What needs improvement with Splunk?

I perceive that the overall functionality of Splunk Enterprise Security is robust, but I believe it could see improvement, particularly in enhancing its AI capabilities. If Splunk Enterprise Security were able to build its own LLM based on the incoming data instead of relying on other AI solutions, that would be a significant improvement, streamlining my experience while maintaining the quality of feedback.

I think that there is a rich ecosystem around improving Splunk Enterprise Security, and the question we often ask ourselves is why Splunk Enterprise Security does not already do that and why we have to pay a third party to do that. We often question whether it is easier to pay the third party to do the enterprise security data enrichment or service, or if it is better and easier to just try to implement it ourselves. We will often buy into a third-party product only to have it available in Splunk a year or two later.

I think the addition of the new Splunk AI Assistant into Splunk Enterprise Security would be really helpful, especially for new Splunk users to be able to rapidly learn and generate complex SPL queries.

There is a lot to say regarding how Splunk Enterprise Security could be improved. Overall, it would be to have detection content that is truly effective and operationalizable and not just content that is available in Enterprise Security Content Update or in Splunk Enterprise Security, but content that is really mature for certain use cases that are difficult to manage in a production environment.

The improvement I would like to see made to Splunk Enterprise Security is a unified interface across several Splunk tenants to manage our clients' Splunk content from a single place.

I think Splunk Enterprise Security can be improved by providing more out-of-the-box contextual information for alert triage, investigation, and response. Regarding Splunk Enterprise Security's AI capabilities, the accuracy and reliability of output have room for improvement.

One of the big things that's important in my industry currently is being able to measure your time, whether that's for implementation of AI and automation or just simply for headcount and asset allocation. I think the ability to track how much time is spent in different portions of a runbook playbook or in triage of an alert would be a beneficial addition to Splunk Enterprise Security's case management.

I think more integration with the AI agent could make my experience better.

I have noticed with a lot of clients that the instances in the cloud have been really slow. When the team performs an update in the instance, some features are missing. The most recent thing we have noticed is that when a version is updated, we miss the button of the short ID, which we use to identify our investigations or reports. Since the update was applied, we did not see that button, so these types of things in the dashboard or in the metrics of the operation in the cloud instance have been impacted. I think it would be great if Splunk Enterprise Security could add an EDR solution. If we install a sensor in the endpoint, the sensor could forward the logs of Sysmon into a SIEM in a more rapid and efficient way.

The first improvement for Splunk Enterprise Security is making it cheaper, as I would like to introduce it to other customers, but the high price is a barrier to entry. I would also like a better integration or functionality with AI, as there is not a good implementation of it.

I think the automation part of Splunk Enterprise Security could be improved. We would like to have a chat with artificial intelligence to be able to ask it to execute playbooks and be more efficient, to request actions or remediations in natural language.

I would recommend more training videos and simulations on what the tool can do. I know it is a huge tool that has many capabilities. Educating and providing guidance on those features would be beneficial, because new features seem to be added quite frequently. I would also suggest more videos or features, such as pop-ups that help or guide a user when they are looking for something in particular. An AI chatbot that could guide you on what you are trying to accomplish would be helpful.

I think it would be great to integrate all the capabilities that Cisco is providing to improve Splunk Enterprise Security. Splunk is already an expensive application, so I expect that they give enterprises the time, resources, and all the integrations that they have been providing regarding the needed improvements.

I think Splunk Enterprise Security could integrate more features, just as a SOAR should be part of the product, along with more AI detection features, and additional features available in observability. The current offering is not sufficient.

There is still an aspect of this tool that I think could be optimized or simplified, particularly the CI/CD part to enable all the API and CI/CD aspects. This would allow us to easily deploy solutions while keeping the code in our source repository. Today, we are forced to develop many things whereas Splunk Enterprise Security could probably provide tools that make customers' lives easier.

The assets and identities framework in Splunk Enterprise Security could benefit from more integrations for improvement. I chose eight out of ten because of the lack of retroactive IOC hunts and potentially missing data, which prevented me from giving it a ten. Splunk Enterprise Security has helped improve my organization's business resilience, though my impressions of its ability to predict, identify, and solve problems in real-time are somewhat lacking due to a delay in search windows and possible overlap in data availability.

To improve Splunk Enterprise Security, I would recommend making it easier for events to be correlated together.

As I mentioned before, we came from the McAfee environment, and in that system, they had alerts visibility where we could easily acknowledge the alerts. Based on that, it would show you the time when the incident happened and the time when you acknowledged the alert. I have not seen that specific capability in Splunk Enterprise Security yet. I know that you can acknowledge and then create the investigation, but since we were accustomed to that feature in McAfee, it is a bit different. This is probably just an adaptation issue, but we are still trying to figure it out.

n/a

I don't have any recommendations on how Splunk Enterprise Security can be improved.

Splunk Enterprise Security is pretty top-notch and one of the best in its class. Along with moving to the new interface, there should be more consistency across the board for all applications to improve my experience even better.

We are exploring improving Splunk Enterprise Security by integrating AI, as I attended a session about integrating with the MCP server, which we believe will help us improve triage and speed up investigations. Splunk Enterprise Security could be improved by having more skills within the MCP that tie to compliance regulations such as NERC CIP, which is important for the utility industry.

In my personal opinion, it is too complicated. It is an immensely powerful tool, but it could be simplified. Installing forwarders and trying to get an overview of a network topology with Splunk Enterprise Security is challenging.

I believe Splunk Enterprise Security can be improved by getting into the authentic SOC space; right now, the triaging it does is able to handle some of it, but I think it would benefit from going further into that, and a lot of performance issues that were seen before have been improved, although some errors or performance issues still occur once in a while. One specific issue I've noticed is not performance-related, but with Splunk and SOAR integration, if I use the entry ID with the auth extension, I get a 404 error after a certain time, as there is a time to live, and by default, it's one hour, and support has indicated this is by design, so this is one of the issues I see with Splunk and SOAR integration that could be improved. Regarding Splunk Enterprise Security's AI capabilities, I think it can definitely be improved, especially re-running searches for metadata, such as getting index source and source types; it's session-by-session based, so if it can store and learn my environment and not have to run those searches every session, that could save a lot of resources and improve efficiency.

I see no areas for improvement in Splunk Enterprise Security outside of incorporating AI and the ability for AI to act and respond on my behalf. I would like AI to handle responding to incidents for me within Splunk Enterprise Security.

