Try our new research platform with insights from 80,000+ expert users

Cisco Secure Network Analytics vs Splunk User Behavior Analytics comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Cisco Secure Network Analytics
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
59
Ranking in other categories
Network Monitoring Software (24th), Network Traffic Analysis (NTA) (3rd), Network Detection and Response (NDR) (5th), Cisco Security Portfolio (3rd)
Splunk User Behavior Analytics
Average Rating
8.2
Reviews Sentiment
6.5
Number of Reviews
19
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (14th), User Entity Behavior Analytics (UEBA) (4th)
 

Mindshare comparison

While both are Network Security Systems solutions, they serve different purposes. Cisco Secure Network Analytics is designed for Network Monitoring Software and holds a mindshare of 1.5%, down 1.7% compared to last year.
Splunk User Behavior Analytics, on the other hand, focuses on User Entity Behavior Analytics (UEBA), holds 10.1% mindshare, down 11.6% since last year.
Network Monitoring Software
User Entity Behavior Analytics (UEBA)
 

Featured Reviews

Rainier S. - PeerSpot reviewer
You are able to drill down into a center's utilization, then create reports based on it
In the last year or two, we have been working with our Cisco NAS engineers to improve our security posturing. It is more our being proactive rather than reactive. While Stealthwatch and Lancope have this ability to look inside and give you visibility (a great feature), follow-up is the rule. We would like filters that you can put into place to tap onto certain types of behaviors, alerts out, and/or hopefully a block. This is sort of what we are looking for. I might be speaking too early, because we are not down this path yet. We know the feature set is there, we just do not know yet how to achieve it. That is proactive rather than more reactive. For Lancope Stealthwatch, we would like to see it more on the ASA Firewall platform. While this might already be available, this is more a failing of Cisco to inform us if it is there. For example: * Are we on the right or wrong version of the code? * What does the code look like? * Are we are really looking at firewalls? Or is it more about the foundation and route switches that we are seeing? It is about visibility.
Hamada-Elewa - PeerSpot reviewer
Decreases the false positives but storage model complexity hampers efficiency
I recommend it to my customers, but I'm a salesman. I am not implementing it myself It decreases the false positives, so it will decrease the time consumed by the operation team to work on Splunk. The most effective one is the integration with other vendors. This is the most attractive one.…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, the implementation is very good."
"Stealthwatch has greatly improved our network visibility, in terms of bandwidth, malware, and PCI violations."
"The most valuable part is that Stealthwatch is part of a portfolio of security devices from Cisco. Cisco literally can touch every single end point, every single ingress and egress point in the network. Nobody else has that."
"Most of the engineers I've worked with have been really good. Very knowledgeable and easy to work with."
"The most valuable features of this solution are its reporting and mitigation capabilities."
"Provides easily identifiable anomalies that you can't see with signature detections."
"Cisco Stealthwatch provides the solutions analytics and threat detection capabilities that I am looking for. It has also improved the network visibility of our organization."
"We find that Stealthwatch can detect the unseen."
"The solution's most valuable feature is Splunk queries, which allow us to query the logs and analyze the attack vectors."
"The most valuable features are its data aggregation and the ability to automatically identify a number of threats, then suggest recommended actions upon them."
"The solution is fast, flexible, and easy to use."
"We are really pleased with Splunk and its features. It would be practically impossible to function without it. To provide a general overview of the system, it's important to note that the standard log files are currently around 250 gigabytes per day. It would be impossible to manually walk through these logs by hand, which is why automation is essential."
"The most valuable feature is being able to take data and put it into other systems so that we could see the output, and to see where we need to apply our focus."
"The solution appears to be stable, although we haven't used it heavily."
"The solution is extremely scalable. Our customers are regularly scaling up after installing Splunk."
"It's easily scalable."
 

