Splunk SOAR vs VMware Carbon Black Endpoint comparison

Security Orchestration Automation and Response (SOAR)

Download the complete report

Helped 825,399 peers since 2012

Categories and Ranking

Splunk SOAR

Average Rating

8.2

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (3rd)

VMware Carbon Black Endpoint

Average Rating

7.8

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (20th), Security Incident Response (1st), Endpoint Detection and Response (EDR) (15th), Ransomware Protection (4th)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Splunk SOAR is designed for Security Orchestration Automation and Response (SOAR) and holds a mindshare of 8.3%, down 9.8% compared to last year.
VMware Carbon Black Endpoint, on the other hand, focuses on Endpoint Protection Platform (EPP), holds 1.9% mindshare, down 2.5% since last year.

Security Orchestration Automation and Response (SOAR)

Endpoint Protection Platform (EPP)

Featured Reviews

Ryan Plas

SOAR Engineer at Accenture Federal Services

Offers playbook automation that helps reduce the manual and tedious work for users

When it comes to Splunk SOAR's ability to provide end-to-end visibility into our company's cloud-native environment, I would say that we are not using the cloud portions of it. I don't know if that's super relevant to what we are doing in our organization. I am 100 percent sure that Splunk SOAR helped reduce your mean time to resolve, but I don't have any metrics on hand but I know it has dramatically decreased. The tool has helped with the business resilience part. I think having it as a platform has been a solid portion of the product that we offer to people. Spunk SOAR has definitely saved my time in alert triage. When some of the tedious enrichment and lookup stuff happens, the analyst doesn't have to deal with such areas, and they can just jump in and see relevant data all in one pane of glass, which has been super helpful for speeding things up. The unified platform helps consolidate networking, security, and IT observability tools. The consolidation of tools impacts our organization as it just helps focus the SOC analyst on a single unified place to find information. It helps keep things streamlined and regular so they know where to look for certain stuff they want. It really helps people with training. It is a really easy tool to onboard people into because everything is right there in the product itself. The product is really great. I would love to see more SOAR innovation going into the tool, especially the on-premises version since it is what we use in our company. I feel the tool needs to encourage continuous improvements, but as a product itself, my company is really happy with the solution. I rate the tool an eight out of ten.

Read full review

Matthew Weisler

Sole Proprietor at Core-Infosec

Great granularity for policies or applications without needing hash values

The solution is cloud based which makes it easy to use for remote devices or work-at-home situations. The solution supports full trust or signature-based approvals. You can get very granular and band out policies or applications without having to do hash values. You can band through the entire environment by execution of the name or desk IDXE. This can be achieved on the policy side because of the signature, IOC, or naming convention itself. This is very effective for pushing more blockage or removing threats across the board. The solution has a very nice API on the back end for remoting into a system and executing scripts or utilizing self automation. This is useful for monitoring several different companies in a workspace or workbook-type format. For example, I report and send out mass emails from a clickable button in an Excel workbook. The APIs all exist for each client. I push out automatic endpoint monitoring and reports every single day at a particular time, with a simple clickable button that serves as a scheduled task for fifty clients.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"My understanding is the initial setup isn't too hard."

"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."

"Scalability is the best feature of the solution."

"The most valuable features are the Splunk SOAR apps and playbooks."

"The customizable playbook is the most valuable aspect of the solution."

"Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack."

"The most valuable feature is the risk-based access control."

"Splunk has many features that make work easier, and it's simple to implement in a large production environment. Splunk collects a massive amount of data from cloud servers and handles it perfectly."

More Splunk SOAR pros

"I like its reporting."

"The product allows us to focus on endpoint and antivirus protection."

"The solution is stable."

"It has intelligent learning behind it and we have been very successful in preventing attacks."

"The best feature of this solution is that we have a live response, which is really tailored to our needs."

"The feature I found most valuable in Carbon Black CB Defense is the ongoing monitoring feature that works by emailing updates about any detections found."

"Behavioral Monitoring stops known malicious events before they even begin."

"It is a scalable solution...The initial setup was straightforward."

More VMware Carbon Black Endpoint pros

Cons

"We've run into a few minor issues. Some of the playbook writing is a bit complicated. We've had a few hiccups with the source control. We'd really like to use GitHub deployment keys for a dedicated account. We haven't been able to do that. I think those are some of the major ones."

"There is a lot of room for improvement with the UI."

"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."

"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."

"The number of playbooks on offer should be increased."

"Some of the training materials are on a basic level."

"The algorithm and machine learning have room for improvement and can be more user-friendly."

"And most of the challenges that I have faced with the solution can be found in the documentation itself."

More Splunk SOAR cons

"Right now, Carbon Black CB Defense doesn't support cloud computing and Kubernetes."

"I would like to see the user credentials feature improved. I would also like to see more reporting features and better ways to roll the reports out."

"But here, we hardly can take any kind of a report out of Carbon Black, so I think that should be something that should be more user-friendly."

