alerts are triggered, the security team receives notifications and takes appropriate action.

For the initial deployment of Splunk Enterprise Security, I cannot say this is easy. It is somewhat complex because when you purchase the product, you have a lot of data. You need to align all of your data so that it fits Splunk Enterprise Security standards. Splunk Enterprise Security has custom data models and custom correlation searches that are already defined. You need to modify or set your data according to Splunk Enterprise Security standards. Once you complete this setup, the product is amazing and will do all of the work.

The most valuable aspect of Splunk Enterprise Security is that SIEM compliance is one of the best features. I can say this not only because it is Splunk Enterprise Security specific, but also because it is Splunk specific. All data coming in needs to be placed in the SRC field. All data will be normalized with the SRC field. Whether you are collecting data from a firewall or from numerous products, all data with the same name will be automatically collected by Splunk Enterprise Security alerts. Based on that, you can get all alert triggers and perform any kind of investigations. If something goes wrong, such as someone wrongly accessing servers, you will get everything very quickly based on the authentication data model. The alert part and security investigation part are very good.

Threat intelligence is very helpful because there is a threat intelligence model in Splunk Enterprise Security. It will identify threats from around the world and bring them into Splunk Enterprise Security. AI also helps us. When a wrong IP is detected, an incident will be created in Splunk Enterprise Security. Once you click on the "get more info" button, it will bring all information about where this IP belongs, including location and coordinates. Based on that, you can trigger security incidents and alerts.

I am very familiar with risk-based alerting in Splunk Enterprise Security. Everything in Splunk Enterprise Security is on a risk-based model. When I found an unknown IP detection one time, everything is assigned with a risk score. If I found an unknown IP one time in one hour, the risk score might be five or ten. If the same thing repeats in one hour, for example if an unknown IP tries to log in twenty times in one hour, the score should be higher. Risk-based alerting will check the notables and increase the score. When you have one hit, the risk score will be two. Whenever you have more hits, the risk score increases and the alert severity and alert priority also go high, becoming a P1 or P2 incident for the analyst. Risk-based alerting is a very good feature in Splunk Enterprise Security.

MITRE ATT&CK is helpful for Splunk Enterprise Security. I take reference from this framework whenever I want to create alerts. The first thing I do is check the MITRE ATT&CK framework and read the documentation. In MITRE ATT&CK, there are tables with many rows and columns. I check these tables and review all the alerts. MITRE ATT&CK shows the security framework and the maximum possible things that can be done to secure our platform. From that MITRE ATT&CK reference, I create alerts.

The main dislikes about Splunk Enterprise Security are that we need more highly skilled people and the license for Splunk Enterprise Security is costly. Beyond this, the infrastructure cost is too high. Since we have an on-premises deployment, it is costly for us because we need a lot of storage and a big server.

From a maintenance perspective, Splunk Enterprise Security sometimes requires maintenance because it continuously monitors all alerts and continuously creates incidents. Sometimes the data volume is high and some searches will be skipped automatically. We might have 1,000 searches and sometimes experience a lot of skipped searches. Sometimes if we modify any macro, there can also be issues. We need at least one person for maintenance who can continuously ensure that Splunk Enterprise Security is running fine.

Regarding support for Splunk Enterprise Security, we reach out many times. Initially, we purchased hardware that was not capable enough. Sometimes our server became choked and Splunk was not able to run some searches on Splunk Enterprise Security. These issues were due to hardware limitations. We called a consultant from Splunk who analyzed the platform and fixed the issues. Sometimes we upgraded our platform twice by adding additional disk space and RAM.

We have not upgraded to version 8.0 yet for Splunk Enterprise Security and are currently on version 7.0. Recently, we have a demo scheduled from the Splunk team to learn about Splunk Enterprise Security 8.0 features. However, in version 8.0 they changed everything. Initially, we had an incident review dashboard and risk management dashboard that I was very familiar with. In Splunk 10X, all the names changed and everything was restructured. Currently, I am still learning which old features correspond to the new ones. They changed many things, which is also one of the disadvantages, as the changes were extensive.

