Splunk SOAR vs VMware Carbon Black Endpoint comparison

The compared Splunk and VMware solutions aren't in the same category. Splunk is ranked #3 in SOAR , with an average rating of 8.1, and holds a 8.8% mindshare in the category. VMware is ranked #18 in EPP , with an average rating of 7.7, and holds a 2.0% mindshare. Additionally, 87% of Splunk users are willing to recommend the solution, compared to 88% of VMware users who would recommend it.

Splunk SOAR

Read 43 Splunk SOAR reviews

5,505 Views
3,291 Comparison Views

87% willing to recommend

VMware Carbon Black Endpoint

Read 63 VMware Carbon Black Endpoint reviews

8,623 Views
5,732 Comparison Views

88% willing to recommend

Splunk SOAR

VMware Carbon Black Endpoint

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 4, 2024

VMware Carbon Black Endpoint and Splunk SOAR are both leading solutions in cybersecurity. Users report that Splunk SOAR's advanced features provide more comprehensive security coverage, making it a superior choice despite higher costs.

Features: VMware Carbon Black Endpoint is praised for its real-time threat detection, response capabilities, and user-friendly interface. Splunk SOAR stands out for its extensive automation features, seamless integration with various third-party tools, and powerful analytics.

Room for Improvement: VMware Carbon Black Endpoint users desire better integration with other security tools, enhancements in reporting capabilities, and improved customer support. Splunk SOAR users suggest improvements in product stability, more extensive documentation, and a less steep learning curve for new users.

Ease of Deployment and Customer Service: VMware Carbon Black Endpoint users appreciate the straightforward deployment process but experience mixed feedback on customer service. Splunk SOAR users find the deployment more complex but commend the responsive and helpful customer service.

Pricing and ROI: VMware Carbon Black Endpoint is noted for competitive pricing, providing good value for the cost. Splunk SOAR, while more expensive, is seen as worth the investment due to its powerful automation capabilities.

To learn more, read our detailed Security Orchestration Automation and Response (SOAR) Report (Updated: November 2024).

Buyer's Guide

Security Orchestration Automation and Response (SOAR)

November 2024

Download the complete report

Helped 814,763 peers since 2012

Categories and Ranking

Splunk SOAR

Average Rating

8.2

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (3rd)

VMware Carbon Black Endpoint

Average Rating

7.8

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (18th), Security Incident Response (1st), Endpoint Detection and Response (EDR) (15th), Ransomware Protection (4th)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Splunk SOAR is designed for Security Orchestration Automation and Response (SOAR) and holds a mindshare of 8.8%, down 9.8% compared to last year.
VMware Carbon Black Endpoint, on the other hand, focuses on Endpoint Protection Platform (EPP), holds 2.0% mindshare, down 2.6% since last year.

Security Orchestration Automation and Response (SOAR)

Endpoint Protection Platform (EPP)

Featured Reviews

Ryan Plas

SOAR Engineer at Accenture Federal Services

Jun 12, 2024

Offers playbook automation that helps reduce the manual and tedious work for users

When it comes to Splunk SOAR's ability to provide end-to-end visibility into our company's cloud-native environment, I would say that we are not using the cloud portions of it. I don't know if that's super relevant to what we are doing in our organization. I am 100 percent sure that Splunk SOAR helped reduce your mean time to resolve, but I don't have any metrics on hand but I know it has dramatically decreased. The tool has helped with the business resilience part. I think having it as a platform has been a solid portion of the product that we offer to people. Spunk SOAR has definitely saved my time in alert triage. When some of the tedious enrichment and lookup stuff happens, the analyst doesn't have to deal with such areas, and they can just jump in and see relevant data all in one pane of glass, which has been super helpful for speeding things up. The unified platform helps consolidate networking, security, and IT observability tools. The consolidation of tools impacts our organization as it just helps focus the SOC analyst on a single unified place to find information. It helps keep things streamlined and regular so they know where to look for certain stuff they want. It really helps people with training. It is a really easy tool to onboard people into because everything is right there in the product itself. The product is really great. I would love to see more SOAR innovation going into the tool, especially the on-premises version since it is what we use in our company. I feel the tool needs to encourage continuous improvements, but as a product itself, my company is really happy with the solution. I rate the tool an eight out of ten.

