Splunk Enterprise Security Reviews

Name: Splunk Enterprise Security
Brand: Splunk
Rating: 4.2 (303 reviews)

Vendor: Splunk

4.2 out of 5

303 reviews
93% willing to recommend

9,782 followers

Post review

What is Splunk Enterprise Security?

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Get the Splunk Enterprise Security Buyer's Guide and find out what your peers are saying about Splunk Enterprise Security, CrowdStrike Falcon, Wazuh and more!

Splunk Enterprise Security is the #1 ranked solution in Log Management Software, top Security Information and Event Management (SIEM) solutions, and top IT Operations Analytics solutions. PeerSpot users give Splunk Enterprise Security an average rating of 8.4 out of 10. Based on the analysis of the 303 most recent Splunk Enterprise Security reviews, the overall sentiment is positive, with a sentiment score of 7.3. Splunk Enterprise Security is most commonly compared to CrowdStrike Falcon: Splunk Enterprise Security vs CrowdStrike Falcon. Splunk Enterprise Security is popular among the large enterprise segment, accounting for 66% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 15% of all views.

Buyer's Guide

Splunk Enterprise Security

November 2024

Get the report

Helped 824,052 peers since 2012

Featured reviews

Avinash Gopu.

Associate VP & Cyber Security Specialist at US Bank

One of the features I appreciate most is privileged account threat detection. It identifies suspicious activity associated with fraudulent accounts detected on the endpoints of target systems. Furthermore, the platform offers threat analysis and reporting that leverages Splunk data. This allows for the detection of irregular user access from machines directly. This functionality is crucial in large PAM environments with thousands of users, as it identifies inactive accounts. For scenarios where users might not access the PAM portal to change passwords, different policies are implemented. Splunk plays a key role in detecting irregular user activity. By establishing a three-month threshold, we can identify cases where users haven't used their accounts despite not being on leave or vacation. Such instances warrant investigation to determine the continued need for privileged access. We can automatically suspend or terminate suspicious sessions. We have also customized reporting within Splunk.

Read full review

Eko Kurniawan

IT Operations & Security at Veris

Splunk can deliver more information by going deeper. By creating a dashboard, we can identify the root cause of the threat. Let's say I have a firewall from Check Point. Splunk will find the dashboard for Check Point, implement it in our environment, and connect it to the Check Point firewall logs, which are shown on the dashboard. If we request a custom dashboard, the engineer will take longer to complete the task. I can create a custom dashboard for the firewall, antivirus, or endpoint protection. This will take time to complete because they need to understand the log type and mitigation of the process from the system or API. Splunk helps us manage our hybrid environment, including our email system. The main email system is Microsoft Exchange, which is deployed on-premise, and the second is Office 365. There isn't much security for the hybrid environment. We get logs from the web application firewall, the firewall, and the anti-spam solution.

Read full review

Vikram Cherala

Senior advisor at TekWissen India

Splunk lets us integrate multiple third-party threat intelligence feeds. We can also customize the data models for correlation more than we could with competing SIEM solutions. We can filter out the noise and see our alerts. I created some security reports or dashboards. We also have dashboards for user requests related to our firewalls, like Palo Alto and traffic or activity alerts. We can also see where we're getting a lot of authentication failures, etc. We've also created some other custom use cases, like using VPN logs and use cases for analyzing the national origins of repetitive malware. We have integrated some other solutions like Carbon Black EDR or MDR as well as Vectra, which is fully automated with AI. They have their own signatures. We get decent visibility with Splunk and integration with data visualization tools like Grafana. We also have various threat intelligence feeds that are updated regularly with the latest IOCs and signatures, which we can use for threat hunting.

Read full review

Splunk Enterprise Security mindshare

Product category:

As of December 2024, the mindshare of Splunk Enterprise Security in the Security Information and Event Management (SIEM) category stands at 11.2%, down from 15.0% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

PeerAnalyst reports

Type	Title	Date
Category	Security Information and Event Management (SIEM)	Dec 26, 2024	Download
Product	Reviews, tips, and advice from real users	Dec 26, 2024	Download
Comparison	Splunk Enterprise Security vs Wazuh	Dec 26, 2024	Download
Comparison	Splunk Enterprise Security vs Microsoft Sentinel	Dec 26, 2024	Download
Comparison	Splunk Enterprise Security vs IBM Security QRadar	Dec 26, 2024	Download

Title	Rating	Mindshare	Recommending
CrowdStrike Falcon	4.3	N/A	97%	122 interviews Add to research
Wazuh	3.7	16.4%	79%	45 interviews Add to research

Valuable Features

Splunk Enterprise Security's most valuable features include fast and flexible search capabilities, comprehensive log management, and high performance with scalability. Its user-friendly dashboards, powerful data correlation, and real-time alerts improve threat detection and response. Integration with multiple data sources enables centralized management. The Search Processing Language (SPL) and schema-on-read technology enhance data analysis. Its customizable visualization options and built-in security use cases further aid efficient monitoring and security operations.