Splunk Enterprise Security has never crashed. However, sometimes there was lagging, but this was due to our infrastructure because we have an on-premises deployment. I used it in the cloud three or four years ago, and the cloud version is very stable with no scalability issues.

Overall, I can give a rating of nine for the scalability of Splunk Enterprise Security.

Splunk Enterprise Security support deserves a rating of nine.

I have never used any alternative to Splunk Enterprise Security. Before Splunk Enterprise Security, we were using Splunk for monitoring purposes, writing queries and preparing alerts. However, this is not what Splunk Enterprise Security does. A normal traditional alert can be scheduled based on Cron or similar methods. Splunk Enterprise Security collects threats from around the world and includes a threat intelligence data model. It manages identity and asset information separately, which cannot be done with our traditional approach.

For the initial deployment of Splunk Enterprise Security, I cannot say this is easy. It is somewhat complex because when you purchase the product, you have a lot of data. You need to align all of your data so that it fits Splunk Enterprise Security. Splunk Enterprise Security has custom data models and custom correlation searches that are already defined. You need to modify or set your data according to Splunk Enterprise Security standards. Once you complete this setup, the product is amazing and will do all of the work.

The mean time to resolve in Splunk Enterprise Security will increase. On other platforms, whenever you create alerts, you only need to see what is there and then troubleshoot everything. In Splunk Enterprise Security, when you create an alert, you can add many additional things. For example, once an unknown IP is detected, it will send an email, create an incident, and create a notable inside the security system. It can do many things and you can add more information. You can check a lookup, check an IP, or follow specific steps. You can add multiple steps to follow as well. All of this will be included with the alert, which resolves a lot of mean time. People do not need to go searching to find how to do things. This significantly reduces the time needed and alerts are immediate. Whenever something goes wrong, you will be notified quickly.

With Splunk Enterprise Security, we detect threats frequently. I work with a major client in the Emirates, and we find a lot of attacks happening and many phishing emails. Sometimes we have two firewalls, one is a DC firewall and one is a Palo Alto firewall, with many compliance requirements. People attempt to access these systems and sometimes send vulnerability emails. For all of these things, we are blocking and detecting with Splunk Enterprise Security and immediately notifying the candidate to not open emails or notifying our team via email.

It reduced the analyst's workload in Splunk Enterprise Security. However, after purchasing Splunk Enterprise Security, we hired more people to analyze the data. By purchasing this product, we came to understand that we can implement additional features and security rules. Our team is continuously and actively working, checking the MITRE ATT&CK framework, finding detections, and implementing them on our platform to make it more secure.

MITRE ATT&CK helps detect patterns that have occurred before.

ES Essentials is in our environment for Splunk Enterprise Security, though I have never focused much on working with it and do not know much about what it does.

Overall, I would rate this review as a nine.

I verify users who have permissions to certain files, losing, or moving data. I use this for an overall view of the court system for our users.

I would say the level of detail is valuable. When I need to find something, I can find it relatively easily with the queries and also the helpful tips and guides. I use them often as they are helpful when I need to find a certain syntax or command that I may not know offhand.

Overall, I appreciate the fact that I have a lot of control and I can use that control to dig deeper into things that may stand out. It has impacted us positively because we have a better view of our security posture and we can look into more detail on notable events that may occur.

The reporting feature, using a daily report that gets emailed, helps with time management. I no longer have to go through different dashboards. I can have it set to automatically send me a report, which makes my time easier to find something specific and work on it if the report indicates something that needs attention.

I would recommend more training videos and simulations on what the tool can do. I know it is a huge tool that has many capabilities. Educating and providing guidance on those features would be beneficial, because new features seem to be added quite frequently.

I would also suggest more videos or features, such as pop-ups that help or guide a user when they are looking for something in particular. An AI chatbot that could guide you on what you are trying to accomplish would be helpful.