"It is difficult to extract reports for ongoing scans"

"I would like to see improvements made so that we can better see all of the processes."

"The GUI and reporting should be addressed and the product's administration features need fine tuning."

"There is room for improvement in the support and service team."

"I haven't run into anything that needs improvement. The website interface can be a little bit better, but it's still good as compared to most others."

More VMware Carbon Black Endpoint cons

Pricing and Cost Advice

"I found the price of Splunk SOAR to be good."

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"The tool is not cheap."

"The cost is high and the licensing is on an annual basis."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

"The licensing cost is reasonable."

"Splunk SOAR is more expensive compared to other options for SOAR."

More Splunk SOAR pricing and cost advice

"I am not really involved in the pricing of this product. But, from my understanding, it is OK for us."

"The product is expensive. There are some additional costs apart from the standard licensing charges attached to the solution."

"The cost is a considerable factor, but the benefit factor is the most important. When you compare it with other products, the price is high. Carbon Black will negotiate the price."

"VMware Carbon Black Endpoint is an expensive product."

"Carbon Black might be a touch more expensive than Symantec. They tend to get a premium for their capabilities. They're sort of an industry leader in a lot of areas with the functionality that they provide."

"The pricing is annually based and operates through another department than mine."

"The platform is expensive."

"The pricing is very high."

More VMware Carbon Black Endpoint pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

825,399 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

14%

Manufacturing Company

12%

Government

10%

Computer Software Company

15%

Financial Services Firm

10%

Government

10%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

What is your experience regarding pricing and costs for Splunk Phantom?

I rate Splunk SOAR two out of 10 for affordability. Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all ...

What needs improvement with Splunk Phantom?

The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginne...

What to choose: an endpoint antivirus, an EDR solution or both?

I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) security solution. The CB Predictive Security Cloud platform combines multiple hi...

What's the difference between Carbon Black CB Response and Carbon Black CB Defense?

Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoint Standard (CB Defense), and the other is the Carbon Black Endpoint Detection an...

What do you like most about Carbon Black CB Defense?

VMware Carbon Black Endpoint is a highly stable solution.

Cortex XSIAM vs Splunk SOAR

Comparisons

Compared 28% of the time

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 18% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 8% of the time

Tines vs Splunk SOAR

Compared 8% of the time

Cyware Cyber Fusion vs Splunk SOAR

Compared 1% of the time

More Splunk SOAR Competitors

CrowdStrike Falcon vs VMware Carbon Black Endpoint

Compared 15% of the time

Microsoft Defender for Endpoint vs VMware Carbon Black Endpoint

Compared 15% of the time

Trellix Endpoint Security vs VMware Carbon Black Endpoint

Compared 9% of the time

SentinelOne Singularity Complete vs VMware Carbon Black Endpoint

Compared 9% of the time

Trend Micro Deep Security vs VMware Carbon Black Endpoint

Compared 8% of the time

More VMware Carbon Black Endpoint Competitors

Product Reports

Splunk SOAR

Download Splunk SOAR product report

VMware Carbon Black Endpoint

Download VMware Carbon Black Endpoint product report

Also Known As

Phantom

Carbon Black CB Defense, Bit9, Confer

Learn More

Splunk

VMware

Overview

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

VMware Carbon Black Endpoint provides comprehensive endpoint security against ransomware, spyware, malware, and viruses, catering to both cloud and on-premise environments.

VMware Carbon Black Endpoint facilitates endpoint detection and response, threat hunting, application control, antivirus support, and protection for virtual and physical machines. Features include intelligent learning, whitelisting, and integration with other security tools, making it suitable for distributors, MSPs, and enterprises seeking advanced threat defense and real-time monitoring. With its capability to detect and stop malicious executables, it supports both offline and online environments and offers tools like command shell access for deeper investigation.

What are the key features of VMware Carbon Black Endpoint?

Intelligent learning: Improves detection capabilities over time.
Whitelisting: Allows only approved applications to run.
Integration with other security tools: Enhances overall security posture.
Centralized cloud control: Manages endpoints from a single interface.
Command shell access: Offers deeper investigation capabilities.
Dynamic grouping: Facilitates organized endpoint management.
Simplified policy management: Streamlines security policy implementation.
API for system remoting: Allows remote system access and management.
Twenty-four-seven support: Provides continuous assistance and response.

What are the benefits of VMware Carbon Black Endpoint?

Real-time monitoring: Offers constant vigilance against threats.
Threat hunting: Identifies and mitigates threats proactively.
Historical data analysis: Assists in understanding past incidents and patterns.
Improved endpoint protection: Enhances overall endpoint security.
Enhanced threat detection: Reduces exposure to advanced threats.

VMware Carbon Black Endpoint is implemented across various industries including technology, healthcare, and finance. Organizations utilize it in cloud and hybrid environments, enhancing their security frameworks with real-time monitoring, intelligent learning, and robust threat detection capabilities tailored to their specific industry needs.

Sample Customers

Recorded Future, Blackstone

Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America

Security Orchestration Automation and Response (SOAR)