Try our new research platform with insights from 80,000+ expert users

Splunk Enterprise Security vs Trustwave SIEM [EOL] comparison

Splunk and Trustwave are both solutions in the Security Information and Event Management (SIEM) category. Additionally, 93% of Splunk users are willing to recommend the solution.
Splunk Enterprise Security
Read 301 Splunk Enterprise Security reviews
  • 17,426 Views
  • 14,446 Comparison Views
93% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Sep 29, 2024

Splunk Enterprise Security and Trustwave SIEM compete in the security information and event management (SIEM) market. Splunk Enterprise Security appears to have the upper hand due to its comprehensive features, better pricing, and robust support.

Features: Splunk Enterprise Security is praised for its advanced analytics, real-time monitoring, and flexible data ingestion capability. Users value its customizable dashboards and robust threat detection capabilities. Trustwave SIEM offers strong threat intelligence, automated incident response features, and good visibility into network activity.

Room for Improvement: Users suggest that Splunk Enterprise Security could improve its integration with third-party tools, reduce its resource consumption, and streamline user interface navigation. Trustwave SIEM needs better documentation, an enhanced alerting system, and more intuitive user interface design.

Ease of Deployment and Customer Service: Splunk Enterprise Security is commended for its straightforward deployment process and responsive customer support. Trustwave SIEM users report a steeper learning curve during implementation and average customer service. Thus, Splunk Enterprise Security is perceived as easier to deploy with better support.

Pricing and ROI: Splunk Enterprise Security is considered by users to offer better value for its price, given its extensive capabilities and support. Trustwave SIEM has a lower entry price point but a slower return on investment. Consequently, users tend to favor Splunk Enterprise Security for its overall cost-efficiency.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed Security Information and Event Management (SIEM) Report (Updated: November 2024).
Buyer's Guide
Security Information and Event Management (SIEM)
November 2024
Download the complete report
Helped 815,854 peers since 2012
 

Categories and Ranking

Splunk Enterprise Security
Average Rating
8.4
Number of Reviews
301
Ranking in other categories
Log Management (1st), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
Trustwave SIEM [EOL]
Average Rating
6.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
 

Featured Reviews

Avinash Gopu. - PeerSpot reviewer
Feb 1, 2024
Offers good visibility into multiple environments, significantly reduces our alert volume, and speeds up our security investigations
There are limitations with Splunk not detecting all user activity, especially on mainframes and network devices. This is because Splunk relies on agents, which cannot access certain workstations. In these cases, we have to rely on application data. For example, with mainframes, manual reports are generated and sent to Splunk, limiting visibility to what's manually reported. This lack of automation for specific platforms needs improvement from Splunk. Additionally, API access is limited for other applications that rely on API calls and requests. This requires heavy customization on Splunk's end. These are the main challenges we've encountered. Monitoring multiple cloud platforms, like Azure, GCP, and AWS, with Splunk Enterprise Security presents some challenges. While Splunk provides different connectors for each provider, consolidating data from two domains across distinct cloud environments can be complex. However, leveraging pre-built templates and Splunk's data collation capabilities can help overcome these hurdles. Despite initial difficulties, I believe Splunk can effectively address this task, earning it an eight out of ten rating for its multi-cloud monitoring capabilities. While Splunk Enterprise Security offers insider threat detection capabilities, its effectiveness could be enhanced by integrating with additional tools, such as endpoint security solutions. This integrated approach is particularly crucial for financial institutions, which often require dedicated endpoint security teams. While using multiple tools is valuable, further improvements within Splunk itself are also necessary. Considering both external integration and internal development, I would rate its current insider threat detection capabilities as three out of ten. Threat detection is where Splunk falls behind. While it offers tools, other use cases require additional work. PAM is an enterprise tool that centralizes information about users, servers, and everything else. It needs real-time monitoring, which I haven't seen in any of the companies I've worked for. They only rely on Splunk for alerting, but real-time monitoring should be handled by the endpoint security team's tools. This means there's no detection or analysis at the machine or endpoint level. Additionally, threat analysis reporting is also absent.
Read full review
it_user1012437 - PeerSpot reviewer
Feb 14, 2019
It's not very attractive when compared to other solutions but the pricing is comfortable.
Log collection, and correlation engine usage. It has some limitations in parser modules. Comfort in pricing.  It's not very attractive in comparison to other solutions.  It needs to improve in AI and automatic parsing. One to three years.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pricing and Cost Advice

