Splunk Security Essentials Reviews

We use Splunk Security Essentials to monitor alerts. We implement correlation in the Splunk solution. Once we encounter a event, we assess its severity based on our preferences and send out notifications accordingly. Additionally, we perform health monitoring, checking the status of masters, heads, and shutdowns every 24 and 48 hours. If any issues arise, we document them and notify the relevant server owners for resolution. We also set up clusters every week and monitor the indexing rate provided by the engineering team. We analyze the data regularly based on standard procedures to ensure everything functions properly.

Once we've configured our logs, for example, if we need to monitor processes and IP addresses, we ensure these logs are being ingested into our Splunk instance. The logs gathered from various endpoints are then consolidated into our Splunk platform. Once the data is collected, we can create searches and dashboards to analyze it. With these searches and dashboards, we gain insights into events and can make informed decisions based on them. We'll examine the parameters of these events and take appropriate actions as necessary.

We are focusing on security to ensure incidents are reported efficiently. In addition to that, for reporting purposes, we are utilizing our dashboards or creating new ones. We will be using free visualization tools for this purpose.

The price could be improved.

I have been using Splunk Security Essentials as a customer for five years.

I rate the solution’s stability a seven out of ten.

We have a team that we are handling the solution.

I rate the solution’s scalability a nine-point five out of ten.

Technical support is not up to the mark.

Neutral

Deploying Splunk Security Essentials has been a challenge due to client approval issues. Despite multiple attempts, the client has not approved our deployments. We need to generate a pattern for testing purposes. VPN deployment only takes a few minutes once we gain hands-on experience with this client. 

We'll deploy within 15 days if we get approval. If we don't get approval, it will take much longer.

The solution is expensive.

Overall, I rate the solution an eight out of ten.