I cannot think of any improvements for Splunk Enterprise Security at the moment. I would like to add that I am not a fan of the new UI. I find the new UI challenging because it takes much more searching to find everything that you need; they introduced it all at once instead of gradually introducing it.

I think Splunk Enterprise Security can be improved because sometimes it is difficult to make sense of the data that is provided to me. The amount of information makes the data hard to interpret, and I feel the niche content is hard to find.

I believe the areas of improvement for Splunk Enterprise Security would focus on resource utilization. For smaller environments lacking adequate CPU and memory resources, the system tends to be laggy, so reducing resource consumption would greatly improve experiences in most customer environments. The usability of the solution is well built, and the interface is intuitive, so there are few improvements to suggest apart from implementing multi-tenancy, which is a frequent request we receive, especially from regional banks managing different branches under varying administrative controls.

I believe Splunk Enterprise Security could be improved by costing less. Splunk Enterprise Security's risk-based alerting, RBA, has slightly raised our alert volume because we have not turned off old alerts, but the fidelity of the alerts that RBA has provided us has been advantageous for uncovering true positives.

The improvement for Splunk Enterprise Security is happening now as they are implementing the agentic SOC, with agents helping with the mundane work for the analyst. If an agent is already looking through investigations and reaching the point where it is an actionable event, having the analyst look into it to ensure it is something we want to do is one of the biggest improvements I am seeing.

I am quite happy with the feature set of Splunk Enterprise Security, and I think it can be improved. Nothing comes to mind regarding areas for improvement, even a small one, that could make my day-to-day work even smoother.

In terms of how Splunk Enterprise Security can be improved, with the focus of transitioning everything to an agentic SOC, it would be beneficial to continue allowing us to see into what's being done, so we can validate that the agentic SOC formats and processes are doing the correct things.

The one area that I would say at one point did need help and attention would have been Mission Control. However, that seems to have been really worked on, and it appears to be stabilizing out now.

Everything is good with Splunk Enterprise Security, and I have nothing that comes to mind regarding improvements, even small things that could make my experience better.

Regarding Splunk Enterprise Security's AI capabilities, we are currently not using the AI capabilities; however, I am excited about the AI capabilities that are being developed and hope that the government is more open to using the AI capabilities of Splunk. As far as reliability goes, I think that the AI capabilities will still need some human interaction, and I do not feel comfortable yet truly trusting everything that AI does.

I am not sure how Splunk Enterprise Security can be improved right now. I believe it is doing us a lot of good and is really helpful, so I am not able to speak on how it can be improved at the moment. Nothing comes to my mind about areas where Splunk Enterprise Security could be improved.

An improvement that could be made in Splunk Enterprise Security is proper version control for our content and alerts that are built in it.

To improve Splunk Enterprise Security, I suggest starting to add SOAR inside of Splunk Enterprise Security without having two separate servers for that. I believe it might be accomplished in the future.

In my opinion, there is always room for growth in Splunk Enterprise Security. Specifically, since I am currently working with SOAR, I would like to give recommendations regarding Splunk SOAR, as there are very few ready-made apps, and we face problems with integration, which requires us to write to the vendor for help. Since the vendor responds slowly, we completed a pilot and could not make a decision because there are very few ready-made apps. I would like the number of ready-made apps to grow and for the overall focus on SOAR to increase.

Splunk Enterprise Security can always improve its UI; we do have some less technical team members, so continual improvement and refreshes of the UI are always appreciated.

Splunk Enterprise Security's improvement potential is difficult to assess since we're not currently running the latest version. There may already be features that I would want, such as the automated AI integration and other capabilities. There are pain points my team runs into, though specifying exact improvements would be challenging given my current version.

I would like to see the data management platform of Splunk Enterprise Security have an API management plane for centralizing changes via code instead of having to log into the actual platform, which would also allow for direct threat modeling in GitHub. One improvement needed is addressing a UI bug that appears when pushing a detection via code into the test queue. The detections do not show in the test queue but rather in the analyst queue, which should be addressed to improve overall functionality.

I do not have any suggestions on how Splunk Enterprise Security can be improved.

I need to partner with teaching more students what Splunk Enterprise Security is and the other products so they can be aware of it early on in life as opposed to later.

Splunk Enterprise Security can be improved by finding a way to administrate multiple instances at once. It should be easier to import custom detections in Splunk Enterprise Security, as if you have a detection in one place, you shouldn't need to copy and paste it into a new detection; it should allow an easy way to import it without detection as code.

Regarding areas of Splunk Enterprise Security that I think could be improved or enhanced, I am continuously getting the task of upgrading the system. For example, we have multiple heavy forwarders, and every time we upgrade the system, there should be some issue after an upgrade. It is not always a smooth upgrade. Sometimes it is pathetic, and you have to work continuously even after an upgrade to find out what exactly the root cause is. Then you have to reach out to Splunk support. This happens almost every time.

There are two parts to consider for areas of improvement. One, especially after the Cisco acquisition, is from a pricing point of view. From a pricing perspective, the costs have become higher, as I understand from our procurement team. The other area is from a support perspective. Support has declined, but it is starting to improve again, though it still could be better.

For large organizations with large deployments, there can be some performance degradation in Splunk Enterprise Security. However, my overall impression is very positive, and areas for improvement definitely exist. One of the biggest challenges is its licensing cost, especially for organizations that ingest large volumes of data. The major problems crop up when it involves large data sets. Licensing cost is a key factor because if it is too much, it can influence the decision of whether the organization should prefer it or rely on other tools for the coming future. Another area is the learning curve. New users can find SPL and advanced administration a bit difficult initially. Writing queries and fixing them to the perfect timeframe can be challenging when relatively new. In large environments, deployment and maintenance can also become quite complex and may require experienced administrators. Large deployments sometimes mean Splunk Enterprise Security may not be able to monitor that effectively. Splunk Enterprise Security could continue improving cost efficiency, simplifying administration for new users, and making advanced analytics and machine learning features easier to configure. Despite these challenges, I believe Splunk Enterprise Security's powerful search capabilities, scalability, and real-time monitoring give it a strong position and make it one of the leading platforms in the market. Though we have discussed some negatives that could cause anyone to think carefully, I do feel that beyond those aspects, it is a good solution.

Currently, in my opinion, Splunk Enterprise Security is good. However, Splunk has an ingest processor that could be improved.

