What advice do you have for others considering Splunk Enterprise Security?

Splunk Enterprise Security has been the best SIEM solution tool I have worked with over the past ten to fifteen years. It has integrated with numerous products beyond just being a SIEM solution, including AWS and Cisco networking devices, which, alongside their security essentials and correlation searches, creates a comprehensive package. Excellent customer service, availability for monitoring the cloud, and data lake solutions that facilitate easier data access underscore the readiness of Splunk Enterprise Security to meet various organizational needs. I give this product a rating of ten.

The unified workflow has made it possible for there to be automatic investigations and for us to triage quickly by identifying the artifacts of interest. Splunk is no longer unique as SIEMs are now a commodity. Splunk still has a foothold with the unique detection logic, but I expect that to change in the next couple of years. Splunk Enterprise Security is a bit expensive to scale. Customer support was better in the past and it is hard to find really good support as it has all been outsourced. I would rate this review a 7.

I would say to do a lot of homework in researching the different tools and modules within Splunk Enterprise Security. Splunk Enterprise Security is obviously very essential and is the heart of Splunk, but all of the other tools that are available, such as SOAR and RUM, are important, so identify exactly what your enterprise needs and map that to the different Splunk modules to make sure that you are getting as much as you can from Splunk. I provided this review with a rating of 9.

For others considering adopting Splunk Enterprise Security, I advise to build a lab, test it, play with it, and build up your skills on it; it is a very good solution. Splunk Enterprise Security is a very good solution, and I have no other thoughts or points to share about Splunk Enterprise Security before we finish. I would rate this product an eight overall.

I do not have information on whether I have noticed a reduction in the mean time to resolve incidents (MTTR) thanks to Splunk Enterprise Security. I have observed that the Risk-Based Alerting feature of Splunk Enterprise Security has not had a positive impact on the volume of alerts or on analyst productivity. On the contrary, it has actually generated quite a lot of alerts that are even longer to analyze, and the benefit is not necessarily immediate. I do not really have an opinion on the Threat Topology features or the support for the MITRE ATT&CK framework in Splunk Enterprise Security in helping me discover the scope of an incident. I have not noticed an improvement in the speed of threat detection thanks to Splunk Enterprise Security. I would rate this review seven out of ten.

Splunk Enterprise Security's risk-based alerting (RBA) has impacted our alert volume and analyst productivity by allowing us to send low fidelity notables to the risk index so we can still maintain a record of that and focus on curating correlation searches to as high fidelity as possible. I have found the threat topology and MITRE ATT&CK framework features in Splunk Enterprise Security helpful for understanding the full scope of a security incident, as we do map our content to MITRE, and the features available in Detection Studio with MITRE Attack coverage offer us an opportunity to improve in that space by closing some gaps identified. We are not leveraging threat intelligence, but I think the features in Detection Studio offer more areas where we could look for insights into how to close the MITRE Attack coverage gaps we have. My advice for others looking into using Splunk Enterprise Security is that before looking at Splunk Enterprise Security, organizations must evaluate what their use case and priority use cases are and evaluate the best approaches available so they know what data to load into Splunk Enterprise Security and what detections to develop against that data. I would rate this product an 8.

I have not really gotten to use too many of the AI feature sets in the current state, so I do not believe that I can speak to the efficacy of those features.I think the functionality is there. The implementation is probably the hardest part, which is just a lot of work on the engineering and architecture of an organization, as well as if there are deficiencies in the IT infrastructure side, bad data equals bad Splunk. We have to ensure that we continue to implement things to be able to use Splunk Enterprise Security to its full potential. From a directional standpoint, I think Splunk Enterprise Security is on the right path of observability taking the forefront of any sort of AI implementation. The biggest concerns about agentic capabilities is how you arrive at that decision making, which are the same concerns you would have with a human in terms of triage. Ensuring that observability always maintains the forefront of the decision making in the feature sets that are provided is important. I'm not sure if the consolidation really has much of an effect on us as of date. UEBA, I believe, will have a huge benefit, but it's not fully implemented, so I can't speak to it in a full manner. The investigation capability of being able to search while inside of an investigation and that single pane of view has been beneficial for path consolidation for us to be able to focus on the alert that we're looking at. I would say to ensure that you're getting the right data and getting it formatted appropriately when looking into using Splunk Enterprise Security. While you don't need to ingest everything, you do need to make sure that you're ingesting everything that is important from a detection engineering perspective. If you're missing a large portion of your logs, it's going to be very difficult for you to adequately triage the situation, and the fewer places you have to go for the right information, the easier the investigation and the better Splunk Enterprise Security tools work. I would give Splunk Enterprise Security an overall rating of eight on a scale of one to ten.