I have been using this solution for about one year.

I believe Splunk Enterprise Security is stable. I have not had any issues.

Splunk Enterprise Security's scalability is very good. I have not had any issues.

Customer support is very good. I have not had any issues reaching out to customer support. I rate it a 10.

I did not use a previous solution.

That is hard to quantify as I do not have a say in the return on investment, but I will say that the tool is very easy to use and I definitely recommend it moving forward.

I did not evaluate other options before choosing Splunk Enterprise Security.

I would let potential users know that this is a great tool that has many features and capabilities. It is almost a one-stop shop for everything that you need to view your environment. Although it may be daunting at first, it is very easy to use once you get the hang of it.

I appreciate Splunk Enterprise Security. I do feel that there is a lot that this product can do, and I would like to see more guidance, documentation, videos, and simulations to see it firsthand. I rate this review an 8.

My main use case for Splunk Enterprise Security involves new detections and correlation of events. I use data points that are submitted via information-sharing communities and use those as artifacts, TTPs, and IOCs to build my own detections for behavior in my logs. Using those detections I can identify suspicious or malicious behavior.

Splunk Enterprise Security has saved us time and money by making it easier to investigate events. It has helped us in correlating similar events and identifying things that we might have missed if we were to search it out manually. Specific tools that we use, like Attack Analyzer, do all the work for us. After it identifies an event of interest, it will do the investigation for us so that we can reach decisions faster and have less time by the human doing things that a machine can do.

Splunk Enterprise Security has helped us and has been more beneficial in the past, but our expectations have grown over time, and we feel like Splunk is not currently meeting our expectations. A lot of the configuration is do-it-yourself rather than out-of-the-box or just a checkbox to implement. It improved things initially by cutting our MTTR in half upon implementation about 12 years ago. Since then, we had a significant reduction when we adopted Splunk Attack Analyzer, cutting it by 75 percent. Our decision-making ability is now being leveraged rather than our investigation abilities.

We have been able to leverage Splunk research or develop our own detections, cutting the time to detection from days to hours. Splunk Security Essentials allows us to focus on the artifacts and the decisions as opposed to the investigation. Decisions can be made in seconds. Investigations are performed by a machine and it saves us dozens of minutes per incident. The unified workflow has made it possible for there to be automatic investigations and for us to triage quickly by identifying the artifacts of interest. This has improved our daily work experience and has improved team morale, which has led to greater retention.

The best feature Splunk Enterprise Security offers is the correlation feature, being able to do automatic lookups and enrichment of data. Those automatic lookups allow us to convert IPs to network names that are human-readable and also convert user IDs into usernames and give us business units. We can have a lot of contextual information about a person and where they come from and where they are going without having to do that lookup manually ourselves. In addition to doing those lookups, it can also correlate data. If there is a specific ID or session ID or other relevant artifact, we can see that data from other data sources and it is very useful to have it all organized chronologically.

I think that there is a rich ecosystem around improving Splunk Enterprise Security, and the question we often ask ourselves is why Splunk Enterprise Security does not already do that and why we have to pay a third party to do that. We often question whether it is easier to pay the third party to do the enterprise security data enrichment or service, or if it is better and easier to just try to implement it ourselves. We will often buy into a third-party product only to have it available in Splunk a year or two later.

I have been using Splunk Enterprise Security for 12 years.

Splunk Enterprise Security has experienced stability issues.

Splunk Enterprise Security is a bit expensive to scale.

Customer support was better in the past and it is hard to find really good support. I think that it has all been outsourced.

The unified workflow has made it possible for there to be automatic investigations and for us to triage quickly by identifying the artifacts of interest. Splunk is no longer unique as SIEMs are now a commodity. Splunk still has a foothold with the unique detection logic, but I expect that to change in the next couple of years. Splunk Enterprise Security is a bit expensive to scale. Customer support was better in the past and it is hard to find really good support as it has all been outsourced. I would rate this review a 7.

Splunk Enterprise Security was the major use case that I had.

