Splunk Enterprise Security Reviews

Our main use cases for Splunk Enterprise Security include security, detection, and incident response.

The data model benefits our organization by making it easy for the team to get data into Splunk, and field tagging is particularly helpful.

The features of Splunk Enterprise Security that I most appreciate are CIM, the data model, the search capabilities, and the investigation feature embedded into Splunk version 8.

The investigation feature helps the team seamlessly put everything together, providing a consistent view of all relevant artifacts for incidents.

Splunk's ability to predict, identify, and solve problems in real-time is exceptional due to its ease of data ingestion and comprehensive search capabilities with various options.

I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be excellent, especially with the new Mission Control included in Splunk Cloud version 8. It is really easy to use.

We are sending data directly to Splunk Cloud without any broker or pipeline in between. Our organization does not use risk-based alerting in Splunk Enterprise Security yet, and our SecOps team has not measured incident remediation times compared to our previous solution.

I would advise other organizations considering Splunk Enterprise Security to check their business case, considering the number of systems and amount of data to determine if it is the right tool in terms of the licensing model. If they decide to implement Splunk Enterprise Security, getting professional support is crucial.

One of our decision drivers was the customer support, which we found to be very responsive based on feedback from other customers. Additionally, the ability to extend the license for IT-related topics provides flexibility to leverage the platform across all departments, not just security - a unique feature compared to other SIEM tools.

Splunk Enterprise Security can be improved with better triage capability and less dependency on running SPL searches, which would allow analysts who may not have much experience in writing SPL searches to still use the tool and run investigations.

We are still at the beginning, just four months into using Splunk Enterprise Security.

I assess the stability and reliability of Splunk Enterprise Security as generally good. We had a few glitches, but nothing serious, and when we needed to raise cases with the support team, they were quickly resolved, particularly an issue on the indexer level.

Splunk Enterprise Security scales effectively with our growing needs. As a global organization, we first started with three regions, and when we were about to move to include the last region, it was easy to increase the license and onboard the new region seamlessly.

I would evaluate customer service and technical support for Splunk Enterprise Security as excellent, particularly our sales representative, who is exceptional. On a scale of one to ten, I would rate customer service and technical support as a nine.

Prior to adopting Splunk Enterprise Security, we were using QRadar from IBM, but we wanted a modern and state-of-the-art SIEM, which led us to choose Splunk Enterprise Security.

The deployment was the best that I have gone through so far. We had the professional support, which is something I recommend everyone do, which is like introducing Splunk and having the Splunk professional support personnel advising and supporting through the implementation phase.

We had professional support, which I recommend to everyone introducing Splunk Enterprise Security, to have professional support advising and supporting them through the implementation phase.

The return on investment from Splunk Enterprise Security is still to come.

My experience with pricing, setup cost, and licensing for Splunk Enterprise Security was positive. We had an excellent sales representative. The licensing model was fair and good compared to other tools we evaluated. The storage-based licensing was the best model that fit our requirements, though it may change as we evolve and ingest more data.

I rate this product seven out of ten. Nothing is perfect, and there is still room for improvement.

Splunk Enterprise Security serves as our security tool, specifically functioning as a SIEM product.

Splunk Enterprise Security's best features include scalability, reliability, and extensive integrations.

The RBA in Splunk Enterprise Security helps us considerably because there are rules that we cannot turn off, but they are spammy rules that we can whitelist. We group them as intermediate findings, making this risk score useful. It saves us time because instead of working on 1,000 alerts per day, we focus on two or three alerts and simply review their impact on our organization.

With Splunk Enterprise Security and our SOC team, we have developed custom rules that adjust the risk scores based on our observations, not merely Splunk's recommendations. It helps considerably because it groups the alerts, gives us information about related alerts, and provides excellent features such as drill-down searches and dashboards, which save our time and decrease mean time to respond and mean time to detect.

Overall, Splunk Enterprise Security has reduced our MTTR by approximately 30%. That reduction applies to both response and detection.

Our dashboards and visualizations in Splunk Enterprise Security communicate our security posture to executives effectively, as they are more interested in numbers and money saved rather than technical details. The visualizations allow us to present why they spend money on this solution, and we can create engaging visual stories for them based on the dashboards.

The area for improvement with Splunk Enterprise Security is support.

The knowledge base could also be improved.

Beyond support, the pricing tier of Splunk Enterprise Security could be better, as it is an expensive solution; however, the cost reflects the value delivered.

I have been using Splunk Enterprise Security for more than eight years.

For stability, I give it a ten.

In terms of scalability, I also rate it a ten.

On a scale from 1 to 10, I rate support for Splunk Enterprise Security at a six.

My experience deploying Splunk Enterprise Security is straightforward; I am a certified Splunk architect, which is the highest certification. Based on the documentation, it is easy for non-distributed deployments, but it can be challenging for others with larger infrastructures.

In terms of deployment time for Splunk Enterprise Security, it takes approximately 15 minutes.

For my clients, there are over 200 people using Splunk Enterprise Security.

In my company, we have approximately 30 specialists.

Regarding Splunk Enterprise Security deployment, we utilize both on-premises and cloud setups.

The return on investment we see from Splunk Enterprise Security is not straightforward, as it depends on the company; some may not have alerts or impacts, while others, when detecting critical alerts or threats, may realize it has saved them a million dollars. Overall, I estimate the ROI to be approximately 20% to 30%.

