Splunk Enterprise Security vs Sumo Logic Security comparison

Splunk and Sumo Logic are both solutions in the Security Information and Event Management (SIEM) category. Splunk is ranked #1 with an average rating of 8.4, while Sumo Logic is ranked #19 with an average rating of 8.3. Splunk holds a 10.9% mindshare in SIEM, compared to Sumo Logic’s 0.8% mindshare. Additionally, 93% of Splunk users are willing to recommend the solution, compared to 95% of Sumo Logic users who would recommend it.

Splunk Enterprise Security

Read 301 Splunk Enterprise Security reviews

17,426 Views
14,446 Comparison Views

93% willing to recommend

Sumo Logic Security

Read 18 Sumo Logic Security reviews

1,626 Views
1,104 Comparison Views

95% willing to recommend

Splunk Enterprise Security

Sumo Logic Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 29, 2024

Splunk Enterprise Security and Sumo Logic Security compete in the security analytics domain. Sumo Logic Security seems to have the upper hand due to its competitive pricing, easy integration, and modern capabilities.

Features: Splunk Enterprise Security is recognized for its advanced detection mechanisms, comprehensive reporting capabilities, and robust user reviews. Sumo Logic Security is valued for its cloud-native architecture, real-time monitoring, and easy integration with other systems.

Room for Improvement: Splunk Enterprise Security could benefit from a more intuitive learning curve, reduced operational costs, and simplified user experience. Sumo Logic Security users mention the need for more customizable reporting options, better alert management, and more detailed documentation.

Ease of Deployment and Customer Service: Splunk Enterprise Security's deployment is seen as complex and resource-intensive, though customer service is highly rated. Sumo Logic Security offers easier deployment with responsive customer support, making it appealing for rapid implementation.

Pricing and ROI: Splunk Enterprise Security is noted for higher setup costs, some users feel are justified by its capabilities, though it can impact ROI negatively. Sumo Logic Security is praised for its cost-effectiveness, providing significant value relative to its price, making it a preferable choice for budget-conscious buyers looking for strong security analytics.

To learn more, read our detailed Splunk Enterprise Security vs. Sumo Logic Security Report (Updated: October 2024).

Buyer's Guide

Splunk Enterprise Security vs. Sumo Logic Security

October 2024

Download the complete report

Helped 814,649 peers since 2012

Categories and Ranking

Splunk Enterprise Security

Ranking in Log Management

1st

Ranking in Security Information and Event Management (SIEM)

1st

Average Rating

8.4

Number of Reviews

301

Ranking in other categories

IT Operations Analytics (1st)

Sumo Logic Security

Ranking in Log Management

19th

Ranking in Security Information and Event Management (SIEM)

19th

Average Rating

8.6

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (12th)

Mindshare comparison

As of November 2024, in the Security Information and Event Management (SIEM) category, the mindshare of Splunk Enterprise Security is 10.9%, down from 14.3% compared to the previous year. The mindshare of Sumo Logic Security is 0.8%, down from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Sameep Agarwal.

Group manager at HCM Technologies

Oct 23, 2023

It has a drag-and-drop interface, so you don't need to know SQL or Java to construct a query

The ingestion happens quickly, so you can run up the data costs if you use the default settings. It isn't a problem for government agencies in the Saudi market, but many of the corporations in India are small or medium-sized enterprises that cannot afford that kind of ingestion system. Splunk needs to be tweaked in JSON so you can limit what is coming from the endpoints, especially the events. One needs to filter that out so that only certain events are ingested, like login failures, Active Directory changes, password reset requests, privilege modifications, etc. Each Windows machine generates about 310 KB of information per event, but we can tweak that down to about 50 KB.

Read full review

Moole Muralidhara Reddy

DevOps and Solution Architect at ADP

Mar 26, 2024

Used to store and monitor application logs and VPC flow logs

We are mainly concentrating on networking. We use VPC products and application logs to monitor the genuineness of users who have logged in. We also store and monitor GuardDuty logs to see if someone is trying to access the same server multiple times. We are storing and monitoring WAF logs and GuardDuty logs. If someone faces any issues, we'll receive an email and take action based on it. If someone tries to access one of the applications from a different country, we can search in Google and identify the location of that particular IP address. Sumo Logic Security identifies whether a particular IP address is low, medium, or high risk without the help of Google. We can store logs in CloudWatch, but it is very difficult to search them in CloudWatch. We should know the query in order to do that. Searching for logs with Sumo Logic Security is very easy compared to CloudWatch. We have been using the solution for more than two years and haven't faced any issues with the solution's availability. I would recommend the solution to other users. I would recommend Sumo Logic Security instead of AWS, CloudWatch, or CloudTrail. With Sumo Logic Security, you can capture and see all the logs in a single place. If some issues occur, you can log into the solution and verify all the logs. At an organizational level, we have multiple AWS accounts for different environments. Instead of logging in to all the AWS accounts, you can log in to Sumo Logic Security and verify everything. Overall, I rate the solution a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The flexibility of the solution is quite good."