The entire tool is a little slow. It can be improved, as the lagging is noticeable. The team can work on improving the performance. There are some vulnerabilities that come up when deploying other tools with Splunk Enterprise Security. For example, when using a CTE tool where we are encrypting the indexer data, Splunk Enterprise Security can work on making the encryption and decryption of data compatible with other tools. Currently, I'm using Thales tool called CTE to encrypt and decrypt data, but Splunk Enterprise Security is not much compatible with that tool. Additionally, the response is a little slow, so Splunk Enterprise Security can work on that part as well.

High infrastructure requirements are present when I integrate Splunk into my full services such as app microservices, database, CloudWatch, or the machines where I have deployed the services. I have to integrate into all the platforms I am using. It needs another machine or infrastructure to manage all the logs and generate these kinds of reports. Regarding the learning curve, any beginner encounters trouble with it because it is complex to implement across all services due to the huge amount of applications or functionality to watch and implement. I also mentioned earlier that the pricing is a concern because it does not provide any free tier to use; therefore, I have to use the paid version, which is quite expensive, costing thousands of dollars per one gigabyte or ten gigabytes of data generated. I believe the pricing is quite expensive. It generates a huge amount of data, so it sometimes works slowly for the generated logs. I can say around ninety-eight percent uptime because I can sometimes get into trouble finding logs across the services in the generated logs. The learning curve, its implementation, and its pricing are quite heavy for learners or purchasers.

I really appreciate Splunk Enterprise Security, but I do have some complaints. One complaint is that it is very expensive for organizations. This is a common complaint, but it does perform very well, so that expense becomes an investment. For small teams, it is very hard to manage. There has to be a dedicated team of analysts or engineers hired to manage Splunk Enterprise Security overall. The tuning takes up some time, particularly detection tuning and response mechanisms. I have also heard from my clients that it is resource intensive on their devices, taking a lot of resources which sometimes hampers their work. The search and query functionality in Splunk Enterprise Security needs to be much faster in the future because it still needs some work. It can be improved significantly. Additionally, one thing that I observed was the time range functionality was not very helpful for me. I wanted it to be very specific and precise, but it included logs from other time zones as well, which was a hassle. Splunk Enterprise Security needs regular updates and upgrades. Instead of doing this quarterly or half-yearly, I would prefer patches to be released as soon as there are any new incidents. Alert fatigue was a complaint recently, but it has been resolved. The AI detections were detecting very false positives, which caused our analysts to experience alert fatigue, and this was not helpful for real incidents.

One thing I would like to see improved in Splunk Enterprise Security is a better user manual. Right now, it is pretty tough for any newcomer or new user to understand everything because there are no specific areas for them to learn from. From a features perspective, an enhancement I would like to see is a better learning aspect. The AI feature is great, but I believe enhancing the learning part for any new user would be beneficial.

Whenever an upgrade happens from a lower version to the latest version, some things get complicated, particularly compatibility issues, which we usually see in Splunk Enterprise Security. In those cases, it sometimes definitely requires Splunk Enterprise Security's support or vendor support to resolve those issues. Compatibility issues during upgrades are a major concern. I am generally satisfied with the functionality of Splunk Enterprise Security, and my only concern is the compatibility issue during upgrades.

There is something in Splunk Enterprise Security which is not perfect. What we are seeing is more not on the technology side, but on the pricing and support point of view once Cisco has taken over. We have seen that the pricing has gone higher and the support quality has not kept up or was not as good as it was earlier. These are the two things we see as areas for improvement. Regarding the issue with support, it takes longer for support to come back to us and then it goes through multiple layers of escalation before we get to the right person. I would like to see some additional features, more on the AI detection and automatic detection using AI capability. Although Splunk Enterprise Security has some amount of AI capability, what we would like to see is more on the detection side, how AI can help and how Splunk Enterprise Security can introduce those features as part of the built-in platform itself.

Splunk Enterprise Security can improve in the UI UX interfaces, but for the rest, I am very comfortable with the reporting, dashboard, alerting, search, and reporting features. From the rating perspective, it could be enhanced.

Complex Setup and Configuration ------------------------------- In my personal opinion, the initial setup and configuration process is notably complex and tedious. It is not a plug-and-play solution by any means. We frequently had to engage Splunk support during deployment and fine-tuning phases. During testing, the risk scores did not always behave as expected — which is concerning when you are making detection decisions based on those scores. Unlike some competing tools that offer simpler, more intuitive alerting out of the box, Splunk ES can sometimes result in ineffective detection or missed threats if the design and configuration are not executed with precision. The platform rewards expertise but penalizes poor configuration. Alert Calibration — A Boolean Problem ------------------------------------- In my personal opinion, one of the most frustrating challenges I encountered was around alert calibration. It behaves almost like a boolean switch — either you are flooded with an overwhelming volume of alerts, or the moment you make one or two configuration adjustments to suppress the noise, the alerts stop firing altogether. There is very little middle ground. This calibration mechanism needs significant improvement to give security teams the fine-grained control they need for effective operations. Cost vs. Value — Not a One-Size-Fits-All Solution ------------------------------------------------- In my personal opinion, Splunk Enterprise Security is premium-priced, and in my view, the value it delivers is highly dependent on the nature of the organization. For financial institutions, oil and gas companies, and utility providers — where data security, operational continuity, and regulatory compliance are mission-critical — the investment is absolutely justified. However, for retail or FMCG organizations, where operations are predominantly machine-driven rather than computer-dependent, the cost-to-value ratio becomes questionable. There is always a trade-off between efficiency, cost, and time — and for FMCG companies, that trade-off rarely favors a solution of this scale and price point.

Cost is one major factor. The reason is because they primarily work on the ingestion of data, wherein it becomes a choice for large customers who have deep pockets to spend money on Splunk Enterprise Security. If the customer does not have that much budget, then obviously they will not go for Splunk Enterprise Security. They will go for a similar set of solution such as Elastic in that case. Cost is something which is a major factor. In integrations, a good amount of integrations are already available, but integration with newer AI components or tools and upcoming tools such as Claude or ChatGPT will obviously take some more time to evolve perfectly so that these tools become more easy to use and align to an organization's environment.