When comparing Splunk Enterprise Security with other security solutions, I find it to be the best as it consolidates everything in one place. They have updated it with endpoint security and admission control capabilities, allowing you to see every comment and action during an incident, which I have not seen in other solutions such as Elastic, Sumo Logic, or LogRhythm.

Since we do not work with UEBA in Splunk Enterprise Security, I cannot comment on any improvements in threat hunting and investigations. I have seen demos of it, and while it is a remarkable solution, I cannot personally answer that question. I provide this review with an overall rating of 10.

The clients who are using Splunk Enterprise Security are primarily using it for security as a SIEM solution, or they are also using Splunk Observability.

Generally, when you have the complete set of solutions such as EDR or DLP and then on top of it, if you have a solution such as SIEM, which is collecting logs and everything and then correlating that particular data, it takes somewhere around five to ten minutes to identify and start working on that particular issue.

The biggest advantage, if I talk about for observability, is ease of use. The customers use OTEL collectors, and since this is an open OTEL collector, it is not bound to Splunk itself. That is something which is good.

Customization requires good effort, but it is doable. We being into professional services, we do this particular part. Splunk Enterprise Security provides flexibility to write those rules and regular expressions and other tools, wherein you can filter the traffic based on different kinds of policies.

It definitely helps because when you use different sets of solutions which work on SNMP, they will only poll that data and then they will collect and provide you some information on top of it. Splunk collects much more data as compared to traditional SNMP related tools. Log traces will eventually provide you much better and true information on which you can take actionable actions on top of it. With respect to unified security operations, it helps to consolidate both SIEM and SOAR so that you can quickly detect, investigate and neutralize cyber threats. They can integrate with third-party SOAR solution as well as they have internal capabilities for SOAR.

Cost is one major factor. The reason is because they primarily work on the ingestion of data, wherein it becomes a choice for large customers who have deep pockets to spend money on Splunk Enterprise Security. If the customer does not have that much budget, then obviously they will not go for Splunk Enterprise Security. They will go for a similar set of solution such as Elastic in that case. Cost is something which is a major factor.

In integrations, a good amount of integrations are already available, but integration with newer AI components or tools and upcoming tools such as Claude or ChatGPT will obviously take some more time to evolve perfectly so that these tools become more easy to use and align to an organization's environment.

I have been using the solution for somewhere around four years.

Splunk Enterprise Security is a stable product.

Splunk Enterprise Security is scalable. You can horizontally expand it with forwarders and universal forwarders. It's scalable.

We have been in business for the last eight years. Before partnership with Splunk, we have been working with Broadcom. Now we are also working with Elastic.

The initial setup is straightforward and not that complex. Initially, you will struggle, but once you are done with one or two installations, then it is pretty straightforward.

I am an implementation partner and not a direct customer of Splunk. I do implementation work.

With respect to Splunk Enterprise Security ROI, it is a costly solution. It is not something which can be adopted by every organization. Splunk Enterprise Security needs to come up with something different. When we speak to Splunk representatives, they boast about being a costly solution, but that does not make any sense because if you are not able to fit yourself with the customer and Datadog or Elastic is competing with you, then that is one part which they need to address. Rather than positioning themselves as a costly solution, they should work on something which can actually fit the customers as well as provide implementation partners like us with opportunities to work on certain projects. With respect to ROI, it takes a good amount of time because by the time you get the product installed in your environment, you start using it and you realize how much data needs to be ingested and then you fine-tune them. I think it takes a good amount of time because by that time, Splunk will take a good amount of licensing cost from the customer.

We are using other security tools. We are using API security, Symantec products for different customers, or CrowdStrike EDR. We generally ingest logs from all these different solutions, logs, metrics and traces from these solutions into Splunk Enterprise Security.

We are also using Elastic. The main part is for smaller customers or a limited set of customers, Elastic provides the community version. You can go and install the community version and seventy to eighty percent of the features are available, and the customer can start using it. They don't intend to use Splunk Enterprise Security in that case because that's free, and only a nominal services fee will be charged from these kinds of customers. Elastic also has the observability as well as the ELK stack, Kibana, dashboards and other tools. That part does not make too much of a difference. The major difference between both of the products is obviously pricing.

Splunk Enterprise Security is the most significant challenge. I rate this product at nine out of ten.

At the moment, we are using Splunk ITSI (IT Service Intelligence) with Splunk Enterprise Security suite solution to create the use cases. We have criteria to create use cases in such a way that as soon as we receive a request from a customer or internally, we need to see based on the MITRE ATT&CK frameworks and techniques and tactics. Based on that, we are going to create use cases in Enterprise Security. We will consider a few things, such as what the severity is and what it is based on the group, whether it is end-user support or application support. Based on that, we will create the urgency and all.

The favorite features of Splunk ITSI (IT Service Intelligence) include the ability to define the risk score and understand how much priority we can assign. We can also define priority as critical, low, medium, or high. We can also give some filtering options during the execution time, such as filters, throttling, and mapping the fields by grouping the name and grouping the fields. Additionally, we have the feasibility to give a direct ticket to ServiceNow integration. It will create a ticket and assign it to somebody who is responsible to work on it. We are having some very good things with this solution.