Cons

"It's too complicated to install, when starting out."
"There's a lot of traffic on our network that we don't see sometimes."
"The customizability of the UI should improve."
"The initial setup was complex."
"I would like to see more expansion in artificial intelligence and machine learning features."
"We would like the solution to make more advances in the way that Extreme Networks has been doing."
"Cisco Stealthwatch can improve by having bundled packages for popular add-ons. It would be a lot easier for people implementing it, have let's say a better way to use the product."
"The initial setup was straightforward but required a lot of data entry, to begin with building out the server types and network types."
"The solution is much more expensive than relative competitors like ArcSight or LogRhythm. It makes it hard to sell to customers sometimes."
"We want to have an automated system for bot hunting that enables us to detect anomalies predictively based on historical data. It would be helpful if Splunk included process mining as an alternative option. We have a threat workflow, but it would be useful if we could supplement that with some process mining capabilities over time."
"I would like improved downward integration with other tools such as McAfee and other GCP solutions."
"It could be easier to scale the solution if you are using it on-premise, not in the cloud."
"Currently, a lot of network operations need improvement. We still need people to handle incidents. Our vision is to leverage status and convert it directly from the network devices. It would be ideal if we could take action using APIs and API code and remove manual processes."
"The ability to do more complicated data investigation would be a welcome addition for pros, though the functionality now gives most people what they need."
"It would be good if the solution had an analytics tool that allowed us to analyze the data without writing specific queries."
"In the future I would like to see simplified statistics and analytical threats."
 

Pricing and Cost Advice

"Licensing is done by flows per second, not including outside>in traffic."
"Today, we are part of the big Cisco ELA, and it is a la carte. We can get orders for whatever we want. At the end of the day, we have to pay for it in one big expense, but that is fine. We are okay with that."
"The tool is not cheaply priced."
"The solution is expensive. It costs several hundred thousand dollars per year (depending on how many flows you are collecting)."
"This is an expensive product. We have quit paying for support because we don't want to have to upgrade it and keep paying for it."
"It is worth the cost."
"We pay for support costs on a yearly basis."
"Licensing is on a yearly basis."
"Pricing varies based on the packages you choose and the volume of your usage."
"I hope we can increase the free license to be more than 5 gig a day. This would help people who want to introduce a POC or a demo license for the solution."
"The licensing costs is around 10,000 dollars."
"My biggest complaint is the way they do pricing... You can never know the pricing for next year. Every single time you adjust to something new, the price goes up. It's impossible to truly budget for it. It goes up constantly."
"I am not aware of the price, but it is expensive."
"There are additional costs associated with the integrator."
report
Use our free recommendation engine to learn which Network Monitoring Software solutions are best for your needs.
824,067 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
30%
Financial Services Firm
11%
Government
8%
Manufacturing Company
6%
Computer Software Company
15%
Financial Services Firm
13%
Government
9%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Cisco Stealthwatch?
The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration.
What is your experience regarding pricing and costs for Cisco Stealthwatch?
The tool is not cheaply priced. In cybersecurity, you want an extra layer of security in your organization. Some sectors want NDR solutions, so you cannot deploy such tools everywhere, as they are ...
What needs improvement with Cisco Stealthwatch?
The expensive nature of the tool is an area of concern where improvements are required.
What do you like most about Splunk User Behavior Analytics?
The solution's most valuable feature is Splunk queries, which allow us to query the logs and analyze the attack vectors.
What is your experience regarding pricing and costs for Splunk User Behavior Analytics?
It's too expensive. If you need observability, you will pay for the whole package of observability. But if you need anything in security, you will pay for the whole package, then you can select the...
What needs improvement with Splunk User Behavior Analytics?
Enhancing the storage model that they are using is necessary. It's too much. The number of VMs, the total number of VMs, is overwhelming. The system is stable, but for the storage issues requiring ...
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
Caspida, Splunk UBA
 

Learn More

Video not available
Video not available
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
8 Securities, AAA Western, AdvancedMD, Amaya, Cerner Corporation, CJ O Shopping, CloudShare, Crossroads Foundation, 7-Eleven Indonesia
Find out what your peers are saying about Cisco Secure Network Analytics vs. Splunk User Behavior Analytics and other solutions. Updated: January 2020.
824,067 professionals have used our research since 2012.