The main dislikes about Splunk Enterprise Security are that we need more highly skilled people and the license for Splunk Enterprise Security is costly. Beyond this, the infrastructure cost is too high. Since we have an on-premises deployment, it is costly for us because we need a lot of storage and a big server. From a maintenance perspective, Splunk Enterprise Security sometimes requires maintenance because it continuously monitors all alerts and continuously creates incidents. Sometimes the data volume is high and some searches will be skipped automatically. We might have 1,000 searches and sometimes experience a lot of skipped searches. Sometimes if we modify any macro, there can also be issues. We need at least one person for maintenance who can continuously ensure that Splunk Enterprise Security is running fine. Regarding support for Splunk Enterprise Security, we reach out many times. Initially, we purchased hardware that was not capable enough. Sometimes our server became choked and Splunk was not able to run some searches on Splunk Enterprise Security. These issues were due to hardware limitations. We called a consultant from Splunk who analyzed the platform and fixed the issues. Sometimes we upgraded our platform twice by adding additional disk space and RAM. We have not upgraded to version 8.0 yet for Splunk Enterprise Security and are currently on version 7.0. Recently, we have a demo scheduled from the Splunk team to learn about Splunk Enterprise Security 8.0 features. However, in version 8.0 they changed everything. Initially, we had an incident review dashboard and risk management dashboard that I was very familiar with. In Splunk 10X, all the names changed and everything was restructured. Currently, I am still learning which old features correspond to the new ones. They changed many things, which is also one of the disadvantages, as the changes were extensive.

I would say that the AI component of Splunk Enterprise Security should be improved. The AI and automation features can be improved further. Right now they are helpful, but they heavily depend on accurate data. If the data is not reliable, automation can sometimes lead to incorrect actions. Improving the trust and accuracy of the AI-driven insights would definitely make the platform even better. Regarding AI-driven detections and assistance, sometimes human error may occur, but with the AI insights of detection, it could be negligible up to 90 to 99 percent. This has helped us considerably. The AI feature for building SPL queries, the Splunk Processing Language, has helped us create queries for our particular use cases, which is a great feature of Splunk Enterprise Security.

Splunk ITSI (IT Service Intelligence) correlation what we are trying to do has missed a few features from the earlier versions. We previously had a chance to give complete descriptions of a particular thing and whether it is mandatory or not. However, in the new version, we are seeing something like a risk score that needs to be defined for any use case we are creating. I think that is not mandatory, but also in some areas we cannot define the risk score. At those times, in those cases, we are keeping the risk score as nominal, like one to ten. Because of that mandatory field, we are giving some wrong information to the end list.

Splunk Enterprise Security has achieved a high level of product functionality. Improvements can focus on bringing various features together for easier use and potentially addressing human versus machine threats with AI-based detection, along with educating organizations about compliance.

It is tough to say which features would be included in future updates of Splunk Enterprise Security. I think it will keep growing. Maybe if they incorporate generative AI, I think AI is already there, but if they incorporate generative AI in terms of tracking the issues, automatic resolutions, and some root cause analysis, and I think threat intelligence, something using GenAI providing information on threat intelligence, that would also add value. The workflow is good, and I think they keep improvising it. There is not a specific comment on that regarding how important this feature is and how it supports the overall workflow.

I would appreciate improvements in the licensing aspect, especially with the SVC-based license, as there is no proper view on top of it regarding how much CPU and usage is being done on the SVC-based license, along with updates to the SOAR version. The experience with alerts, specifically risk-based alerts, is good, but it might need some improvement as there might be some deviation or false positives, so I think implementing AI over there might increase the feasibility or view around it. I think the pricing aspect of Splunk Enterprise Security is quite high compared to other products, which I hear from most of my customers.

I feel more comfortable using XSIAM now compared to Splunk Enterprise Security. Splunk Enterprise Security is already a mature product, so I do not have much to point out. It could be a little more user-friendly, which would be nice.It could also expand the product family beyond security log search. Since it has the capability of indexing things, perhaps Splunk Enterprise Security could develop their own EDR agent like Palo Alto and create a product family with a unified dashboard. This would definitely help the enterprise. Splunk Enterprise Security documentation exists, but compared to Palo Alto, Palo Alto has more knowledge base articles. Even though the concepts are the same and multiple engineers have written articles for cross-reference, I do not see this level of documentation in Splunk Enterprise Security.

The user interface is the main area for improvement. I cannot comment on the economic aspect since I am not an end-user and do not know whether clients think the pricing is too expensive. I do not see significant negative aspects of this platform besides the potential for a better UI in some cases.

Overall, the product is good, but when it comes to some infrastructure issues, we have to dig into more logs. There is no straightforward indication of an issue. Health check kind of dashboards are not available. More AI would help us, and more optimization, since security products run more queries. The AI module could suggest solutions, optimizing queries or workload balancing. If the product itself advises on running queries during peak times, it would be similar to what ChatGPT currently offers. We see quite a few issues on stability. Even last week, we faced something, and identifying bottlenecks is not easy. We need more SMEs, and there is no mechanism to tell us about indexer or search head issues. Self-monitoring dashboards could be beneficial. The technical support still requires more improvement. Often, primary support takes a lot of time and forwards most solutions to the engineering side. The primary support team has very limited knowledge to provide.

From the product point of view and deployment point of view, Splunk Enterprise Security is satisfactory. It is not simple; it is at a medium level when it comes to deployment and management of the tool altogether. This includes not only the enterprise platform but also other components such as deployment servers or the Splunk agents we use for collecting logs. When comparing it with different vendors in the industry, from the deployment and maintenance point of view, it is not up to the level of other vendors. When discussing the drawbacks, it's important to note that the flavor I’m currently using is called "Classic." Unfortunately, this platform does not offer any of the new features that Splunk introduces. As a result, we are the last ones to find out about new capabilities, and we’re also slow to implement them. Splunk tends to release new features with different flavors of their platform, and being on the Classic flavor means we are least likely to receive the latest updates. This is a significant concern I have regarding Splunk. When comparing Splunk Enterprise Security with next-gen SIEMs, we look for AI and ML models being incorporated in such a way that it automatically should be able to detect behavioral-based detections. It should be able to detect behaviors from logs and show us the entire attack surface and blast radius of any particular incident, which is primarily missing. The capability of AI, Artificial Intelligence, is missing, which would help to automatically detect and read data comprehensively. Splunk lacks the new native solutions for agent deployment, which is essential for a large enterprise. Currently, there is Machine Learning in Splunk Enterprise Security, but that is resource exhaustive and complex, bringing an impact onto our overall stack performance. Technical expertise in Machine Learning is required, and continuous monitoring is needed to ensure Machine Learning learns about our data to provide results, which is resource exhaustive, time-consuming, and costly. Artificial Intelligence is missing in the Splunk Enterprise Security platform, which would help us read the data automatically, learn from it, and provide attack surface area from a 360-degree perspective. The fixed pricing model requires upfront purchase based on assumptions and roadmap, requiring payment for the next two to three years regardless of usage.

