Try our new research platform with insights from 80,000+ expert users

Logpoint vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Logpoint
Ranking in Security Orchestration Automation and Response (SOAR)
13th
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
22
Ranking in other categories
Log Management (21st), Security Information and Event Management (SIEM) (20th), User Entity Behavior Analytics (UEBA) (7th), Endpoint Detection and Response (EDR) (30th)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
43
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of January 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Logpoint is 1.2%, up from 0.9% compared to the previous year. The mindshare of Splunk SOAR is 8.3%, down from 9.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Abdullah Secca - PeerSpot reviewer
Valuable monitoring and integration features boost compliance
They are not in the US market, and the quality of support has declined. They migrated operations from Boston to Denmark, and we cannot use a tool hosted outside the country. Additionally, dealing with foreign entities for support was a challenge, leading us to switch providers due to lack of adequate support.
Shubham Sinha. - PeerSpot reviewer
Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work
The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The UEBA component, as well as the SOAR component, are some of the most valuable features of Logpoint."
"It is an AI technology because it is using machine learning technology. So far, there is nothing better out there for UEBA in terms of monitoring endpoints and user activity. It is using machine learning language, so it is right at the top. It provides that capability and monitors all the activities. It devises a baseline and monitors if there is any deviation from the baseline."
"The main advantage of Logpoint is the support service. They reply within ten minutes to an hour to our queries."
"The solution's most valuable aspect is the combination of the software and the support that they have."
"They basically charge you in a better way."
"The integration is very user-friendly. There are not many CLI commands. Everything is directly accessible from the web interface."
"The solution's user interface is quite simple, and the integration is better than other products."
"The search feature is valuable. The dashboards are also valuable for our bosses. Another valuable feature, which is the main feature of the product, is the centralization of all the logs."
"The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools."
"I have found all the security automation platform features of Splunk SOAR to be good. The Automation playbook development is highly useful."
"I like the integration capabilities of Phantom. It has a lot of integrations with other products. Its searching methodologies are also good. It is also easy to understand and easy to create playbooks."
"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."
"I'm just a beginner on the solution and it's pretty easy for me to use."
"The product provides 100% automation for certain processes."
"The most valuable feature of the solution is the playbook automation just because it allows us to reduce the manual actions that SOC has to handle."
"The solution’s dashboard is really good and customizable. It also has a good UI."
 

Cons

"LogPoint can improve its dashboards. We are not able to customize the dashboard when creating them. They only have preset dashboards which do not have exactly what we are looking for."
"Logpoint is not flexible. Its documentation is not user-friendly."
"Log management could be better because transporting the log from a password to the client system takes time."
"LogPoint must find a way to integrate the servers without agents."
"It is a good product, but its interface or GUI could be better."
"One of the things we faced last year was that we had some memory issues with the server running. We were running them as virtual services, and we were facing some performance issues. Back then, there were some things that had already been solved at the end, but one of the small issues we had was that it was quite memory-consuming. After one upgrade that we did, we faced some performance issues."
"The interface needs things like wizards that will assist with creating complex correlation rules."
"Sometimes, the product is not stable."
"The algorithm and machine learning have room for improvement and can be more user-friendly."
"Various aspects of the playbook development process itself can be optimized."
"Splunk SOAR has room to improve its offering for small-sized customers. The price is not fair for smaller-sized customers."
"The application does not work properly and does not pass the log-based configuration. I feel that some kind of review should happen in the application. This review should validate things so that we can get the right information. Splunk does not tell us where the IP address is associated with."
"We've had trouble implementing the solution with Microsoft products. There seems to be an integration gap."
"Splunk SOAR can improve IoT/OT security-related case studies or your use cases. Their integration with identity and access management (IAM) solutions is a bit shaky. They don't have good integration with a lot of IAM solutions. They do have good capability in terms of user access management internally, but even with privileged user access, they have a good module. However, if they have to integrate with solutions, such as CyberArk or IBM IAM solutions they are lacking, the visibility of user access is not that much."
"It would be ideal if we could automate processes even more."
"In my opinion, the focus should be on improving its simplicity, specifically the interface, and configuration."
 

Pricing and Cost Advice

"It's getting more expensive, which is one of the reasons we're looking around just to see if there's anything better value."
"On a scale of one to ten, where one is cheap, and ten is expensive, I would rate LogPoint's pricing a seven. It is not very expensive compared to some of the more costly products, and it is not very cheap compared to some of the cheaper products in the SIEM market."
"It's less expensive than the competitors. The Logpoint marketing team is very accommodating and client-friendly. They offer very good reductions in price. They are pretty good in this aspect. They are transparent in their licensing and pricing."
"It was on a yearly basis at about $100K. It was not a huge environment. We were running it on our own virtual server environment, which, of course, had a cost. There was hardware and some energy cost, and then there were Microsoft Windows licenses for servers. That's all, but there was nothing in comparison to the licensing costs."
"For a hundred user deployment the cost is about $10,000. The next year it would be the same because it's a subscription-based license. There are separate costs as well, for example, if a customer asks for training for their staff."
"My company used to pay for LogPoint costs annually. It's a cost-effective solution. I'm not part of the Finance team, though, so I'm not sure exactly what the licensing fee is or what license my company had."
"It has a fixed price, which is what I like about LogPoint. I bought the system and paid for it, and I pay maintenance. It is not a consumption model. Most SIEMs or most of the log management systems are consumption-based, which means that you pay for how many logs you have in the system. That's a real problem because logs can grow very quickly in different circumstances, and when you have a variable price model, you never know what you're going to pay. Splunk is notoriously expensive for that reason. If you use Splunk or QRadar, it becomes expensive because there are not just the logs; you also have to parse the logs and create indexes. Those indexes can be very expensive in terms of space. Therefore, if they charge you by this space, you can end up paying a significant amount of money. It can be more than what you expect to pay. I like the fact that LogPoint has a fixed cost. I know what I'm going to pay on a yearly basis. I pay that, and I pay the maintenance, and I just make it work."
"Our licensing fees are about $10,000 USD per month, which I think is fair."
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"I found the price of Splunk SOAR to be good."
"Splunk SOAR is more expensive compared to other options for SOAR."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"I don't know the exact price, but for my region, it is very expensive."
"The cost is high and the licensing is on an annual basis."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
831,369 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
67%
Computer Software Company
8%
Comms Service Provider
4%
Manufacturing Company
3%
Computer Software Company
14%
Financial Services Firm
14%
Manufacturing Company
12%
Government
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for LogPoint?
The pricing is reasonable. The costs are charged on a yearly basis, however, I do not want to disclose exact figures.
What needs improvement with LogPoint?
They are not in the US market, and the quality of support has declined. They migrated operations from Boston to Denmark, and we cannot use a tool hosted outside the country. Additionally, dealing w...
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
I rate Splunk SOAR two out of 10 for affordability. Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all ...
What needs improvement with Splunk Phantom?
The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginne...
 

Comparisons

 

Also Known As

No data available
Phantom
 

Overview

 

Sample Customers

AP Pension, Copenhagen Airports, KMD, Terma, DISA, Danish Crown, Durham City Council, Game, TopDanmark, Lahti Energia, Energi Midt, Synoptik, Eissmann Group Automotive, Aligro, CG50...
Recorded Future, Blackstone
Find out what your peers are saying about Logpoint vs. Splunk SOAR and other solutions. Updated: January 2025.
831,369 professionals have used our research since 2012.