Splunk ITSI (IT Service Intelligence) correlation what we are trying to do has missed a few features from the earlier versions. We previously had a chance to give complete descriptions of a particular thing and whether it is mandatory or not. However, in the new version, we are seeing something like a risk score that needs to be defined for any use case we are creating. I think that is not mandatory, but also in some areas we cannot define the risk score. At those times, in those cases, we are keeping the risk score as nominal, like one to ten. Because of that mandatory field, we are giving some wrong information to the end list.

I am using it in my career for six years.

I have never seen instability, lagging, crashing, or downtime throughout my experience with Splunk ITSI (IT Service Intelligence). We work on all production servers and production environment. We have scheduled operations, maintenance operations, and maintenance windows. During that time only, we will see if they are trying to do any activity or if they want to perform any shutdown. They plan accordingly and guide us before they are planning for it.

Splunk ITSI (IT Service Intelligence) has a good feature for scalability. We can scale it very quickly, and it is very helpful for an organization to scale up. It is having that feature and it is a very good feature.

I contacted technical support for Splunk ITSI (IT Service Intelligence). I have worked on both areas, on-premises and the cloud environment. For on-premises, based on the priority of the case, they address the issue. For the cloud environment, they will prioritize the case and give quick service.

Positive

During the initial setup a few days and a few months when I first started using Splunk ITSI (IT Service Intelligence), it was overall understandable. If somebody does not know about it, they can learn it very quickly and they can adapt to the technology.

For deployment of Splunk ITSI (IT Service Intelligence), we require two to three people based on the environment and the size of the environment. It is preferred to have two persons.

From a pricing point of view, Splunk ITSI (IT Service Intelligence) is a bit high. I was seeing one of my customers, an old customer, who are moving from Splunk ITSI (IT Service Intelligence) to other tools. The tool is Cortex XDR SIM. It is all because of the pricing. Other than the big organizations, if somebody in a small company or small to medium company wants to use Splunk ITSI (IT Service Intelligence) facilities, they are very much afraid of it because of the pricing. Also, the people who are already using Splunk ITSI (IT Service Intelligence) as a solution are checking for alternatives. For example, one of the other clients moved to another SIEM solution because of the pricing itself. It is comparatively more, and they need to think about this pricing.

I have familiarity with QRadar and SIM Nitro as alternatives to Splunk ITSI (IT Service Intelligence). I can compare QRadar with Splunk ITSI (IT Service Intelligence). My opinion is that Splunk ITSI (IT Service Intelligence) is the better one. Comparatively, I have used three SIEM tools, but Splunk has more visibility. As a Splunk engineer, we have the feasibility to integrate a lot of logs from different log sources and we can parse them. We can create custom rules. All of this provides very good visibility on Splunk ITSI (IT Service Intelligence). Log availability is also a very good thing. Splunk ITSI (IT Service Intelligence) has very good capability of storing, analyzing, and searching compared to other tools. We can create knowledge objects, such as dashboards, which is very much useful to review what we have in the system and also we can present it to somebody who is not much aware of the system. In QRadar, we do not have much scope to work on. In Splunk ITSI (IT Service Intelligence), we have a lot of things during the integration time. We have a lot of scope and also parsing, and also then utilizing the logs by creating use cases and alerts, reports, and dashboards.

My overall experience is eight years, and relevant to this field is six years. Whenever any new add-ons and integrations we are doing, we actually need to upgrade ourselves. We recently had an upgrade of utilizing Python scripting for scripting. For on-premises Splunk ITSI (IT Service Intelligence), I would give six out of ten. For the cloud solution, I would give nine out of ten. For the overall score for the support of Splunk ITSI (IT Service Intelligence), I will give seven out of ten. I am a customer of Splunk ITSI (IT Service Intelligence). I am continuing to learn on Splunk things based on different platforms, Linux, Windows, and also on cloud. So far it has been so good. It is a good journey and I am feeling positive about it. Splunk ITSI (IT Service Intelligence) is very understandable. Everybody says Splunk is a complex environment, but it is not much complex. We can adapt and we can quickly learn if anybody is starting a new journey on Splunk ITSI (IT Service Intelligence). I have thoughts on legal statements and the process of creating an account. My overall review rating for Splunk ITSI (IT Service Intelligence) is nine out of ten.

Splunk Enterprise Security is primarily a security solution used for device monitoring. If there is any suspicious activity happening, Cisco will capture that and get you the alert, then your SOC team can analyze the issue and take necessary action to avoid the breach.

Analysis is the first point when suggesting the best features of Splunk Enterprise Security.

I think the firewall and all these network devices and security devices—routers, switches—they all need to be connected to Splunk Enterprise Security in some way, so that it can get the data from all these devices, and then SIEM can analyze that data and get us the alert. There are a few tools such as Snowflake Security Data Lake which integrates with Splunk Enterprise Security, and Splunk Enterprise Security has its own security data lake. There are multiple tools that integrate with Splunk Enterprise Security.

In the context of risk-based alerting in Splunk Enterprise Security, company-wise, they have different policies, but risk-based alerting is definitely a great feature that multiple customers utilize.

I think the product is very good. It is a leader in its category. We have majorly utilized Splunk Enterprise Security in SIEM and SOAR use cases, and the product is top-notch, with no problems. The only challenge I was getting to know earlier was the resource crunch. The training and enablement was very limited, but post-Cisco acquisition, it is now quite easy because Cisco has a different outlook for partner enablement and partner management. They provide a plethora of free-of-cost training and enablement, and their solution engineers are available over the call for any kind of consultation, which was not very convenient before the acquisition. This is a clear call-out for me.

