Splunk Enterprise Security vs Zabbix comparison

Cancel
You must select at least 2 products to compare!
Microsoft Logo
31,886 views|17,713 comparisons
92% willing to recommend
Splunk Logo
24,689 views|20,244 comparisons
92% willing to recommend
Zabbix Logo
22,616 views|17,448 comparisons
95% willing to recommend
Comparison Buyer's Guide
Executive Summary
Updated on Sep 5, 2022

We performed a comparison between Splunk and Zabbix based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Splunk users share mixed reviews on deployment. Zabbix users say deployment is straightforward and fast.
  • Features: Users of both products are happy with their stability and scalability.

    Splunk users like the solution’s logging and data capabilities. Reviewers mention that the monitoring could be improved and that it is not so user-friendly.

    Zabbix users say it is a mature solution that integrates well with Microsoft Office but that its UI needs improvement.
  • Pricing: Most Splunk users say that it is an expensive solution. Zabbix is open-source and free of charge.
  • Service and Support: Most Splunk and Zabbix users are satisfied with the technical support.
  • ROI: Reviewers of both products report seeing an ROI.

Comparison Results: In this comparison, Zabbix comes out on top. When compared to Splunk, it is easier to deploy and is open-source.

To learn more, read our detailed Security Information and Event Management (SIEM) Report (Updated: April 2024).
771,157 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The Identity Behavior tab furnishes us with the entire history linked to each IP or domain that has either accessed or attempted to access our system.""I've worked on most of the top SIEM solutions, and Sentinel has an edge in most areas. For example, it has built-in SOAR capabilities, allowing you to run playbooks automatically. Other vendors typically offer SOAR as a separate licensed solution or module, but you get it free with Sentinel. In-depth incident integration is available out of the box.""One of the most valuable features of Microsoft Sentinel is that it's cloud-based.""You can fine-tune the SOAR and you'll be charged only when your playbooks are triggered. That is the beauty of the solution because the SOAR is the costliest component in the market today... but with Sentinel it is upside-down: the SOAR is the lowest-hanging fruit. It's the least costly and it delivers more value to the customer.""Native integration with Microsoft security products or other Microsoft software is also crucial. For example, we can integrate Sentinel with Office 365 with one click. Other integrations aren't as easy. Sometimes, we have to do it manually.""The standout feature of Sentinel is that, because it's cloud-based and because it's from Microsoft, it integrates really well with all the other Microsoft products. It's really simple to set up and get going.""The solution offers a lot of data on events. It helps us create specific detection strategies.""The best functionality that you can get from Azure Sentinel is the SOAR capability. So, you can estimate any type of activity, such as when an alert was triggered or an incident was found."

More Microsoft Sentinel Pros →

"The integration is seamless with many devices and operating systems.""Splunk Enterprise Security's dashboards are a key asset.""The most valuable feature is the incident dashboard, and the extensive use of correlation searches, which isn't available with a standard Splunk search package. This feature is important to me because it enables SOC analysts to do their job more efficiently and be able to investigate or mediate incidents at a faster pace.""Splunk UBA is useful for fraud detection and for detection of APTs, advanced persistent threats.""My favorite example of improving of organization is saving a $60k/mo in payroll fraud and $10k/mo in wasted API credits by using simple searches and clear reports.""I really like the user interface and how it works.""The visibility is amazing with easy dashboard creation.""We can do things in minutes instead of days."

More Splunk Enterprise Security Pros →

"We are able to do problem determination on runaway processes.""We value the auto-host discovery, template import, bulk import/export features. Newer versions also add nice features, such as multi-IP per host.""There are lots of great features and functionality within the solution.""The solution is stable.""They've already added extra features, such as noise-canceling and facial recognition, which is great.""It not only provides the preconfigured item monitoring feature, but it is also easy to configure custom items.""Our customers also like that they don't have to use multiple modules. Micro Focus and major vendors typically require you to buy several modules and plugins. Our customers do not like that. We offer them a single product for all their monitoring needs.""Zabbix is a cost-effective solution. We're a small organization with a few dozen devices to monitor, and it was available for free. We can see what we need. We haven't done an in-depth analysis on it, but we're currently okay with the product."