I think that Splunk Enterprise Security is a very good platform, but the price is very high. I don't know how to explain what else can be improved in Splunk Enterprise Security aside from pricing. Support is important for improvements. My thoughts on better support include better knowledge base and better response time; it encompasses both aspects.

Splunk Enterprise Security could be improved by having better role-based access controls. We need to be able to better control who can do what, which people can be allowed to take certain actions, run certain playbooks, or view specific items, and separate things between teams.

I have many good ideas for how Splunk Enterprise Security can be improved. Our Splunk team attended a session, and it was really good. I see that AI integration would assist analysts in seamlessly looking into data without relying on engineers to write an SPL. With AI integration, they can search different kinds of data that they have access to. The UEBA side looks good, and the Splunk Enterprise Security UI indicates that we are on the right path. I look forward to using and sharing what I've learned with my team regarding different tools in Splunk Enterprise Security that we can leverage to improve processes, provided they are not already using them. One major return on investment for using Splunk Enterprise Security, from my perspective, is the feedback I provided to the product research team about creating a UI that helps specific team members extract value from the platform. For instance, if a DLP operations analyst accesses the platform, it should guide them to navigate predefined content for their role. That's something I've already mentioned to them, and I'm eager to see what happens next. Currently, it's a blank slate where users can explore, which is good, however, some people might need a push. Training can either be done from start to finish, or with AI integrating everywhere, users could ask questions that would return answers, from creating an SPL to providing results.

I would definitely improve the risk-based alerts in Splunk Enterprise Security, helping SOC analysts to get to the drill-down searches. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include writing detection rules for new threats, finding out about the SPL logic, and writing correlation rules. In ES8, we are experiencing some issues with crashes, and whenever we open the correlation rule, it gives a Java error requiring a refresh. We had not seen that error before, however, we are seeing it more frequently in ES 8.1.

Improving Splunk Enterprise Security is a challenging task; I have already reported several technical issues to the relevant teams and received solutions from them. One favor I ask for them is just to keep maintaining the on-prem version of Enterprise Security and not move everything to the cloud since we operate mostly in an air-gapped environment, so we only use some of the features of it. Some additional features that should be included in the next release of Splunk Enterprise Security are an integrated Attack Range, not as a separate solution, and providing a way to test the rules in the production environment.

Splunk Enterprise Security could be cheaper. More artificial intelligence implementation for features should be included in the next release of Splunk Enterprise Security.

To improve Splunk Enterprise Security, I suggest incorporating more AI features for faster remediation and enhanced responses, allowing users to build more correlation searches quickly. Regarding improvements in Enterprise Security, I believe the incorporation of AI would enable Splunk users to spend less time on building correlation searches while still gaining productive ideas.

Splunk Enterprise Security could be improved in the dashboards that provide KPIs about environmental behavior. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include correlation when we have inputs or tools about security, such as Forescout or CrowdStrike, which presents a good challenge. My organization uses risk-based alerting in Splunk Enterprise Security, yet not optimally, which presents another challenge. My security ops team takes longer to remediate security incidents with Splunk Enterprise Security compared to our previous solution. It is very complex.

As for improvements to Splunk Enterprise Security, we will see how ES 8.2 looks. It is hard to say. We just found out about a bunch of changes, so it is difficult to make specific recommendations at this point. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include not having enough time to be in it, the resources and people to also be in there, and trying to configure it and teach people how to use it. A lack of resources prevents us from giving it the attention it needs.

Splunk Enterprise Security can improve in terms of being able to add to additional sources. They're adding many different ones, but as more cloud and data lakes emerge, being able to touch all those different new technologies that emerge together would be beneficial.

Splunk Enterprise Security can be improved mainly regarding the UI, which can be daunting at first for newer employees. It's hard to find everything, such as menu locations, dashboard access, and dashboard creation. It's still very complicated and takes a few weeks to understand. The UI could be more user-friendly. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include skills. I've been using it for four years and I don't know everything yet. Finding information and writing complex SPL queries can be challenging. I tried to use external AI, ChatGPT, but they're not very good with it. I know now there's SPL with AI, and we're going to test that.

The correlation of events is the most significant challenge I face when using Splunk Enterprise Security for advanced threat detection. I am still looking at version 8 to see how it can be improved or how we can utilize it better.

Splunk Enterprise Security can be improved with better triage capability and less dependency on running SPL searches, which would allow analysts who may not have much experience in writing SPL searches to still use the tool and run investigations.

Splunk Enterprise Security can be improved by bringing back some of the operational use cases. When Splunk developed ITSI, they took a lot of information or use cases out of ES, where operational use cases can also be security use cases. Those two products need to be more migrated to each other. In the next release of Splunk Enterprise Security, there should be more reporting options.

If they could implement an out-of-the-box solution, it would be almost an AI data onboarding system that automatically identifies the fields that are SIM compliant, Common Information Model compliant, and then immediately applies those to a data model, builds a data model, and starts the SIM searches against those data models. A lot of the work for Splunk Enterprise Security happens on the back end, not the front end, so that's where you can really trim down your resource need and expertise if you supplement that with automated or artificial intelligence. The most significant challenges I face when using Splunk Enterprise Security for advanced threat protection are integration with other platforms and noise. Alerts from Splunk Enterprise Security generate many alerts, which take time to move through, assess, analyze, and determine whether they are true or false positives, and then go back and redundantly tune. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be cumbersome. Custom use cases are also cumbersome. You need someone very skilled at Splunk and data modeling to get to a point where you create something inside SPL that allows you to detect what you want. There is not much predictive analysis happening in Splunk, and I hope that with the new AI toolkit allowing for the deployment of custom AI models and large language models within Splunk, along with additional advanced mathematical capabilities for vector analysis, the prediction and ability for Splunk Enterprise Security to add value to detections will increase.

Splunk Enterprise Security can be improved by addressing the content management interface, which is very outdated, slow, and clunky; sometimes we think things are saved and they haven't. Being able to edit saved content and saved searches in batch, such as when you have a log source and a field changes, is a pain point right now since you have to go in and basically update all of them unless you do some kind of Eval on the ingestion side; that's probably the biggest pain point with it right now.

The most significant challenge I face when using Splunk Enterprise Security for advanced threat detection is not with Splunk itself, but with our own asset management and knowing what our assets are, particularly regarding visibility.

The problem with Splunk Enterprise Security generally, is that organizations strugle to fit into their cultures and workflow. For better outcomes, companies have to fit their internal processes to how the tool has been designed. At times, this can be too complex to run, has high overhead requiring constant tuning. Newer versions e.g. 8.3, hint at greater ease of use.