I am talking about the learning curve of the product. Your product adoption improves once you have the trained resources in the market, but if you don't have trained resources, then they will make mistakes in the implementation and deployment, and then people see that. If there are limited resources in the market, they will be very costly. Whoever is on that particular technology will not be affordable, and that also decreases the chance of the company to grow.

I am overall satisfied with how the dashboard is arranged. There is a lot of flexibility in the dashboard, the number of integrations that it provides, the level of accuracy, and the sensitivity level. I think these are the important things.

The workflow is good, and I think they keep improvising it. There is not a specific comment on that regarding how important this feature is and how it supports the overall workflow.

On average, the time my SecOps team takes to remediate security incidents with Splunk Enterprise Security is certainly less compared to previous solutions. In that case, I would rate Splunk Enterprise Security as the highest SIEM solution. Their SOAR solution is also quite competent.

As for currently using any new threat detection features in Splunk Enterprise Security, I mention Mandiant and VirusTotal, and then Cyber, which are a couple of tools that multiple customers, different customers, use.

It is tough to say which features would be included in future updates of Splunk Enterprise Security. I think it will keep growing. Maybe if they incorporate generative AI, I think AI is already there, but if they incorporate generative AI in terms of tracking the issues, automatic resolutions, and some root cause analysis, and I think threat intelligence, something using GenAI providing information on threat intelligence, that would also add value.

The workflow is good, and I think they keep improvising it. There is not a specific comment on that regarding how important this feature is and how it supports the overall workflow.

I have 12-plus years in software and IT.

My thoughts about the technical support of Splunk Enterprise Security is that they are good, but I think there are complaints about support sometimes. However, it is the same with every other player. I would say it is not so bad, but there could be improvements.

Negative

It depends on the volume of deployment for Splunk Enterprise Security. A bigger organization needs a month of time for different things: running some POCs in the beginning, understanding the environment complexities, the number of integrations, and if that integration requires some kind of development, how many legacy applications need to be integrated. The time varies depending on the scope of work. A couple of months for a large enterprise can take almost a month. Organizations have to migrate data also. If they are using some existing solution, that data needs to be migrated, and all those checks and balances will take time.

That depends on the size of the project, but I think maybe five to six resources, at least, are usually involved in deployment from my side.

I believe it is beneficial in terms of finance to use Splunk Enterprise Security, as enterprises are realizing the value, and the ROI is also good.

I think the licensing costs for Splunk Enterprise Security are on the higher side, but I am not certain. I have not done a thorough analysis—six months back I left this Splunk partnership. I think they are still affordable to some of the very demanding enterprises. However, the mid-market and startups may struggle, because it is a very premium, enterprise-based solution. The price is also very premium. Comparing it with Microsoft Defender and the Microsoft SIEM solution, I think in terms of pricing, they are very neck-and-neck. The pricing is also good. If they can offer a slight level of discount, that can enhance their ability to reach price-sensitive customers.

Product adoption improves once you have the trained resources in the market, but if you do not have trained resources, then they will make mistakes in the implementation and deployment, and then people see that. If there are limited resources in the market, they will be very costly. Whoever is on that particular technology will not be affordable, and that also decreases the chance of the company to grow.

Splunk Enterprise Security gives us the foundation for collecting, indexing, and analyzing data, while Splunk Enterprise Security adds more security-specific capabilities like threat detection, correlation search, risk analysis, and investigation workflows. We use it to monitor security events from different sources such as authentication systems, endpoint, and network devices. It helps us identify suspicious behavior, prioritize notable events, and investigate incidents more efficiently. The advantage is that we can still customize detection and dashboards based on our environment instead of only depending on different tools.

The best feature of Splunk Enterprise Security is the flexibility it provides when working with different types of machine data. One feature I really appreciate is SPL, or Search Processing Language, because it allows us to investigate data in a very detailed way; we can start from a simple search and gradually build more advanced queries to find patterns, troubleshoot problems, or identify unusual activities. Another valuable feature is the customization capability, allowing us to create our own dashboards, alerts, and reports based on exactly what our team needs instead of depending only on predefined templates. I also appreciate the data onboarding flexibility as Splunk can handle many different log formats, and we can decide how data is indexed, retained, and analyzed based on our requirements.

Splunk Enterprise Security's security customization capability is one of the areas where I find it very strong. From a security perspective, every organization has different requirements, and Splunk Enterprise Security allows us to build detection logic based on our own environments instead of depending only on fixed rules. For example, we can create custom SPL search and correlation rules, alerts, and dashboards to monitor specific activities such as unusual login behavior, system changes, or suspicious events. I also appreciate that we can combine data from multiple sources such as servers, network devices, and security tools to create a complete investigation workflow. The flexibility of customized search and security monitoring based on real business needs is one of the biggest advantages of Splunk Enterprise Security.

Splunk Enterprise Security is a very mature platform, but there are a few areas where I think it can improve. One area is administration and configuration simplicity; since Splunk Enterprise gives a lot of control, managing components such as indexers, search heads, configuration, and upgrades can become complex, especially for new teams. More automation around administration would help. Another improvement area is resource optimization. When dealing with very large data volumes, search and storage require proper tuning, so more built-in recommendations for performance optimization would make it easier. I would also appreciate more AI-assisted capabilities, especially for creating SPL queries, tuning alerts, and suggesting improvements automatically. Overall, the flexibility is excellent, but making management and optimization easier would improve the experience.