Read full review

Durai Singh

Business Owner at Ararat Technologies

Oct 25, 2023

The solution is expensive, support is poor, and it takes time to understand the product

Customers want solutions that provide endpoint detection and response. The traditional antivirus solutions and the market trend are changing. Customers are asking for the latest technologies. Carbon Black has very good market strategies. We do the marketing activities and promote the product to the…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The customizable playbook is the most valuable aspect of the solution."

"Splunk integrates with so many products. It provides us with good information for us to be able to do our jobs."

"So far, the interface is very easy to use."

"The customization continues to be excellent."

"Its ability to integrate with other systems and applications in our environment is pretty easy. Sometimes if we see any complexity we try to involve a consultant to help us. Everything is through the built-in app. Splunk can connect to any assets through the built-in app. It could be in a platform, firewalls, or endpoints. It's easy if it's an app integration."

"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."

"The most valuable feature is the API connector, depending on how it's formatted and who made the actual app offering for it. The REST API is my favorite component. It's very easy to use. The filters are also really valuable. Those are the two primary features but I enjoy using the rest of it."

"My understanding is the initial setup isn't too hard."

More Splunk SOAR pros

"For Carbon Black Endpoint, the possibility of integration with different other software's log servers is the important thing. Having just one point of view is more interesting so you don't need to go to different places to see all the information."

"The product allows us to focus on endpoint and antivirus protection."

"You can deploy it through the cloud so that even if your stuff is outside of your controlled environment, you are still under control, based on the policies you create. The policies are controlled through the cloud. For example, if I don't allow anyone to do a certain activity or to install a particular app, and a consultant or a partner who is not part of our environment is doing so, it will stop them as well."

"The triage feature that shows you the whole chain of the malware is useful."

"It uses machine learning and behavioral analytics for advanced threat detection and response."

"Carbon Black Cb Defense has a nice component called Alert Triage. It contains full details of the process execution "kill chain" and "go live" for immediate remediation."

"The whole purpose of the product, like application control, is very good, and also if you need to update some policies, it works well and instantly."

"It is a very complete platform."

More VMware Carbon Black Endpoint pros

Cons

"While there have been improvements to the investigation process, particularly with the playbook data, the current log review method is cumbersome."

"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."

"We want to see improvements made to the APIs such that we can connect to many different systems and data sources."

"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."

"Splunk SOAR can improve IoT/OT security-related case studies or your use cases. Their integration with identity and access management (IAM) solutions is a bit shaky. They don't have good integration with a lot of IAM solutions. They do have good capability in terms of user access management internally, but even with privileged user access, they have a good module. However, if they have to integrate with solutions, such as CyberArk or IBM IAM solutions they are lacking, the visibility of user access is not that much."

"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."

"Improving the integration ecosystem can raise the quality of the bottom tier of the integrations so that they can work better out of the box."

"It would be ideal for us if Splunk SOAR could integrate with Teams."

More Splunk SOAR cons

"It would be nice to have additional forensic tools that you can build into the back end."

"Right now, Carbon Black CB Defense doesn't support cloud computing and Kubernetes."

"I would like to see the user credentials feature improved. I would also like to see more reporting features and better ways to roll the reports out."

"It is difficult to extract reports for ongoing scans"

"The product's reporting capabilities are an area of concern where improvements are required."

"I would like to see improvements made so that we can better see all of the processes."

"The endpoint machines need improvement."

"The directions for Splunk are spot on, but it is difficult to find anything on integration with AlienVault,"

More VMware Carbon Black Endpoint cons

Pricing and Cost Advice

"It's very overpriced because it is based on the number of users. There is no bulk licensing."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

"I don't know the exact price, but for my region, it is very expensive."

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"The licensing cost is reasonable."

"I found the price of Splunk SOAR to be good."

"The cost is high and the licensing is on an annual basis."

More Splunk SOAR pricing and cost advice

"The solution has almost the same price as other different kinds of infrastructures, but it offers a lot of different features."

"The licensing cost is on the more expensive side, but I thought it was worth it because they did a good job. It was one of the vendors I truly didn't have to worry about too much until this latest upgrade."

"The product’s price is less expensive than other vendors."

"In terms of licensing costs, Carbon Black CB Defense was all associated with CROW and the services my company is using with them, so it came all-inclusive."

"VMware Carbon Black Endpoint is an expensive product."

"The cost is a considerable factor, but the benefit factor is the most important. When you compare it with other products, the price is high. Carbon Black will negotiate the price."