"The Splunk queries are valuable."

"What I really like is that even if you have already collected the data, you can extract fields and can build searches."

"The solution's most valuable feature is the incident review, which gives a good overview of our security incidents."

"It is easy to use, and easy to implement."

"Splunk's strongest suit is its user interface. We can integrate multiple solutions and adjust settings in the Splunk interface."

"The most valuable features of Splunk Enterprise Security are its high-performance data collection, flexible query language, and its versatility across the organization."

"Easy to deploy and simple to use."

More Splunk Enterprise Security pros

"We use it to ingest Windows domain controller logs. We use this to monitor if anyone is placed in particular administration groups that potentially shouldn't be. It helps us keep track of people."

"With this tool, we provide access to every developer team the ability to find errors, then they come to us and ask for specific help."

"Support has been excellent. Sumo Logic's support staff is really good, both their account management staff and direct support."

"Sumo Logic Security is a good solution for searching the logs and identifying the issues."

"For many of our services, we use Sumo Logic to track errors and send notifications to our Slack channel, if there are issues. Then, we have our support people monitoring this, and they can react quickly."

"It provides easy visibility. I also like the shareable queries because we share a lot across groups."

"We can integrate threat intelligence solutions into the product."

"The tool has key features like operability. It will alert the admins whenever a device is onboarded."

More Sumo Logic Security pros

Cons

"I would like Splunk to add more integration. QRadar has many indications with more products than Splunk."

"It currently has limited default rules and customizations. If they can concentrate more on the compliance part and the security information part, it would be helpful. The platform part is good, but it requires many features from the security aspect."

"It would be nice if they had a wizard to construct searches, including more complex searches that include math or statistics."

"I would like to get visibility into the data pipelines on heavy forwarders and indexers to see exactly their source and the cause of saturation when it occurs. This would help us learn even more about our high use applications."

"Splunk Enterprise Security should provide a better and richer integration."

"The product was difficult to back up the first time."

"Its pricing model and integration with third-party services can be improved. We had faced an issue with integration. The alerting feature is currently not available with Splunk, but it is definitely available with Datadog and PagerDuty. They should include this feature. A few dashboards in Splunk look quite old and are not that modern. They aren't bad, but improving these dashboards will definitely make Splunk more attractive and usable. I read in a few blog posts that there were a few security incidents related to Splunk agents. So, it can be made more secure."

"The level of scalability depends on the license you have. You can expand or reduce it based on the environment. It does cost more money to scale, however."

More Splunk Enterprise Security cons

"We would like the ability to drill down into a dashboard and get into deeper levels."

"The initial setup is the most stressful, like learning how to use it."

"There are some API gaps that are missing."

"Sumo Logic Security is expensive, and its pricing could be improved."

"I would like better UI-driven functionality to create alerts and reports. Now, we have to understand the syntax, so it is a little difficult for someone to pick it up without using the manuals. If there was more of a graphical user interface, it would be beneficial."

"The integration with multiple sources could be better."

"If you want to up your subscription through the AWS Marketplace, it can be difficult. You can't just go back to the AWS Marketplace, and say, "I want a bigger one now." You have to contact the sales team, then they do it on the back-end. This could definitely be improved."

"The solution should improve its UI."

More Sumo Logic Security cons

Pricing and Cost Advice

"Splunk Enterprise Security is expensive."

"Price-wise, if you compare QRadar to Splunk for SIEM functionality then they are in the same range but when you integrate SOAR with these solutions, Splunk takes the lead and is more competitive."

"It is a bit costly."

"It is not cheap."

"Our ROI is high."

"The pricing model is based on the number of gigabytes that you ingest into the Splunk system. So it can be an expensive solution."

"Splunk is really expensive."

"Splunk Enterprise Security is expensive."