I have been using Splunk Enterprise Security for around 1.5 years, and during this time, I work mainly for log analysis, monitoring, and troubleshooting different systems.

I would rate the stability of Splunk Enterprise Security around nine out of ten; in my experience, it is a very stable and reliable platform, especially when the architecture is designed properly. Once components such as indexers, search heads, and forwarders are configured correctly, it runs consistently without frequent issues and handles continuous data ingestion and searches very well, even with large amounts of machine data. The reason I would not give a ten is that stability also depends on proper maintenance, resource allocation, and configuration tuning. If searches are not optimized or the infrastructure is not sized correctly, performance issues can occur. But overall, for an enterprise environment, it is a very dependable solution.

We have around 40 to 50 active users of Splunk Enterprise Security, and the users are mainly from different teams such as security operations, infrastructure, application support, and the engineering team. Not every user uses it in the same way; some mainly view dashboards and reports, while analysts and engineers use it more deeply for SPL search, troubleshooting, investigation, and creating alerts. We manage access based on roles, so different teams get permission and data visibility according to their needs.

I would rate technical support around nine; overall, the support experience has been good. The support team is knowledgeable, especially when dealing with complex topics such as indexing issues, search performance, configuration problems, or distributed development troubleshooting. The documentation from the Splunk community is also very strong, allowing many common issues to be resolved quickly. The reason I would not give a full ten is that for some advanced technical issues, especially in environment-specific problems, it sometimes takes multiple decisions or escalations to reach the final solution. But the overall quality of support and technical expertise is reliable.

I have compared Splunk Enterprise Security with other SIEM and analytics solutions such as IBM QRadar and similar platforms. From my experience, the biggest advantage for Splunk Enterprise Security is its flexibility and data analytics capability; Splunk Enterprise Security is not limited only to security events, and we can bring in almost any type of machine data and create custom searches, dashboards, and use cases. Solutions such as IBM QRadar are strong for traditional SIEM use cases because they provide many predefined security rules and workflows out of the box. However, Splunk Enterprise Security gives more freedom to customize detection logic and analyze data in different ways using SPL; while Splunk Enterprise Security may require more configuration and tuning initially, once it is properly set up, it provides a lot of control and scalability. I would say QRadar is more structured out of the box, while Splunk Enterprise Security is better for organizations that want deeper customization, flexible analytics, and broader use cases beyond security. Therefore, I suggest that Splunk Enterprise Security is the best.

We have deployed Splunk Enterprise Security in a self-managed on-premises development with a distributed architecture. Our setup includes components such as universal forwarders for collecting data, indexers for storing and processing events, and search heads for users to perform searches, create dashboards, and run reports. This deployment approach gives us more control over things such as data retention, infrastructure sizing, security policy, and custom configuration. For some data sources, we have integrated with cloud services, so it is more of a hybrid monitoring approach, but the main Splunk Enterprise Security environment is managed by our team.

After implementing Splunk Enterprise Security, we have seen the downtime reduced approximately 30 to 40%. The main reason is that Splunk Enterprise Security helps us identify problems much earlier instead of waiting until an issue impacts users. We can detect warning signs through logs, alerts, and system behavior patterns. For example, if an application starts generating errors or infrastructure performance changes, teams can investigate the event history quickly and understand the root cause. This can improve our mean time to resolution because engineers spend less time searching across multiple systems and more time fixing the actual problems.

In Splunk Enterprise Security, we create custom correlation searches and alerts based on our environment requirements for risk-based alerting. For example, we set alerts for repeated failed login attempts, unusual user activity, privilege changes, or suspicious system behaviors. The useful part is that Splunk Enterprise Security does not force us to only use predefined detection; we can adjust thresholds, add conditions, and tune alerts using SPL to reduce false positives and focus on important events.

We have explored the newer Splunk detection capabilities mainly through Splunk Enterprise Security. We use features such as risk-based alerting and advanced correlation searches to improve how we detect threats instead of looking at every alert separately. Risk-based detection helps combine multiple suspicious activities and prioritize users or systems that show higher risk. Additionally, we use custom security content and detection rules based on our environment. The benefit is that we can tune detections, reduce unnecessary alerts, and focus more on meaningful security events. Overall, the newer detection approach helps move from just alert monitoring to a more context-driven investigation process.

I would rate Splunk Enterprise Security an eight; the reason is that it provides very strong capabilities for security monitoring, threat detection, and investigation. With Splunk Enterprise Security, we can combine data from different sources, create custom detections, and analyze suspicious activities to gain better context during investigations. I especially appreciate features such as correlation search, risk-based alerting, and customizable security dashboards because they help prioritize important threats instead of only generating a large number of alerts. The only reason I would not give it a perfect ten is that it requires proper tuning and skilled users to get maximum value, and initial configuration and optimization detections can take time. But once implemented properly, it is a very powerful security analytics platform. I rate Splunk Enterprise Security an eight overall.

I have been using Splunk Enterprise Security for the last five years, mainly building use cases for the SOC team. My role involves analyzing logs and writing vulnerability alerts based on what I observe. When security alerts are triggered, the security team receives notifications and takes appropriate action.