More Zabbix Pros →

Cons
"Sometimes, it is hard for us to estimate the costs of Microsoft Sentinel.""Sentinel's alerts and notifications are not fully optimized for mobile devices. The overall reporting and the analytics processes for the end user should also be improved. Also, the compatibility and availability of data sources and reports are not always perfect.""Not all information shows up in Sentinel. Sometimes there are items provided in 365 and if you looked in Sentinel you would not see them and therefore think they do not exist. There can be discrepancies between Microsoft tools.""Microsoft should improve Sentinel, considering that from the legacy systems, it cannot collect logs.""Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities.""If I can use Sentinel offline at home and use it on a local network, it would be great. I'm not sure if I can use Sentinel offline versus the tools I have.""It has been a challenge with Azure Sentinel to onboard the Syslog server from FortiGate. Azure Sentinel can work better on that shift between the Syslog server and a firewall.""The solution could be more user-friendly; some query languages are required to operate it."

More Microsoft Sentinel Cons →

"The administration of the cluster and app deployment to indexers or search heads can be done only using ssh access and command line, there is no GUI tools for that.""Configuring a few apps is complex, not straightforward.""It takes time to train people.""The price has room for improvement.""We were inundated with the amount of alerts and alarms that we could get out of it. It is also a resource hog and we didn't have the resources to support it on-prem so we're taking it offline now.""The implementation and the scanning of the logs can be difficult.""The difficult part is related to integration with sources of data that are used to create the logs as this depends on the infrastructure of the client.""A problem that we had recently had was we licensed it based on how much data you upload to them every day. Something changed in one our applications, and it started generating three to four times as many logs and. So now, we are trying to assemble something with parts of the Splunk API to warn ourselves, then turn it off and throttle it back more. However it would be better if they had something systematically built into the product that if you're getting close to your license, then to shut things down."

More Splunk Enterprise Security Cons →

"There are a lot of areas for improvement, specifically in the dashboards and reports functionalities.""Zabbix isn't very good at automation just yet.""Its UI should be improved. They did some improvements in version 5, but it could benefit from some more work. Its integrations should also be improved. They've been active for one year, and they seem to have noticed that. It has new integrations, but it could benefit from more integrations. As far as I know, there is no model to push statistics, metrics, or events towards Zabbix. This type of API isn't yet there, whereas some other tools provide an API for this.""We would like to monitor other touchpoints such as ATM machines. It would be great if it can provide monitoring of ATM machines. Compatibility with other products would also be great.""The solution needs to add remote features.""I want Zabbix to improve the UX/UI. Zabbix doesn't use a JavaScript chart for images, and I want them to improve this.""I would like for this solution to be more cloud-friendly.""The System Center Operations Manager can be improved."

More Zabbix Cons →

Pricing and Cost Advice
  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

  • "Pricing and licensing is quite expensive. But for the value the product provides, it seems at par in the market."
  • "Although Splunk is an expensive product, it is designed to be utilized across your organization in order to maximize your ROI and lower your TCO."
  • "It is not cheap."
  • "Splunk Enterprise becomes extremely expensive after the 20GB/month license."
  • "You will eat up whatever you purchase quickly. The level of insights that Splunk empowers is addictive."
  • "Splunk licensing model might seem expensive but with all the gain in functionalities you will have compared to traditional SIEM solutions I think it’s worth the price."
  • "Pricing is pretty fair."
  • "While licensing can be a concern, there are ways to reduce the licensing costs including filtering some events."
  • More Splunk Enterprise Security Pricing and Cost Advice →

  • "It’s free of cost."
  • "It is a true open-source solution, so there are no licensing costs."
  • "The product is an open source and free solution."
  • "It's free software released under the GNU/GPL license."
  • "There are no licenses."
  • "We’re using the free version, which covers all our current needs."
  • "It is free, which allows us to reduce costs."
  • "I was using the free, Community Edition."
  • More Zabbix Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    771,157 professionals have used our research since 2012.
    Comparison Review
    Anonymous User
    I have researched a quite a few network monitoring tools which can be used for various monitoring purposes of not only the servers, but the intermediate routers as well. There are majorly three types of these softwares. Ones which are completely open-source, you can do almost anything you want using these, but they require quite some expertise before you can use them. Then there are the ones that are not open source, the enterprise softwares and cost you some money, but on the other hand, they are extremely easy to set-up and learn. You can have them up and running in a matter of minutes. And then there are those which are completely cloud based. They can be free of cost or charge some money depending on the software. The good thing about these is that you don’t have to install any extra software, and it can be managed completely online but then again these have limited features and you cannot exploit them to the full extent as you can do with the open-source and to some extent the enterprise software, so I won’t suggest you to use these, because these are generally not the complete solutions and require other support software to achieve the same. Below I have listed the outstanding pros and cons of the various Network analyzers that you can look into Nagios Pros: Nagios offers an extensive set of collector plug-ins that allows users to gather performance and availability data from a broad range of operating systems, including  Windows and Netware Nagios… Read more →
    Questions from the Community
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Top Answer:For tools I’d recommend:  -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is… more »
    Top Answer:Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring… more »
    Top Answer:There are a lot of third-party applications that can be installed.
    Top Answer:The template system in Zabbix is very beneficial as it saves time in configuration.
    Top Answer:Zabbix's licensing and pricing are good for our needs.
    Top Answer:To improve Zabbix, adding more features to support the monitoring of modern workloads like containers would be… more »
    Comparisons
    Also Known As
    Azure Sentinel
    Learn More
    Overview