"Luckily, we come under a large federal agency, and before the pandemic, they signed a large enterprise license agreement. It worked out great and to our advantage because we are a small organization. We got a 300 gig license, and we just did not have the buying power to be able to get products cheaply. Because we all partnered together under the agency umbrella, we were able to get Splunk Enterprise Security, UBA, and ITSI for cheap. This was good considering the fact that some of these premium apps require a minimum number of users, and we do not have the number of people needed to even justify buying it."
"We have seen ROI and improvements as we have continued to use the product, but they are more reactive."
"While some clients find the cost of Splunk Enterprise Security to be on the higher end, its pricing is comparable to other SIEM solutions."
"Price-wise, if you compare QRadar to Splunk for SIEM functionality then they are in the same range but when you integrate SOAR with these solutions, Splunk takes the lead and is more competitive."
"The pricing seems good relative to the other vendors that we have had here. However, they need to find ways to be more flexible with the licensing and be able to deal with situations where we start generating more logs. Maybe having some controls in the Splunk interface to turn it off, so we don't have to change anything in our application."
"ROI is estimated at saving my team roughly 10 to 12 man hours per week in troubleshooting for our company as well as what our profits had been from our services of installing, configuring, and supporting other clients with the product."
"The pricing of Splunk Enterprise Security is high."
"Pricing can be a limiting factor. You have to continuously tune what you are bringing in and make sure what you bring in is of value."
More Splunk Enterprise Security pricing and cost advice
Information not available
report
See which vendors are best for you
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
See recommendations
815,854 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
Read full review
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Computer Software Company
14%
Government
9%
Manufacturing Company
8%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
See all answers
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
See all answers
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
See all answers
Ask a question
Earn 20 points
 

Comparisons

Wazuh vs Splunk Enterprise Security Logo
Wazuh vs Splunk Enterprise Security
Compared 11% of the time
IBM Security QRadar vs Splunk Enterprise Security Logo
IBM Security QRadar vs Splunk Enterprise Security
Compared 9% of the time
Dynatrace vs Splunk Enterprise Security Logo
Dynatrace vs Splunk Enterprise Security
Compared 8% of the time
Datadog vs Splunk Enterprise Security Logo
Datadog vs Splunk Enterprise Security
Compared 4% of the time
AppDynamics vs Splunk Enterprise Security Logo
AppDynamics vs Splunk Enterprise Security
Compared 4% of the time
More Splunk Enterprise Security Competitors
No data available
 

Product Reports

Buyer's Guide
Splunk Enterprise Security
October 2024
Splunk Enterprise Security reportDownload Splunk Enterprise Security product report
Buyer's Guide
Security Information and Event Management (SIEM)
November 2024
Trustwave SIEM [EOL] reportDownload Trustwave SIEM [EOL] product report
 

Learn More

Splunk
Trustwave
 

Overview

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?
  • Comprehensive Dashboards: Provide a holistic view of security operations.
  • Flexible Data Ingestion: Supports various data sources for better analysis.
  • Robust Log Aggregation: Centralizes log management for easier monitoring.
  • Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
  • SIEM Capabilities: Integrates security information and event management.
  • Threat Intelligence: Utilizes external information to improve security measures.
  • Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
  • Correlation Searches: Identifies and correlates security events effectively.
What benefits or ROI should users look for?
  • Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
  • Faster Incident Response: Speeds up identification and resolution of security issues.
  • Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
  • Scalability: Adapts to growing and changing security needs.
  • Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

SIEM Enterprise enables organizations to quickly address their compliance requirements and take a proactive approach to their security risk management strategy.

Purpose-built with a focus on simplified management, SIEM Enterprise's intuitive, browser-based user interface makes it easy to centrally configure, update and operationally maintain across your environment. SIEM Enterprise is the go-to solution for organizations that need to sort through disparate logs from security products and devices to detect threats and manage risk and compliance requirements.

 

Sample Customers

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Manna Enterprises
Buyer's Guide
Security Information and Event Management (SIEM)
November 2024
Download Free Report
Find out what your peers are saying about Splunk, Microsoft, Wazuh and others in Security Information and Event Management (SIEM). Updated: November 2024.
DOWNLOAD NOW
815,854 professionals have used our research since 2012.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.