For the initial deployment of Splunk Enterprise Security, I cannot say this is easy. It is somewhat complex because when you purchase the product, you have a lot of data. You need to align all of your data so that it fits Splunk Enterprise Security standards. Splunk Enterprise Security has custom data models and custom correlation searches that are already defined. You need to modify or set your data according to Splunk Enterprise Security standards. Once you complete this setup, the product is amazing and will do all of the work.

The most valuable aspect of Splunk Enterprise Security is that SIEM compliance is one of the best features. I can say this not only because it is Splunk Enterprise Security specific, but also because it is Splunk specific. All data coming in needs to be placed in the SRC field. All data will be normalized with the SRC field. Whether you are collecting data from a firewall or from numerous products, all data with the same name will be automatically collected by Splunk Enterprise Security alerts. Based on that, you can get all alert triggers and perform any kind of investigations. If something goes wrong, such as someone wrongly accessing servers, you will get everything very quickly based on the authentication data model. The alert part and security investigation part are very good.

Threat intelligence is very helpful because there is a threat intelligence model in Splunk Enterprise Security. It will identify threats from around the world and bring them into Splunk Enterprise Security. AI also helps us. When a wrong IP is detected, an incident will be created in Splunk Enterprise Security. Once you click on the "get more info" button, it will bring all information about where this IP belongs, including location and coordinates. Based on that, you can trigger security incidents and alerts.

I am very familiar with risk-based alerting in Splunk Enterprise Security. Everything in Splunk Enterprise Security is on a risk-based model. When I found an unknown IP detection one time, everything is assigned with a risk score. If I found an unknown IP one time in one hour, the risk score might be five or ten. If the same thing repeats in one hour, for example if an unknown IP tries to log in twenty times in one hour, the score should be higher. Risk-based alerting will check the notables and increase the score. When you have one hit, the risk score will be two. Whenever you have more hits, the risk score increases and the alert severity and alert priority also go high, becoming a P1 or P2 incident for the analyst. Risk-based alerting is a very good feature in Splunk Enterprise Security.

MITRE ATT&CK is helpful for Splunk Enterprise Security. I take reference from this framework whenever I want to create alerts. The first thing I do is check the MITRE ATT&CK framework and read the documentation. In MITRE ATT&CK, there are tables with many rows and columns. I check these tables and review all the alerts. MITRE ATT&CK shows the security framework and the maximum possible things that can be done to secure our platform. From that MITRE ATT&CK reference, I create alerts.

The main dislikes about Splunk Enterprise Security are that we need more highly skilled people and the license for Splunk Enterprise Security is costly. Beyond this, the infrastructure cost is too high. Since we have an on-premises deployment, it is costly for us because we need a lot of storage and a big server.

From a maintenance perspective, Splunk Enterprise Security sometimes requires maintenance because it continuously monitors all alerts and continuously creates incidents. Sometimes the data volume is high and some searches will be skipped automatically. We might have 1,000 searches and sometimes experience a lot of skipped searches. Sometimes if we modify any macro, there can also be issues. We need at least one person for maintenance who can continuously ensure that Splunk Enterprise Security is running fine.

Regarding support for Splunk Enterprise Security, we reach out many times. Initially, we purchased hardware that was not capable enough. Sometimes our server became choked and Splunk was not able to run some searches on Splunk Enterprise Security. These issues were due to hardware limitations. We called a consultant from Splunk who analyzed the platform and fixed the issues. Sometimes we upgraded our platform twice by adding additional disk space and RAM.

We have not upgraded to version 8.0 yet for Splunk Enterprise Security and are currently on version 7.0. Recently, we have a demo scheduled from the Splunk team to learn about Splunk Enterprise Security 8.0 features. However, in version 8.0 they changed everything. Initially, we had an incident review dashboard and risk management dashboard that I was very familiar with. In Splunk 10X, all the names changed and everything was restructured. Currently, I am still learning which old features correspond to the new ones. They changed many things, which is also one of the disadvantages, as the changes were extensive.

Splunk Enterprise Security has never crashed. However, sometimes there was lagging, but this was due to our infrastructure because we have an on-premises deployment. I used it in the cloud three or four years ago, and the cloud version is very stable with no scalability issues.

Overall, I can give a rating of nine for the scalability of Splunk Enterprise Security.

Splunk Enterprise Security support deserves a rating of nine.

I have never used any alternative to Splunk Enterprise Security. Before Splunk Enterprise Security, we were using Splunk for monitoring purposes, writing queries and preparing alerts. However, this is not what Splunk Enterprise Security does. A normal traditional alert can be scheduled based on Cron or similar methods. Splunk Enterprise Security collects threats from around the world and includes a threat intelligence data model. It manages identity and asset information separately, which cannot be done with our traditional approach.

For the initial deployment of Splunk Enterprise Security, I cannot say this is easy. It is somewhat complex because when you purchase the product, you have a lot of data. You need to align all of your data so that it fits Splunk Enterprise Security. Splunk Enterprise Security has custom data models and custom correlation searches that are already defined. You need to modify or set your data according to Splunk Enterprise Security standards. Once you complete this setup, the product is amazing and will do all of the work.