As a service provider and person managing the tool, the biggest advantage that stands out for me is quite significant. I am using disparate security solutions to integrate or import data into Splunk. I have worked with risk-based alerting in this aspect.

In banking, the logs generated are significant, so everyone should be aware of not facing emergencies such as service failures. Debugging and analyzing these services are really important, especially for larger organizations such as banks, where the services should be implemented with Splunk.

Splunk Enterprise Security helps to improve business resilience by being dependent on the services the company provides. If the processes are heavy such as banking, healthcare, and aviation, it is quite helpful. However, for a small and less complex system, it is not useful because it contains a very heavy architecture. It can be quite expensive to implement for them, but for larger processes and products, it is quite useful.

High infrastructure requirements are present when I integrate Splunk into my full services such as app microservices, database, CloudWatch, or the machines where I have deployed the services. I have to integrate into all the platforms I am using. It needs another machine or infrastructure to manage all the logs and generate these kinds of reports.

Regarding the learning curve, any beginner encounters trouble with it because it is complex to implement across all services due to the huge amount of applications or functionality to watch and implement. I also mentioned earlier that the pricing is a concern because it does not provide any free tier to use; therefore, I have to use the paid version, which is quite expensive, costing thousands of dollars per one gigabyte or ten gigabytes of data generated.

I believe the pricing is quite expensive. It generates a huge amount of data, so it sometimes works slowly for the generated logs. I can say around ninety-eight percent uptime because I can sometimes get into trouble finding logs across the services in the generated logs.

The learning curve, its implementation, and its pricing are quite heavy for learners or purchasers.

I have used Splunk Enterprise Security for three years now.

Splunk Enterprise Security is fully scalable because it provides all kinds of configuration in management servers and all cloud integrations such as AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub, Jenkins, and Cisco as well. It is quite fully scalable across all platforms.

My manager discussed licensing earlier, but I did not have the need to call them later after implementing. After my organization bought it, they provided quite a good response from the support team.

When I compare Splunk Enterprise Security to other tools, I have been using various solutions on average to allow my SecOps team to remediate security incidents with Splunk.

Regarding the installation and deployment, I would say it is quite complex. It is complex because I have to deeply learn it due to the many things involved. As a beginner, it is quite complex to learn. If a senior developer or individual is trying to implement it, that is time-consuming because I have to do a lot of things to implement Splunk across the services and servers.

If I quantify the return on investment of Splunk in percentage, I would say it is around ten to twenty percent on average for its services provided because these bugs or hacker attempts are really rare cases, making it heavy to calculate.

I did not purchase it because these transactions are handled at the organizational level. The higher managers process these purchases over the AWS cloud, so as a developer, I am not included in that process.

I am using a new threat detection feature in Splunk. When I implement Splunk, it provides a dashboard or methods to implement these threat detection processes. It gives me an email trail that identifies when services and which users are trying to breach security. If any service has failed, then it also triggers an email or a notification in the dashboard. These are rare cases, but I find the average number to be acceptable.

I have used Azure for deployment. I rate Splunk Enterprise Security nine points out of ten, and my overall review rating for this product is nine out of ten.

My main use case for Splunk Enterprise Security is detection and engineering. We are looking for all different kinds of threats with Splunk Enterprise Security and then we ingest data sources from different telemetry to look at our posture, starting from MFA to everything else. That is our main use for Splunk Enterprise Security.

In my experience, the best features Splunk Enterprise Security offers are the in-depth search, dashboards, and all those features.

Our dashboards with Splunk Enterprise Security give us our metrics, and I also use it for the executive dashboard. For example, we use it for lateral movement and email security, and basically, we use it for protection and firewalls as well, ingesting all the logs.

Splunk Enterprise Security is our main MDR service and the center of our cybersecurity operation, where we have all the alerts ingested and present.

Since implementing Splunk Enterprise Security, I have seen a faster response time, and we can also suppress noise, including false positives.

