Hey Chris
I know I am late to this, but posting for others. Splunk has a prebuilt application specific for satisfying NIST 800-171 requirements. You can check it out here: https://splunkbase.splunk.com/app/3828/
You don't actually need to purchase Splunk's full SIEM…
I am a Splunk PS Consultant who is doing SIEM migrations to move people from legacy SIEM solutions like ArcSight and Qradar, and would just like to learn more about product differences to get an idea of why everyone is switching over