I'm not as familiar as I should be to answer how Splunk Enterprise Security can be improved, however, one of the improvement points that Enterprise Security could offer is on-prem training, the availability to have a Splunk representative come out to different sites and actually sit down with the organizations and help them understand.

The on-premise integration with SOAR could be more simple; the cloud version integrates with SOAR very easily, but the on-premise SOAR and on-premise Splunk Enterprise Security are really not that easy, so I would appreciate if that could be improved. Additional features that should be included in the next release of Splunk Enterprise Security are the ability to integrate with other software and tool frameworks, beyond Sysmon, to avoid ingesting Sysmon logs from the endpoint, which can be very noisy at times, resulting in more straightforward detection and less resource-intensive licensing.

I'm not sure how Splunk Enterprise Security can be improved, but I'm sure it will be improved; the features that they add, I constantly never even think of. One of the big things is making it a little easier for the intro analyst to be able to understand and work through without a lot of dedicated training.

Improvement for Splunk Enterprise Security is hard to address because I'm not on version 8 yet. The main thing was integrating all the different pages we have into one, which they have accomplished in version 8.1.2. I'm looking forward to using it.

While Splunk Enterprise Security is powerful, it presents significant complexity for users, as it's not particularly user-friendly for beginners. I recommend focusing on building user-driven guided workflows to help newcomers navigate and efficiently use the platform through simple guides. I also see room for improvement in the integration of Splunk SOAR, which currently has some limitations regarding its data use in downstream playbooks.

Though we have not completely explored the product functionality, Splunk Enterprise Security itself has many features. This morning I was reviewing all the AI capabilities, such as version 8.2 which has included incident triaging and process. That's probably a very good feature. Our organization has very limited resources, so we would want to expand some of those automation and AI capabilities to fill those gaps.

It's hard for me to say how Splunk Enterprise Security can be improved because I've seen what they've done with the AI systems, which is going to help a lot once it's rolled out. However, one main change I would suggest is related to the incident board: when an incident is resolved, it should not appear on the incident board. It's just a rare occurrence that we open up the incident.

It's difficult to answer how Splunk Enterprise Security can be improved because I'm hearing AI mentioned frequently in the keynote. It's definitely out there and it's improving the whole process. I think that a lot of effort is going into the realization of AI, but some effort is left out because they don't always mention that the outcome has to always be verified. You just say, 'Ask AI to narrow down the threats, show me how to write an email, summarize it up,' but the additional process that comes with it is verifying it all. Maybe question it, and sometimes it's wrong and you have to start over. I think improving it would be either having different AI responses to cover more, or always having to verify the user, not relying on an answer. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are not in the product; they're in the human aspect. Writing the query and knowing what to search for is not a product problem.

Additional features could be included in the next release. The specific functionality I'm looking for relates to alerts and false positives. If we want to filter alerts, currently it's a very manual process. We identify IP addresses and usernames and must manually filter them. It would be beneficial if we could simply click a checkbox to filter and automatically add it to the search, then save it immediately, instead of the time-consuming process of cutting and pasting, which isn't efficient. The most significant challenge I face when using Splunk Enterprise Security for advanced threat detection is maintaining balance in search parameters. Creating searches that aren't too narrow to miss threats, yet not too wide to generate excessive false positives is crucial. When determining recurring false positives for filtering, junior analysts who aren't coders must edit code-like elements. This introduces unnecessary risk when they could simply check a box to filter.

Splunk Enterprise Security can be improved by having more focus on the data health monitoring aspect, which will definitely be helpful. A good out-of-box application that can help monitor if the data feeds are feeding in properly or if there is any drop will really help make life easier.

Splunk Enterprise Security is not exactly user-friendly. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are assets and identities, which are a pain in the neck, and the documentation for RBA is horrible. They've got it now to where it pretty much deploys itself as long as you know what you're doing, yet it does some really weird and impractical things such as putting file extensions on lookup tables that shouldn't be there, which you have to go in and clean up. It's got some quirks that aren't documented, or not all documented.

Splunk Enterprise Security can be improved in many ways. I am very happy to experience the AI-powered security platform they are going to show us in the new version. Better identification of true positives and false positives should be included in future releases. There is another new term called benign positives. It is better to clearly identify each definition of those terms since it has not been popular in the industry, and everyone needs to be aware of those things. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are the false positive alerts. As mentioned in the keynote, there is a lot of noise. Reducing the noise to make sure the SOC is operating more efficiently is one of the challenges my team is having. The process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security is not the easiest, however, it is not the most difficult one, so I would say it is medium.

I've used it for a long time and I still feel it's the best tool out there. I love what the team is doing. They refreshed the user interface recently, they've got version control coming, and they're doing more exciting things. I'm really excited to see them continue to improve by making the SIEM the central point of what security teams are doing and operating instead of having multiple tools such as SOAR or UEBA. With Splunk Enterprise Security and Mission Control, everything is coming back into one place. We're able to operate from a single source to take an alert and get to an actionable state much quicker. I'm really excited to see how they continue to grow and evolve that.

The way Splunk Enterprise Security could improve is by pulling in and mapping my DHCP data and tracking users' IP addresses as it changes throughout sessions, and being able to keep track of who is actually assigned to what IP address more natively.

The system can be intimidating, and sometimes the concepts conveyed in the documentation require adjustment. The product is mature and continuing to mature. There could be a better opportunity to let larger groups outside of the community know about the ease of deploying the product. I'm finding that newer generations, including my own, don't respond well to TL; DRs that often come from third parties and are often incorrect. If there was more of a quick answer, perhaps with Splunk AI, they could start implementing that on the documentation page to let people who have trust in that get a quicker answer.

To improve Splunk Enterprise Security, I would suggest allowing third-party SOAR solutions to work with it. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection include the user interface, which isn't terribly intuitive, and it has been a process to get people to adopt it and use it as much as they should. The user interface feels clunky to navigate and interact with in Splunk Enterprise Security compared to other case management solutions where it feels easier to use at a high level. In Splunk Enterprise Security, the way you click through everything, attach stuff, and interact with other analysts feels cumbersome, with a lot of digging required to get into things; not everything is just one click away—things are usually three clicks away. The process of extending the usage of Splunk Enterprise Security is still bumpy; the user experience is really the challenge there, as many of our analysts complain about its difficulty for day-to-day use.