I think Splunk Enterprise Security could integrate more features, just as a SOAR should be part of the product, along with more AI detection features, and additional features available in observability. The current offering is not sufficient.

I have been using Splunk Enterprise Security for two years.

Splunk Enterprise Security is stable.

In terms of scalability, Splunk Enterprise Security is pretty scalable. You just have to pay more.

We have very good customer support with Splunk's SE, and while sometimes responses can be slow, overall it is satisfactorily defined. I would rate the customer support of Splunk Enterprise Security an eight out of ten.

We previously used LogRhythm, and that decision was made by someone else, our former CIO. We owned Splunk before and decided to go back to Splunk again.

I have not yet seen a return on investment. It is still hard to quantify because we are still configuring and building our metrics to measure it. We started some metrics and I am hoping to get those in the next six months.

My experience with pricing, setup cost, and licensing is that pricing is high, and it feels as though it is not very transparent. We do not know what discount rate we are going to get, and I have to buy multiple different products.

Before choosing Splunk Enterprise Security, we knew what we wanted to do, so I did not have to evaluate other products.

Splunk Enterprise Security has helped reduce our team's average meantime to resolve metric by about 50 percent because we are able to tune it to lower false positives and noise.

I would say Splunk Enterprise Security helps us detect threats faster because we are able to tune the number of alerts sent out, resulting in fewer alerts we need to monitor.

We are still developing the impact of Splunk Enterprise Security's risk-based alerting on our alert volume and analyst productivity.

Having the consolidation of SIEM, SOAR, and UEBA into a single interface with Splunk Enterprise Security improves our operational efficiency and provides a single pane of glass.

The integration of threat intelligence directly into the TDIR workflow with Splunk Enterprise Security improves our ability to preemptively block threats and makes our decision-making faster since we have intel ingested in the platform instead of referencing different sources.

Regarding Splunk Enterprise Security Essentials, we have not worked much on the cloud side, so it has not improved our visibility across hybrid or multi-cloud environments.

My advice to others looking into using Splunk Enterprise Security is that if someone wants a very comprehensive solution, it is the way to go. However, they need to ensure they have a person who can handle, configure, maintain, and add rules and policies, as it is not the product they need to buy unless they have managed services. I would rate this product an eight out of ten overall.

My main use case for Splunk Enterprise Security involves log aggregation, anomaly identification, visualization of potential issues, errors, and threat modeling.

I create specific reports or dashboards to measure log patterns or events that fall outside of our specific thresholds, such as user logins multiple times a day or users attempting to hit protected routes that they don't have access control for.

All the features of Splunk Enterprise Security are quite great and necessary. I think being able to create and share visualizations and dashboards is really helpful for allowing my less Splunk-savvy co-workers the ability to still monitor and investigate issues or potential incidents.

Typically, my coworkers use the dashboards I create for monitoring system health, error rates, and similar metrics, but then with visualization drill-downs, that allows them to dig deeper into what an issue might be caused by, which parleys into incident response.

Splunk Enterprise Security has positively impacted my organization by providing enhanced logging capabilities in addition to standardizing log approaches and visualizations, allowing us to create and share dashboards and visualizations so that all of our various enterprise programs can implement standard and consistent dashboard methodologies.

I think the addition of the new Splunk AI Assistant into Splunk Enterprise Security would be really helpful, especially for new Splunk users to be able to rapidly learn and generate complex SPL queries.

I believe we have been using Splunk Enterprise Security for about six years.

Splunk Enterprise Security is stable.

I think Splunk Enterprise Security is very easily scalable both horizontally and vertically; we have had no issues expanding as needed.

Customer support has been fantastic.

I have used a couple of different solutions; traditionally, I looked at logs on servers through tail, cat, and vim, and I played around with other log aggregation solutions including Kibana, but I have been with Splunk for about six to eight years.