More Splunk Enterprise Security pricing and cost advice

"The AWS Marketplace pricing is fairly reasonable for what it does. I wouldn't call it expensive, but I wouldn't call it cheap. It is pretty good."

"Pricing has been cheaper than some of the competing tools, like Splunk."

"The pricing is a little high, but for the features that we receive from Sumo Logic, it suits the price. For some small organizations, the price might be a little high."

"Purchasing Sumo Logic through the AWS Marketplace was a simple step."

"Purchasing the solution through the AWS Marketplace is very easy."

"Storing logs in Sumo Logic Security is charged GB-wise, which is a little higher than other products."

"We chose to go through the AWS Marketplace because it makes it a lot easier when we bill our customers. Rather than having to get multiple different sources of information then correlate a monthly bill for our customers, it is just included in the AWS usage charges."

"The only limit to the scalability of the product for us is how much we are willing to pay."

More Sumo Logic Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

814,649 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

14%

Government

Manufacturing Company

Computer Software Company

16%

Financial Services Firm

11%

Government

10%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

See all answers

What do you like most about Sumo Logic Security?

Sumo Logic Security is a good solution for searching the logs and identifying the issues.

See all answers

What is your experience regarding pricing and costs for Sumo Logic Security?

Storing logs in Sumo Logic Security is charged GB-wise, which is a little higher than other products.

See all answers

What needs improvement with Sumo Logic Security?

Sumo Logic Security is expensive, and its pricing could be improved.

See all answers

Comparisons

Wazuh vs Splunk Enterprise Security

Compared 11% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 9% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 4% of the time

AppDynamics vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Google Chronicle Suite vs Sumo Logic Security

Compared 15% of the time

Wazuh vs Sumo Logic Security

Compared 13% of the time

Rapid7 InsightIDR vs Sumo Logic Security

Compared 11% of the time

Securonix Next-Gen SIEM vs Sumo Logic Security

Compared 8% of the time

Grafana Loki vs Sumo Logic Security

Compared 7% of the time

More Sumo Logic Security Competitors

Product Reports

Buyer's Guide

Splunk Enterprise Security

October 2024

Download Splunk Enterprise Security product report

Buyer's Guide

Sumo Logic Security

October 2024

Download Sumo Logic Security product report

Learn More

Splunk

Sumo Logic

Overview

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Sumo Logic

Sumo Logic is a cloud-based machine data analytics company focusing on security, operations, and BI use cases. It provides log management and analytics services that leverage machine-generated big data to deliver real-time IT insights.

Sumo Logic is developed as a SaaS solution, it processes and analyzes large quantities of IT infrastructure data, spotting patterns and anomalies that can indicate a potential threat or significant event.

The platform is designed to help IT, security, and business operations teams develop, manage, and secure their applications and cloud infrastructures. It collects, aggregates, and analyzes data from various sources including servers, virtual machines, and network devices, providing visibility into complex systems.

What are the key features of Sumo Logic?

Real-time Analytics: Continuous queries and live dashboards that provide insights into application performance, user behavior, and security threats.
Advanced Machine Learning: Utilizes machine learning algorithms to identify trends, anomalies, and patterns.
Integrated Threat Intelligence: Tools and workflows to enhance security postures by detecting threats and anomalies.
Multi-tenant Cloud Service: Allows users to operate in a shared cloud environment securely.

The solution aims to simplify data complexity, streamline operations, and provide actionable insights to businesses across various industries.

Sumo Logic is designed to handle high data volumes from multiple sources without diminishing performance. It is primarily deployed in the cloud with seamless integrations for AWS, Google Cloud, and Microsoft Azure. This flexibility allows users to leverage Sumo Logic’s capabilities regardless of their existing cloud infrastructure.

In summary, Sumo Logic is a comprehensive, AI-driven analytics solution ideal for businesses looking to enhance their IT and security operations through data-driven insights and real-time monitoring. Its flexible deployment options and scalable pricing model make it accessible for various business sizes and sectors.

Sample Customers

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

Information Not Available

Buyer's Guide

Splunk Enterprise Security vs. Sumo Logic Security

October 2024

Free Report: Splunk Enterprise Security vs. Sumo Logic Security

Find out what your peers are saying about Splunk Enterprise Security vs. Sumo Logic Security and other solutions. Updated: October 2024.

DOWNLOAD NOW

814,649 professionals have used our research since 2012.

See our Splunk Enterprise Security vs. Sumo Logic Security report.

See our list of best Security Information and Event Management (SIEM) vendors, best Log Management vendors, and best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.