The mean time to resolve in Splunk Enterprise Security will increase. On other platforms, whenever you create alerts, you only need to see what is there and then troubleshoot everything. In Splunk Enterprise Security, when you create an alert, you can add many additional things. For example, once an unknown IP is detected, it will send an email, create an incident, and create a notable inside the security system. It can do many things and you can add more information. You can check a lookup, check an IP, or follow specific steps. You can add multiple steps to follow as well. All of this will be included with the alert, which resolves a lot of mean time. People do not need to go searching to find how to do things. This significantly reduces the time needed and alerts are immediate. Whenever something goes wrong, you will be notified quickly.

With Splunk Enterprise Security, we detect threats frequently. I work with a major client in the Emirates, and we find a lot of attacks happening and many phishing emails. Sometimes we have two firewalls, one is a DC firewall and one is a Palo Alto firewall, with many compliance requirements. People attempt to access these systems and sometimes send vulnerability emails. For all of these things, we are blocking and detecting with Splunk Enterprise Security and immediately notifying the candidate to not open emails or notifying our team via email.

It reduced the analyst's workload in Splunk Enterprise Security. However, after purchasing Splunk Enterprise Security, we hired more people to analyze the data. By purchasing this product, we came to understand that we can implement additional features and security rules. Our team is continuously and actively working, checking the MITRE ATT&CK framework, finding detections, and implementing them on our platform to make it more secure.

MITRE ATT&CK helps detect patterns that have occurred before.

ES Essentials is in our environment for Splunk Enterprise Security, though I have never focused much on working with it and do not know much about what it does.

Overall, I would rate this review as a nine.

Splunk Enterprise Security was the major use case that I had.

As a service provider and person managing the tool, the biggest advantage that stands out for me is quite significant. I am using disparate security solutions to integrate or import data into Splunk. I have worked with risk-based alerting in this aspect.

In banking, the logs generated are significant, so everyone should be aware of not facing emergencies such as service failures. Debugging and analyzing these services are really important, especially for larger organizations such as banks, where the services should be implemented with Splunk.

Splunk Enterprise Security helps to improve business resilience by being dependent on the services the company provides. If the processes are heavy such as banking, healthcare, and aviation, it is quite helpful. However, for a small and less complex system, it is not useful because it contains a very heavy architecture. It can be quite expensive to implement for them, but for larger processes and products, it is quite useful.

High infrastructure requirements are present when I integrate Splunk into my full services such as app microservices, database, CloudWatch, or the machines where I have deployed the services. I have to integrate into all the platforms I am using. It needs another machine or infrastructure to manage all the logs and generate these kinds of reports.

Regarding the learning curve, any beginner encounters trouble with it because it is complex to implement across all services due to the huge amount of applications or functionality to watch and implement. I also mentioned earlier that the pricing is a concern because it does not provide any free tier to use; therefore, I have to use the paid version, which is quite expensive, costing thousands of dollars per one gigabyte or ten gigabytes of data generated.

I believe the pricing is quite expensive. It generates a huge amount of data, so it sometimes works slowly for the generated logs. I can say around ninety-eight percent uptime because I can sometimes get into trouble finding logs across the services in the generated logs.

The learning curve, its implementation, and its pricing are quite heavy for learners or purchasers.

I have used Splunk Enterprise Security for three years now.

Splunk Enterprise Security is fully scalable because it provides all kinds of configuration in management servers and all cloud integrations such as AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub, Jenkins, and Cisco as well. It is quite fully scalable across all platforms.

My manager discussed licensing earlier, but I did not have the need to call them later after implementing. After my organization bought it, they provided quite a good response from the support team.

When I compare Splunk Enterprise Security to other tools, I have been using various solutions on average to allow my SecOps team to remediate security incidents with Splunk.

Regarding the installation and deployment, I would say it is quite complex. It is complex because I have to deeply learn it due to the many things involved. As a beginner, it is quite complex to learn. If a senior developer or individual is trying to implement it, that is time-consuming because I have to do a lot of things to implement Splunk across the services and servers.

If I quantify the return on investment of Splunk in percentage, I would say it is around ten to twenty percent on average for its services provided because these bugs or hacker attempts are really rare cases, making it heavy to calculate.

I did not purchase it because these transactions are handled at the organizational level. The higher managers process these purchases over the AWS cloud, so as a developer, I am not included in that process.

I am using a new threat detection feature in Splunk. When I implement Splunk, it provides a dashboard or methods to implement these threat detection processes. It gives me an email trail that identifies when services and which users are trying to breach security. If any service has failed, then it also triggers an email or a notification in the dashboard. These are rare cases, but I find the average number to be acceptable.

I have used Azure for deployment. I rate Splunk Enterprise Security nine points out of ten, and my overall review rating for this product is nine out of ten.

We use Splunk Enterprise Security for our security monitoring and incident management. This is our global application that we are using for security monitoring and compliance.

We've seen some good improvements from a business perspective, particularly regarding security monitoring. However, when I consider our current challenges and future roadmap, I don't believe Splunk Enterprise Security has the capabilities we need. We previously faced challenges with QRadar, which prompted us to migrate to Splunk Enterprise Security. While Splunk Enterprise Security has addressed the past issues we encountered, it fails to meet our future requirements. Currently, it effectively addresses existing threats, but it doesn’t tackle advanced threats, which is a significant challenge we foresee with Splunk. There is still a lot of room for improvement.

With the Classic flavor we have in our company, the feature that I find good in Splunk Enterprise Security is from the MITRE coverage point of view, and then the level of information that it provides. The integration with its own SOAR platform is also one of the pros.