I think my experience with pricing, setup cost, and licensing has been pretty positive. As far as licensing goes, it has been pretty transparent. The bulk of the expense for Splunk Enterprise Security comes from data storage and retention, so thankfully, we have been able to work with both our Splunk and cloud partners to come up with a retention policy and life cycle plan that works for us and fits within our budget.

We used direct contract procurement to purchase Splunk Enterprise Security.

I have definitely seen a return on investment. Although I don't know that I can quantify that ROI, I have definitely seen a reduction in administrative burden, allowing us to redirect both our analyst and engineering resources to focus on actual remediation efforts or identification of incidents and response times, rather than engineers having to spend a lot of time parsing logs or incidents.

I think my experience with pricing, setup cost, and licensing has been pretty positive. As far as licensing goes, it has been pretty transparent. The bulk of the expense for Splunk Enterprise Security comes from data storage and retention.

We evaluated other options before choosing Splunk Enterprise Security, including Kibana, Dynatrace, and Datadog.

I would say to do a lot of homework in researching the different tools and modules within Splunk Enterprise Security. Splunk Enterprise Security is obviously very essential and is the heart of Splunk, but all of the other tools that are available, such as SOAR and RUM, are important, so identify exactly what your enterprise needs and map that to the different Splunk modules to make sure that you are getting as much as you can from Splunk. I provided this review with a rating of 9.

I work with Splunk as a service provider as well as a customer because we use Splunk internally.

This is used to run the Security Operation Center to conduct 24/7 monitoring for any security alerts and incidents for our use cases and use cases for our clients.

We do use some disparate security products that integrate or import data into Splunk. We have integrated Splunk with many threat intelligence sources, including external threat intelligence sources. We have a direct Splunk integration with CrowdStrike, and we have many other integrations with Splunk itself.

We have integrated Splunk with many log sources, including firewalls and other devices. From those firewalls and log sources, we have configured alerting in our Splunk environment. This helps us in detecting and alerting any security incidents.

Splunk Enterprise Security's biggest benefit is the ecosystem itself. It has many connectors and plugins built-in, which provides all those capabilities as part of its ecosystem.

I have a very positive impression of the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security. The alerting part does support our SOC.

Splunk Enterprise Security's biggest advantage is the ecosystem. The large ecosystem can detect threats from a variety of devices, including firewalls and antivirus software. Because Splunk Enterprise Security has many built-in rules for detection already, I do not write many playbooks from scratch. Splunk Enterprise Security has many detection rules that are already provided, which helps me get started on threat detection faster. This is due to two primary reasons: the large ecosystem, by which Splunk can integrate with many varieties of devices, and Splunk Enterprise Security, which has many built-in rules that help me detect threats.

It helps me predict, identify, and solve problems in real-time, which helps me detect threats in real-time and then take action faster. Because of this, any security incidents can be prevented.

There are two parts to consider for areas of improvement. One, especially after the Cisco acquisition, is from a pricing point of view. From a pricing perspective, the costs have become higher, as I understand from our procurement team. The other area is from a support perspective. Support has declined, but it is starting to improve again, though it still could be better.

I have used Splunk for eight years.

I find the installation part quite straightforward.

There is no quantification of time-saving or money-saving benefits of Splunk because it is more focused around threat detection itself.

It is worth buying the product, definitely, because no other vendor supports the kind of integrations that Splunk supports, even though the price is a little on the higher side.

The biggest piece of advice I would say to people looking to use Splunk Enterprise Security in the future is to check the compatibility with the ecosystem of products they are using within the enterprise or within their own business, and see if it is supported by Splunk Enterprise Security. Because if they use a firewall which is not supported by Splunk Enterprise Security, then it will become a challenge in detecting any threats on the firewall because the logs cannot be ingested or consumed by Splunk Enterprise Security. The most important thing is to check their ecosystem and whether Splunk Enterprise Security supports logs from their ecosystem. I rate this product an 8 overall.

Our main use cases for Splunk Enterprise Security are to find the root cause of any applications, to see the dashboards, to see the logs, and to centralize some logging systems.