"Overall, Splunk is among the top three SIEM tools due to its capabilities and agility in bridging business analytics with security needs."
"Splunk Enterprise Security enhances business resilience and assists with threat detection by centralizing security data."
"The Splunk Enterprise Security's threat-hunting capabilities have been particularly useful in later releases."

Room for Improvement

Splunk Enterprise Security could enhance user experience with a more intuitive UI and easier setup. Enhanced documentation, integration capabilities, and more out-of-the-box use cases could improve usability. Cost reduction and licensing flexibility would attract more users. Splunk could offer better training resources and AI integration. Performance issues, particularly with large data sets, are frequent. Improved threat detection and reduced false positives would boost security efficiency. Enhanced customization options, especially for dashboards and queries, are needed.

"Most importantly, Splunk can be outrageously expensive. That is the problem with both Splunk and Sentinel. Their pricing literally explodes based on the amount of data you feed in."
"Splunk Enterprise Security would benefit from a more robust rule engine to reduce false positives."
"Splunk Enterprise Security would benefit from a more robust rule engine to reduce false positives."

ROI

Splunk Enterprise Security offers significant return through improved integration, faster troubleshooting, and enhanced visibility. It saves time, increases efficiency, and supports better decision-making. Organizations have noted reductions in man-hours, costs, and error resolution times, with automation significantly contributing to ROI. While some see a direct financial return, others highlight qualitative benefits such as enhanced security measures and insights. Licensing costs pose challenges to some, but many find Splunk a valuable investment.

Pricing

Pricing for Splunk Enterprise Security is generally viewed as high, with costs primarily based on data ingestion volume. While many note the value and comprehensive features offered, the expense can be a concern for smaller enterprises and some regions. Licensing complexity and additional costs for features add to the overall investment. Despite the cost, users appreciate the robust capabilities and ROI, making it suitable for organizations with significant data and security needs.

"Splunk is priced higher than other solutions."
"The pricing is based on the volume of data fed into it, which can lead to substantial costs. This pricing model is complex and unpredictable, making cost management difficult."
"The price of Splunk Enterprise Security is reasonable, falling somewhere in the middle range."

Popular Use Cases

Their primary use case for Splunk Enterprise Security involves enhancing cybersecurity operations. Organizations utilize it for log aggregation, monitoring, and analyzing security incidents. They integrate various security tools and data sources to detect and respond to threats effectively. Splunk Enterprise Security is employed for creating security dashboards, alerts, and correlation searches. Its versatility allows users to monitor network traffic, detect vulnerabilities, and implement threat intelligence across multiple environments, ensuring robust security management.

Service and Support

Splunk Enterprise Security's support team is knowledgeable and helpful, with certifications ensuring expertise. Users appreciate the active online community, but response times are inconsistent. Some find support excellent, citing a quick, efficient experience, while others note delays and reliance on lower-tier staff for complex issues. Training materials and forums are valuable resources. Many users resolve issues independently, benefiting from local partners and professional services, but seek improvements in response speed and technical depth.

Deployment

Initial setup for Splunk Enterprise Security varies in complexity. Some users find it straightforward, especially for basic implementations, while others experience difficulties due to custom configurations, various data sources, or lack of expertise. Many note that smaller, standalone setups are easier, whereas larger, distributed environments pose challenges. Experienced teams or professional services often help streamline deployments. Despite documentation and support, maintaining the system can be complex, requiring skilled personnel and ongoing effort for optimization and configuration.

Scalability

Splunk Enterprise Security is recognized for its scalability, enabling horizontal and vertical expansion without significant issues. Users find it well-suited for both cloud and on-prem environments, although cloud deployments are typically easier to manage. Its architecture supports large data volumes, making it a preferred choice for enterprise-scale operations. While it generally performs well, careful planning and resource allocation are crucial to manage costs effectively as usage scales. The solution offers features that accommodate growing data demands efficiently.

Stability

Users consistently find Splunk Enterprise Security highly stable with minimal issues. Stability is praised despite occasional bugs and memory leaks. Users stress the importance of proper configuration, resource allocation, and capacity planning to prevent any degradation. Even during high data processing, the system remains reliable. Many users highlight its dependability and low maintenance requirements, noting Splunk's resilience across diverse environments, although some face challenges with large datasets.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Splunk Enterprise Security Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

15%

Computer Software Company

14%

Government

Manufacturing Company

University

Educational Organization

Healthcare Company

Insurance Company

Retailer

Energy/Utilities Company

Comms Service Provider

Real Estate/Law Firm

Non Profit

Media Company

Construction Company

Legal Firm

Transportation Company

Wholesaler/Distributor

Outsourcing Company

Hospitality Company

Recreational Facilities/Services Company

Logistics Company

Aerospace/Defense Firm

Performing Arts

Pharma/Biotech Company

Consumer Goods Company

Compare Splunk Enterprise Security with alternative products

Learn more about Splunk Enterprise Security

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Product Video

Splunk Enterprise Security customers

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.