From the product point of view and deployment point of view, Splunk Enterprise Security is satisfactory. It is not simple; it is at a medium level when it comes to deployment and management of the tool altogether. This includes not only the enterprise platform but also other components such as deployment servers or the Splunk agents we use for collecting logs. When comparing it with different vendors in the industry, from the deployment and maintenance point of view, it is not up to the level of other vendors. 

When discussing the drawbacks, it's important to note that the flavor I’m currently using is called "Classic." Unfortunately, this platform does not offer any of the new features that Splunk introduces. As a result, we are the last ones to find out about new capabilities, and we’re also slow to implement them. Splunk tends to release new features with different flavors of their platform, and being on the Classic flavor means we are least likely to receive the latest updates. This is a significant concern I have regarding Splunk.

When comparing Splunk Enterprise Security with next-gen SIEMs, we look for AI and ML models being incorporated in such a way that it automatically should be able to detect behavioral-based detections. It should be able to detect behaviors from logs and show us the entire attack surface and blast radius of any particular incident, which is primarily missing.

The capability of AI, Artificial Intelligence, is missing, which would help to automatically detect and read data comprehensively. Splunk lacks the new native solutions for agent deployment, which is essential for a large enterprise.

Currently, there is Machine Learning in Splunk Enterprise Security, but that is resource exhaustive and complex, bringing an impact onto our overall stack performance. Technical expertise in Machine Learning is required, and continuous monitoring is needed to ensure Machine Learning learns about our data to provide results, which is resource exhaustive, time-consuming, and costly.

Artificial Intelligence is missing in the Splunk Enterprise Security platform, which would help us read the data automatically, learn from it, and provide attack surface area from a 360-degree perspective. The fixed pricing model requires upfront purchase based on assumptions and roadmap, requiring payment for the next two to three years regardless of usage.

I have been using Splunk Enterprise Security for around three years.

On a stability scale, I would rate it an eight out of ten.

Regarding scalability, I would rate it a seven out of ten. I don't have the pay as you go model. 

We have 150 users using this solution.

Whenever we raise any support case in Splunk, even after providing the required information, if a person is working on it and it gets transferred or handed over to a different representative in a different shift, they keep asking the same questions and requesting more details. Even when we ask for a call, even for P1 or P2 incidents, they keep going around asking for details. When we request P1 or P2 support, it would be wise to get into a call, get all the details, and have a troubleshooting call to address the issue on a priority basis. The technical support representatives keep transferring the tickets during shift handover, and different representatives ask the same questions multiple times, wasting our precious time. The issue doesn't get resolved until I escalate it to their higher management.

Positive

We were using QRadar previously. We had legacy systems, and from the volume and log source point of view, from the costing perspective and detection point of view, we thought Splunk Enterprise Security was far better than QRadar. Splunk Enterprise Security would provide better capabilities and out-of-box detections. These were some of the things that we saw, and Splunk Enterprise Security was also one of the leaders in SIEM technology. However, once we started using Splunk Enterprise Security, we discovered it was not the right tool.

The initial setup was of medium complexity. It took approximately 8 to 12 months to migrate from QRadar to Splunk Enterprise Security. 

The cloud platform we are using is maintained by the Splunk team itself. However, when it comes to our on-premises deployment, the maintenance is very high, cumbersome, and costly from both resource and time perspectives.

We haven't saved any money with Splunk Enterprise Security. Instead, we have spent excess of the budget on this with unexpected costs. That's one of the pain points I see with Splunk Enterprise Security. There haven't been any savings.

Splunk Enterprise Security comes with high fixed costs. That's one of the disadvantages. When comparing with different vendors, they offer pay-as-you-use models, which is more user-friendly, but Splunk Enterprise Security comes with fixed pricing.

We use different security tools as well.

For any user who wants to have a cost-efficient and next-gen SIEM solution, I wouldn't recommend Splunk Enterprise Security. However, if a user is not concerned about cost and is looking for an on-premises solution, then I would suggest Splunk Enterprise Security. For anyone who wants to go for a cloud and cost-effective solution with next-gen capability, I wouldn't recommend this.

I would rate it a seven out of ten.

My main use case for Splunk Enterprise Security is web uploads.

The ability to create SPLs in Splunk Enterprise Security is my favorite feature. These features benefit my organization primarily through threat detection, which I use for, so that's a huge benefit. Splunk Enterprise Security has absolutely helped improve my organization's business resilience.

Splunk Enterprise Security could be improved by incorporating AI features, as it doesn't have the AI capability that Pyramid does, where users can ask questions without having to write code.

It has been more than three years.

I haven't experienced any downtime or performance issues with Splunk Enterprise Security. Zscaler may experience issues because Splunk grabs data from them, but other than that, I haven't had anything crash.

Splunk Enterprise Security adapts to our growing needs on a yearly basis, as we're constantly growing our program and it has helped in that way. We have expanded usage from just engineering, as now our whole DLP team uses it, allowing us to not rely on other people for it. It was a smooth process when we were expanding usage.

The most significant challenges I've faced when using Splunk include getting the code right. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be good, as changes are easy to make. On average, my security ops team takes about three days to remediate security incidents with Splunk Enterprise Security, depending on what the incident is.

My advice to other organizations considering Splunk Enterprise Security is that it depends on their needs and costs, but I think it can cover everything from a small business to a large business, so I would definitely recommend it.

On a scale of 1-10, I rate Splunk Enterprise Security an 8.