Managing logs is very easy with Splunk Enterprise Security. Earlier, we were using DataDog and before that, we were also using our own tool, 24/7, to maintain logs and everything. In that, we faced many issues maintaining logs from many applications because we are managing many applications right now. So it was very tough, and when we were introduced to Splunk Enterprise Security, we used it, and it became very easy to maintain. It is easy to have control over it.

The main benefits I have seen from using Splunk Enterprise Security are mainly two things: the pricing and the manpower. Right now, we do not have to worry about the time if we encounter any issues. Recently, one of our customers raised an issue that the application was running very slow. Earlier, we had issues like that, but at that time we had to do so much manual checking everywhere to find the issue. Right now, if we get an issue regarding this, it is very easy to understand the root cause.

One thing I would like to see improved in Splunk Enterprise Security is a better user manual. Right now, it is pretty tough for any newcomer or new user to understand everything because there are no specific areas for them to learn from.

From a features perspective, an enhancement I would like to see is a better learning aspect. The AI feature is great, but I believe enhancing the learning part for any new user would be beneficial.

We have been using Splunk Enterprise Security products for the last eight to nine months, but I have been onboarded on this in the last six months.

The stability, reliability, and performance of Splunk Enterprise Security are pretty good. Now we are very stable with many production systems, and Splunk Enterprise Security is also scalable if we want to expand further.

I would evaluate the tech support team as good.

I previously used different products and solutions like in-house technologies and DataDog.

The initial setup process for Splunk Enterprise Security was somewhat challenging. As I mentioned, it lacks a specific user manual, making the initial setup tough, but now we are hands-on and comfortable with it.

Regarding ROI, while I cannot speak specifically about the investment, I can say that the returns are good. We achieve one hundred percent productivity utilizing Splunk Enterprise Security to create multiple dashboards and find various issues.

On the pricing aspect, I find the setup cost and licensing of Splunk Enterprise Security to be relatively cheaper compared to what we used earlier. I can say that what we are paying is worth it based on the value we receive.

We decided to switch to Splunk Enterprise Security because of the ecosystem. We are also using Splunk Cloud, and we have a good relationship with Splunk. The pricing compared to what we were using earlier is worth it.

The key differences, apart from pricing, are the visibility and observability. We did not get good visibility with the previous tools, but now we have a very clear view, which is why we switched to Splunk Enterprise Security.

My advice for anyone considering Splunk Enterprise Security is to understand the basics of logging systems first and determine your use cases before building specific functionalities in Splunk Enterprise Security.

We have recently upgraded to Splunk Enterprise Security 8.0, and we are evolving everything now. We are evolving frameworks and many other things within it. I would rate this review an 8.5 overall.

Splunk Enterprise Security is mainly used for detecting and monitoring log analysis, threat detection, and incident investigation. It is primarily used for failed login detection where multiple login failed attempts occur from the same source IP. Brute force attacks are another common use case. Splunk Enterprise Security use cases can be extended through visualization on data dashboards, setting incident triage, and Windows event log analysis in SOC environments. I use it from a SIEM perspective in my organization.

The best features of Splunk Enterprise Security are that it is the leading platform in cybersecurity right now in SOC environments. Business resilience is very useful for real-time monitoring and investigation, which improves our business resilience.

The AI-driven detections have improved the accuracy of my investigations significantly. I have worked with two other SIEM tools: Wazuh and Azure Microsoft Sentinel. Compared to both, Splunk AI is very good. When we mark an alert as a false alert, Splunk Enterprise Security automatically detects it as a false positive. Whenever another similar alert comes through, it automatically takes action, so we will not get that alert on our dashboard again. It automatically handles false positive alerts, preventing clutter on our dashboard.

It has reduced my mean time to detection (MTTD) by about 30 percent and my mean time to resolution (MTTR) by about 40 percent. Our SLA has reduced from fifteen minutes to ten minutes, which is very helpful because we are raising alerts within ten minutes.