"Its pricing was very good, which is one of the reasons I went to it as an alternative. It is on a yearly basis. There are no additional fees."

"This is a really expensive product and we pay licensing fees on a yearly basis."

More VMware Carbon Black Endpoint pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

814,763 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

15%

Financial Services Firm

13%

Manufacturing Company

11%

Government

Computer Software Company

15%

Financial Services Firm

10%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

I rate Splunk SOAR two out of 10 for affordability. Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all ...

See all answers

What needs improvement with Splunk Phantom?

The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginne...

See all answers

What to choose: an endpoint antivirus, an EDR solution or both?

I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) security solution. The CB Predictive Security Cloud platform combines multiple hi...

See all answers

What's the difference between Carbon Black CB Response and Carbon Black CB Defense?

Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoint Standard (CB Defense), and the other is the Carbon Black Endpoint Detection an...

See all answers

What do you like most about Carbon Black CB Defense?

VMware Carbon Black Endpoint is a highly stable solution.

See all answers

Comparisons

Cortex XSIAM vs Splunk SOAR

Compared 26% of the time

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 20% of the time

ServiceNow Security Operations vs Splunk SOAR

Compared 8% of the time

Tines vs Splunk SOAR

Compared 8% of the time

Torq vs Splunk SOAR

Compared 7% of the time

More Splunk SOAR Competitors

CrowdStrike Falcon vs VMware Carbon Black Endpoint

Compared 18% of the time

Microsoft Defender for Endpoint vs VMware Carbon Black Endpoint

Compared 14% of the time

SentinelOne Singularity Complete vs VMware Carbon Black Endpoint

Compared 8% of the time

Trellix Endpoint Security vs VMware Carbon Black Endpoint

Compared 8% of the time

Trend Micro Deep Security vs VMware Carbon Black Endpoint

Compared 7% of the time

More VMware Carbon Black Endpoint Competitors

Product Reports

Buyer's Guide

Splunk SOAR

October 2024

Download Splunk SOAR product report

Buyer's Guide

VMware Carbon Black Endpoint

October 2024

Download VMware Carbon Black Endpoint product report

Also Known As

Phantom

Carbon Black CB Defense, Bit9, Confer

Learn More

Splunk

VMware

Overview

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

VMware Carbon Black Endpoint provides comprehensive endpoint security against ransomware, spyware, malware, and viruses, catering to both cloud and on-premise environments.

VMware Carbon Black Endpoint facilitates endpoint detection and response, threat hunting, application control, antivirus support, and protection for virtual and physical machines. Features include intelligent learning, whitelisting, and integration with other security tools, making it suitable for distributors, MSPs, and enterprises seeking advanced threat defense and real-time monitoring. With its capability to detect and stop malicious executables, it supports both offline and online environments and offers tools like command shell access for deeper investigation.

What are the key features of VMware Carbon Black Endpoint?

Intelligent learning: Improves detection capabilities over time.
Whitelisting: Allows only approved applications to run.
Integration with other security tools: Enhances overall security posture.
Centralized cloud control: Manages endpoints from a single interface.
Command shell access: Offers deeper investigation capabilities.
Dynamic grouping: Facilitates organized endpoint management.
Simplified policy management: Streamlines security policy implementation.
API for system remoting: Allows remote system access and management.
Twenty-four-seven support: Provides continuous assistance and response.

What are the benefits of VMware Carbon Black Endpoint?

Real-time monitoring: Offers constant vigilance against threats.
Threat hunting: Identifies and mitigates threats proactively.
Historical data analysis: Assists in understanding past incidents and patterns.
Improved endpoint protection: Enhances overall endpoint security.
Enhanced threat detection: Reduces exposure to advanced threats.

VMware Carbon Black Endpoint is implemented across various industries including technology, healthcare, and finance. Organizations utilize it in cloud and hybrid environments, enhancing their security frameworks with real-time monitoring, intelligent learning, and robust threat detection capabilities tailored to their specific industry needs.

Sample Customers

Recorded Future, Blackstone

Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America

Buyer's Guide

Security Orchestration Automation and Response (SOAR)

November 2024

Download Free Report

Find out what your peers are saying about Microsoft, Palo Alto Networks, Splunk and others in Security Orchestration Automation and Response (SOAR). Updated: November 2024.

DOWNLOAD NOW

814,763 professionals have used our research since 2012.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.