In terms of how Splunk Enterprise Security can be improved, based on the last version I'm seeing here, as we are a bit behind,is the Mission Control. It is something that I have heard and tested on a couple of labs that is very good for unifying everything. There are additional features I would want to see included in the next release. We're planning to incorporate UBA and SOAR. It would be good to have everything in one place.

Splunk Enterprise Security can be improved with more AI in the commands and more help in the commands, as not all people know how to write code in SPL, and we need more help in this area. That additional features such as AI command help and more flexibility in the search should be included in the next release to make it more simple. The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection involve correlating data from multiple assets and networks simultaneously, as our network is very complex and we have not yet properly collected all the data from our various data centers within my environment.

There are ways Splunk Enterprise Security can be improved, though I might be speaking specifically about my organization's implementation. Better education for users would be beneficial as they often don't know what they don't know or how to look for certain features. Regarding ease of use, Splunk Enterprise Security is adequate. The challenge arises when we have multiple users trying to differentiate between the regular search head and the Enterprise Security search head. While users can accomplish their tasks, the main issue stems from education rather than the platform itself.

Splunk Enterprise Security could be improved by incorporating AI features, as it doesn't have the AI capability that Pyramid does, where users can ask questions without having to write code.

Splunk Enterprise Security can be improved with more ease of configuration. It is pretty straightforward to get it started, however, to really check if my data is all available and how to activate the right use case and the right correlations is still sometimes a hassle. A guided mode to help us understand how to get started, improve data quality, and prepare data more efficiently for use cases would be highly beneficial for us.

The main improvement needed in Splunk Enterprise Security is its system visibility after installation. When you install Splunk, you cannot see it on the system as an application. If you are unfamiliar with Splunk and download and install it, you will not see it as an application on your system. You have to go back to your browsing history to get the link and start using it again. Additionally, Splunk Enterprise Security does not always provide an immediate response to alerts on threats.

Regarding room for improvement, I expect Splunk to provide information about new features on a regular basis, such as notifications about enhancements that may improve security posture. I want these notifications to come to us quite regularly, as we always want to improve our security posture. I'm interested in the notifications and alerts aspect, particularly since Splunk Enterprise Security's Mission Control feature was very proactive when it was rolled out.

The machine learning capabilities of Splunk Enterprise Security are good, but they can be improved. In a changing threat landscape, its machine learning capability can be improved in behavior-based analysis because signature-based analysis does not work very well currently. It can improve in detecting new types of attacks or IOCs through behavior-based learning capabilities. For example, if there are malware traffics incoming, it should detect them using network logs more precisely, as most malware traffic uses the same kind of port or attack. There should be a community program or hackathon-type events where people can develop more advanced and sophisticated machine learning models for Splunk Enterprise Security to enhance its functionality. Adding a chatbot similar to GitHub Copilot in Splunk Enterprise Security would be beneficial. It would help write different kinds of sophisticated queries and assist in solving problems we encounter, similar to what we have in VS Code. There is good scope for developing Splunk Enterprise Security for low-level systems such as Raspberry Pi. However, for server deployment, a robust server is essential. Development should focus on making Splunk Enterprise Security capable of running on devices such as Raspberry Pi.

There should be more options for adding more visual experience in terms of dashboards. The integration feature with other applications, such as anti-DDoS application Arbor, needs to be more powerful.

Even though aggregation is one of the best features, they do poorly at integrating their own products with each other. There is Splunk Cloud, which handles searching, and there is Splunk Enterprise Security. In the backend, these are separate instances, even though the data comes from essentially the same database source. When I make changes on one platform, it may or may not affect the other side. This leaves me with uncertainty between what I'm doing in one, not knowing if it will affect the same thing on the other side. By extension, I sometimes make redundant changes already done on the other side. The discrepancy between the different search heads leaves me confused most of the time about these changes. Their support also needs improvement.

The risk and notables component, particularly the two-tier system of picking something from risk into the notable, is one of the most problematic features. The GUI, now called Mission Control, which serves as issue management or ticket management, falls below what would be considered industry standards. AI assistance for security analysts to analyze notables and risks needs improvement. Although it exists, the demonstration is not yet sufficient for the required level. We need this as soon as possible to help security analysts. Splunk Enterprise Security is not cloud environment-friendly, especially when dealing with large cloud infrastructures. With significant AWS presence and multiple clouds, collecting asset data is challenging. The AWS add-on is particularly problematic, with most inputs requiring manual writing due to lack of out-of-box functionality. Regarding the platform and Enterprise Security specifically, the lack of Git-friendly or Git-native integration is problematic. The recently introduced content management system is inadequate, attempting to implement an outdated concept of storing rule versions in an index while teams work with Git natively. The storage of queries in savedsearches.conf prevents efficient work with query text. It should be structured as separate SPL files that can utilize intellectual add-ons for Visual Studio Code and work natively with GitHub. Content management is limited to applications within the Enterprise Security suite, excluding custom applications not starting with SA or DA.

Splunk Enterprise Security is a wonderful solution, however, the background configuration process could be better as the administration process is very complicated. As an analyst rather than a Splunk engineer, some background configurations might be easier.

They should put out more educational resources for users to learn how to use Splunk Enterprise Security. If they could have a manual or guide similar to Linux, where users can search and see various commands for different searches, it would help users navigate their way around the product more easily so it wouldn't be so complex.

The documentation and training resources available for knowledge and training can be expanded. We need to learn more about Splunk Enterprise Security and new security attacks.

Areas of Splunk Enterprise Security that could be improved include the need for training and certifications. We are planning to do certifications, and there are many features, such as risk-based score and score detection, where the current training doesn't provide visibility to the analyst. They should offer training based on the features we use. For any future enhancements or features, such as MLTK and SOAR platform integration, we need more visibility, training, and certification for the skilled professionals who are working.

The solution could be improved by integrating more application monitoring features and possibly incorporating AI capabilities to enhance its functionality.

In terms of recommendations for improvement, when performance degradation occurs, we need to do a root cause analysis. The repeated tendency to inform us about memory utilization complaints encourages us to consider adjusting our query needs. Improving the infrastructure behind Splunk Enterprise Security is vital—enhanced cores, CPUs, and memory should be prioritized to support better processing power. When we execute heavy, resource-intensive queries over long periods, the performance dips. Our admin quickly intervenes to correct resource bottlenecks, allowing everything to function properly again.

Data retention can be better. If we want to look at the data for five months or six months, that is not available to us. We only have a history of 20 or 30 days. After that, the information gets lost. That is a drawback. Splunk's dashboards are pretty basic. In comparison to Grafana, the dashboards are not as detailed. There is room for improvement in that area.