Risk-based alerting provides significant value. When we raise an alert, we provide the incident classification as either true positive or false positive in Splunk and also in the ticketing tool. If an alert is a false positive, Splunk's AI takes care of this and tells us whether we want this alert to show to the SOC team or not. The decision depends on AI analysis.

The assessment of the threat topology and the MITRE ATT&CK framework in Splunk shows that Splunk already maps MITRE ATT&CK with incidents. Whenever an alert comes, the AI configures it to that framework. For investigation purposes, I check the process tree to see how the alert originates and where the malware is going to end. This is very good for threat investigation.

Splunk Enterprise Security has become at least forty to fifty percent faster at detecting threats compared to Azure Sentinel. It is very fast for detecting alerts.

It has contributed to the reduction of analyst burnout and fatigue because it reduces our alerts. If we raise an alert on Splunk, it takes care of them through AI. False positive alerts will not show up, preventing mess for our team. Our threat hunting team and forensic team handle the true positive alerts, while false positives are automatically taken care of by AI.

When comparing Splunk with other vendors, I find that Splunk use cases have more power to detect alerts. Azure Microsoft Sentinel has inbuilt over two hundred use cases analytics for their team only, and we cannot create more customized use cases. In Splunk, we can create additional customized use cases, plus there is AI for detection. If we miss some use cases for any logs or events, AI takes care of it and creates its own use case, showing alerts for us. The dashboard is also very user-friendly compared to both.

Areas that have room for improvement in Splunk Enterprise Security include user access. When we give access to a new user, it becomes difficult for them to log in and understand the interface. It would be beneficial if there is a demo for L1 users. I also see improvement needed in integration. Currently, we have to manually integrate devices, but I would like AI to take care of it, similar to how SentinelOne operates. This would make the process smoother.

My experience using the solution has been two years.

Stability-wise, Splunk Enterprise Security is very good. I have not experienced any significant performance issue or downtime.

I rate the scalability of Splunk Enterprise Security as an eight. It depends on how stable and scalable you manage Splunk Enterprise Security for your organization.

I rate the technical support of Splunk Enterprise Security as a three. I find it not good because whenever I raise a ticket, they take a very long time. Even if I call the toll-free number, tickets are pending.

I have worked with two other SIEM tools: Wazuh and Azure Microsoft Sentinel. The AI-driven detections have improved the accuracy of my investigations significantly compared to these solutions.

It is very easy to deploy Splunk Enterprise Security compared to both other SIEM tools. Splunk connector is very easy to set up.

The time it takes to install depends on whether we are installing on a Windows or Linux machine or the size of the organization. For a moderate-level company, it usually takes around five days to install everywhere the connectors and endpoints.

When it comes to upgrading Splunk Enterprise Security to version eight point zero, I have a team that handles the upgrade, and it is basically easy to upgrade the version.

Combining SIEM, SOAR, and UEBA into a single interface has improved my operational efficiency significantly. Before we integrated SOAR, we usually took fifteen minutes to raise SLA alerts. For analysis, L1 would take ten to twelve minutes to decide if they wanted to raise an alert or not. With SOAR, we have predefined playbooks, so if any inbound connection happens from a malicious IP, it automatically blocks on the firewall. We handle most alerts through SOAR now, which allows us to focus on the more significant incidents like malicious attacks, effectively reducing our response time.

Regarding the pricing of Splunk Enterprise Security, I would say it is very expensive for our organization compared to the two others. Wazuh is open-source, and for SentinelOne, we are a partner with Microsoft, but Splunk has a high cost for setup, which is based on the EPS count and storage.

When comparing Splunk with other vendors, I find that Splunk use cases have more power to detect alerts. Azure Microsoft Sentinel has already inbuilt over two hundred use cases analytics for their team only, and we cannot create more customized use cases. In Splunk, we can create additional customized use cases, plus there is AI for detection. If we miss some use cases for any logs or events, AI takes care of it and creates its own use case, showing alerts for us. The dashboard is also very user-friendly compared to both.