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    Splunk Enterprise Security is a SIEM, log management, and IT operations analytics tool. The solution provides users with the ability to secure their information and manage their data in the cloud, data centers, or other applications. Splunk Enterprise Security also offers visibility from different areas, levels, and devices, rather than from a single system, thus, providing its users with flexibility. Splunk Enterprise Security can monitor data and analyze, detect, and prevent intrusions. This benefits users as it provides alerts to possible intrusions, helps users to be proactive, and reduces risk factors. 

    Full visibility across your environment

    Break down data silos and gain actionable intelligence by ingesting data from multicloud and on-premises deployments. Get full visibility to quickly detect malicious threats in your environment.

    Fast threat detection

    Defend against threats with advanced security analytics, machine learning and threat intelligence that focus detection and provide high-fidelity alerts to shorten triage times and raise true positive rates.

    Efficient investigations

    Gather all the context you need and initiate flexible investigations with security analytics at your fingertips. The built-in open and extensible data platform boosts productivity and drives down fatigue.

    Open and scalable

    Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Splunk meets you where you are on your cloud journey, and integrates across your data, tools and content.

    Zabbix is an open-source monitoring software that provides real-time monitoring and alerting for servers, networks, applications, and services. 

    It offers a wide range of features including data collection, visualization, and reporting. 

    With its user-friendly interface and customizable dashboards, Zabbix helps organizations ensure the availability and performance of their IT infrastructure.

    Sample Customers
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
    1. IBM 2. Dell 3. Cisco 4. HP 5. Oracle 6. Microsoft 7. Amazon 8. Google 9. Facebook 10. Twitter 11. LinkedIn 12. Netflix 13. Adobe 14. VMware 15. Salesforce 16. SAP 17. Intel 18. AT&T 19. Verizon 20. T-Mobile 21. Vodafone 22. Ericsson 23. Nokia 24. Siemens 25. General Electric 26. Honeywell 27. Philips 28. Sony 29. Samsung 30. LG 31. Panasonic 32. Toshiba
    Top Industries
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Manufacturing Company8%
    Comms Service Provider8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Computer Software Company20%
    Financial Services Firm15%
    Government9%
    Energy/Utilities Company8%
    VISITORS READING REVIEWS
    Financial Services Firm15%
    Computer Software Company14%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Computer Software Company24%
    Comms Service Provider10%
    Manufacturing Company7%
    Aerospace/Defense Firm7%
    VISITORS READING REVIEWS
    Educational Organization34%
    Computer Software Company12%
    Financial Services Firm6%
    Government6%
    Company Size
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise59%
    REVIEWERS
    Small Business31%
    Midsize Enterprise11%
    Large Enterprise57%
    VISITORS READING REVIEWS
    Small Business19%
    Midsize Enterprise13%
    Large Enterprise68%
    REVIEWERS
    Small Business49%
    Midsize Enterprise20%
    Large Enterprise31%
    VISITORS READING REVIEWS
    Small Business18%
    Midsize Enterprise42%
    Large Enterprise40%
    Buyer's Guide
    Security Information and Event Management (SIEM)
    April 2024
    Find out what your peers are saying about Splunk, Microsoft, Wazuh and others in Security Information and Event Management (SIEM). Updated: April 2024.
    771,157 professionals have used our research since 2012.

    Splunk Enterprise Security is ranked 1st in Security Information and Event Management (SIEM) with 240 reviews while Zabbix is ranked 1st in Network Monitoring Software with 101 reviews. Splunk Enterprise Security is rated 8.4, while Zabbix is rated 8.2. The top reviewer of Splunk Enterprise Security writes "It has a drag-and-drop interface, so you don't need to know SQL or Java to construct a query ". On the other hand, the top reviewer of Zabbix writes "Allows any number of customizations but lacks functionality for finding root causes". Splunk Enterprise Security is most compared with Wazuh, Dynatrace, IBM Security QRadar, Elastic Security and ArcSight Logger, whereas Zabbix is most compared with Centreon, Checkmk, SolarWinds NPM, Nagios Core and ManageEngine OpManager.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.