Splunk could enhance its offerings by incorporating modules for network detection and response and fraud management, along with improving its threat intelligence management capabilities. Additionally, the pricing could be made more competitive.

Splunk Enterprise Security would benefit from a more robust rule engine to reduce false positives. While its detection capabilities are efficient, there is room to improve its alert volume reduction and false positive management efficiency. Furthermore, enhancements in its integration capabilities with other security infrastructures could optimize its overall effectiveness.

It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Hi @Miriam Tover ​,

Some of the few points that I feel needs improvements is below :

-Automated machine learning
-Extraction, transformation and loading
-Data modeling
-Building Splunk queries
-Dashboard creation
-Capacity data storage for Splunk data.
-Tuning Splunk analytics dashboards for performance
-User training

New build-in use-cases for Enterprise Security, a fair price-model, improvement over SPL and index performance, adding and integrating with new connectors and market platforms (more open-source solutions too).

The clusters are hard. It has too many moving parts. They should make data onboarding easier.

If possible, we would like to have not only a log monitoring system but a network monitoring feature in this solution as well.

The tool itself is very difficult to configure. It's great for its number of inputs, for the different types of systems devices, and things that it could collect information from. To actually make good use of it, you need a fairly dedicated team of people that have some reasonably good programming or modeling skills to be able to do the things that you need to do with it. Whereas a lot of the other tools are better packaged for that, and so require a lot less training and a lot less dedication. What they need to do more than anything else is, they need to take a serious look at purpose-built modules like the SIEM and put a lot more effort into making them more robust. If they did that I think they would have a better chance on the market. The base tool was great, and if the organization that they're looking to sell into requires a good, solid logging solution then they would have a very good sales statement to make because you could get the logging solution you need that could give you the SIEM at the same time.

I would like to see them develop integration with the help of a rack rest API. Which is an API that helps to secure communication with oracle cloud and pull down records from there. This integration is currently missing in current version of splunk. I'm looking forward to see this feature getting implemented in next version of Splunk and so that organizations can get benefit of this feature in future.

Splunk should align its security principles with those of other vendors like SentinelOne. Splunk has mature APIs that can communicate with various security applications and devices. Splunk can process more to produce an understandable dashboard. Splunk's latest version is much better than before. It's more resilient and powered by AI. It can ingest more complex logs. It will be better because we're using the legacy one.

The threat intelligence management feature would benefit from a broader range of APIs for enhanced integration. This would facilitate seamless connection with various threat intelligence platforms, as some currently are missing APIs, making integration difficult. The high cost of Splunk Enterprise Security prevented us from using its full capabilities.

Splunk isn't appropriate for smaller companies. It's too expensive.

I want Splunk Enterprise Security to release more AI and machine learning features in the future. We use Dynatrace for our monitoring and Splunk for log management. I want to centralize everything within Splunk.

The solution's automation could be improved. It would be better if we could automate ingesting and alerting for low-level events.

I'd love to see more integrations, which is one of the primary points of the key node with Splunk Enterprise Security. I would also like to see more admin capability to enable the health of Splunk Enterprise Security because, a lot of times, it's difficult to know when and why things are failing, especially for on-premises customers. Splunk Cloud is a little clearer because it has more integrated support. For on-premises, it feels like sometimes you have to guess and then hope for the best. Troubleshooting some things related to Splunk Enterprise Security takes a lot of time.

The tool should include more real-world use case examples built out either through videos or in the community. These should not just be examples of how it can be implemented but of how previous solutions have been transitioned to new solutions and how they provide a different and better approach.

There's been a big push for SBC compute over the ingestion model, which will hamper us. We're trying to increase our search counts with things like risk-based alerting, and I think that change will hinder our process.

It'd be really nice if Splunk Enterprise Security had a better and solid configuration guide.

The incident review could definitely be improved in many ways. It should be easier to run integrations from it. You can run a script from an event, but it needs many clicks to run that integration, which could be made easier.

The main issue that I have with it is that the field transformations sometimes overlap with those in Splunk Enterprise, and then you get permissions issues that lead to troubles. I do not have any additional features that can be included. From what I gather, Mission Control is already included in the next release, as is a lot of the Cisco threat data.

The solution's case management system could be further improved to make it easier for analysts to manage cases. The only limiting factor is the amount of data you're sifting through and the overall size of the number of correlations you're looking for.

While it's costlier than other solutions, it's highly stable. The security orchestration response requires a bit of improvement. We'd like to see a more seamless cloud-based integration. Their mobile features for iOS and Android could be improved in terms of quality of performance.

The one problem Splunk has is writing correlation searches. My analysts are intimidated to write queries to create correlation searches. It would be good if the solution had some kind of copilot to automate or help write correlation searches. Splunk Enterprise Security should include more automation, AI, and machine learning capabilities.

Sometimes, the data does not match what we're looking for, or the tool contains incorrect data.

We have this issue of data versus pricing. Its pricing can be better. There should also be a more flexible licensing model. There is a learning curve in order to start using machine learning. We have been trying to do it for three years, and we have not managed anything. It is too complex. Its ability to identify and solve problems in real-time could be better. We would like to have pattern recognition. There should be some kind of pre-made model to help detect something. For example, at the time of the incident investigation, there should be an option to ask questions, such as if anything changed. It is pretty hard to find out the patterns that are occurring currently because you have to have deep knowledge about your log content. There should be an option to ask a question like, "What has changed as compared to a week ago?" We should be able to specify a time frame and compare.

It's costly. The data speed between apps could be improved. It could be faster.

I've noticed that onboarding data from various multi-cloud sources and diverse products, such as security network devices, can be challenging. Although Splunk has simplified data onboarding with features like data managers, they need to improve their out-of-the-box parsing capabilities. While they've made significant progress, covering about 70 percent of common products, there's still a 30 percent gap where manual configuration is required. This forces us to spend time understanding and writing custom parsing rules instead of focusing on data analysis. With Splunk's recent acquisition by Cisco, I'm hopeful they will prioritize enhancing this functionality and increasing their coverage to 90 percent or more. I want to see Splunk Enterprise Security dashboards incorporate more features, such as out-of-the-box AI and user behaviour analytics, which are accessible within a single dashboard. The technical support response time has room for improvement.

Splunk could have more built-in use case presets that customers can build on and customize.

In terms of features, it does not need any improvement. Everything is good so far. The only improvement I am expecting is the cost of the licensing. Clients are going to other solutions just because of the cost.

While Splunk Enterprise Security offers valuable features, its cost is high and could be more competitive.