I find the threat topology and MITRE ATT&CK framework features helpful for discovering the overall scope of an incident, as they provide a good overview of what MITRE attacks we cover and which ones we're missing, giving us a good idea of what detections or new data we need to ingest. Splunk Enterprise Security has helped me detect threats faster. With the risk-based alerting, it's easier to detect things and respond to incidents. Splunk Enterprise Security Essentials has contributed to a reduction in analyst burnout or fatigue. The speed of finding data and correlating it is a big helper in improving my daily work experience and retention for our security team. I don't think we have been really using the integration of threat intelligence directly into the TDIR workflow yet, so I can't say much about how it has changed my approach to proactive defense. Since we don't have Enterprise Security Premium and just have the base version, we don't have SOAR and UEBA, which means the consolidation of them into a single interface has not improved my team's operational efficiency. My advice for others looking into using Splunk Enterprise Security is to study and understand the Splunk fundamentals, as that will help you understand what Splunk Enterprise Security is doing with your data and how it serves as an add-on on top of Splunk to fully utilize it. I would rate my overall experience with Splunk Enterprise Security an 8 out of 10.

When we configure an alert in Splunk Enterprise Security, we map the attacks in every detection, and when the client or the team reviews an alert, we know what is happening and what MITRE ATT&CK it is related to. While I do not have the exact numbers since I work more in the technical side, I think we have seen improvements in alert fatigue using RBA with Splunk Enterprise Security. The advice I would give to others looking into using Splunk Enterprise Security is to understand what kind of information from indexes they are currently ingesting in Splunk, so when an incident occurs, the team would perfectly know what is happening and where to search for it.

I would advise others looking into using Splunk Enterprise Security that it is a pretty good tool that works very well, but you need a partner or someone to guide you through the process; otherwise, you may feel alone. I would rate this product a 9.

Splunk Enterprise Security does not help us with business resilience. It has helped us reduce incident handling time with SOAR automation and enrichment. It also helps us with the enrichment of events and incidents; it helps us take more precise actions. We have taken advantage of integrating threat intelligence directly into the detection and response workflow. Having threat intelligence integrated into the workflow has helped us see the information generated by the AI. The AI-driven capabilities have improved the accuracy of our investigations, and it has supported our team in making faster, data-driven decisions by helping us determine what is a threat and what perhaps just needs tuning for false positives. I would advise other companies considering implementing Splunk Enterprise Security to size the license properly and also to map out the onboarding that will be done for the data sources, and to align it with the business where they are implementing the technology since it is not the same for all. I rate this product a nine overall.

I would let potential users know that this is a great tool that has many features and capabilities. It is almost a one-stop shop for everything that you need to view your environment. Although it may be daunting at first, it is very easy to use once you get the hang of it. I appreciate Splunk Enterprise Security. I do feel that there is a lot that this product can do, and I would like to see more guidance, documentation, videos, and simulations to see it firsthand. I rate this review an 8.

Splunk Enterprise Security's risk-based alerting (RBA) has been performing very well. It has been tuning out some of the alerts from our queues that do not indicate much malicious activity. I assess the threat topology and MITRE ATT&CK framework features as making the TTPs more clear and that helps me search alerts in a better way. The integration of threat intelligence directly into the TDIR workflow has not improved my ability to preemptively block threats yet. I recommend getting into the courses in Splunk University to have a better understanding of the application. I give this review a rating of nine out of ten.

Splunk Enterprise Security has helped reduce our team's average meantime to resolve metric by about 50 percent because we are able to tune it to lower false positives and noise. I would say Splunk Enterprise Security helps us detect threats faster because we are able to tune the number of alerts sent out, resulting in fewer alerts we need to monitor. We are still developing the impact of Splunk Enterprise Security's risk-based alerting on our alert volume and analyst productivity. Having the consolidation of SIEM, SOAR, and UEBA into a single interface with Splunk Enterprise Security improves our operational efficiency and provides a single pane of glass. The integration of threat intelligence directly into the TDIR workflow with Splunk Enterprise Security improves our ability to preemptively block threats and makes our decision-making faster since we have intel ingested in the platform instead of referencing different sources. Regarding Splunk Enterprise Security Essentials, we have not worked much on the cloud side, so it has not improved our visibility across hybrid or multi-cloud environments. My advice to others looking into using Splunk Enterprise Security is that if someone wants a very comprehensive solution, it is the way to go. However, they need to ensure they have a person who can handle, configure, maintain, and add rules and policies, as it is not the product they need to buy unless they have managed services. I would rate this product an eight out of ten overall.

In terms of efficiency, I am not sure Splunk Enterprise Security has brought much value so far, but on the other hand, it provides indicators with all the dashboards offered, which enable us to see better how we handle our incidents. These indicators allow us to see where we stand and identify the cases to be handled that are pending. At the moment, we do not yet have indicators to answer whether Splunk Enterprise Security has allowed us to reduce the mean time to resolution of incidents, the famous MTTR, within our team. We are on Splunk Enterprise Security version 8, and the integration with Splunk SOAR and the dedicated queues is a plus because it was something we were missing. I do not notice a reduction in analyst fatigue or burnout thanks to this tool. Consolidating SIEM, SOAR, and UEBA functionalities into a single interface has not improved our team's operational efficiency. Splunk Enterprise Security has helped improve our organization's resilience to incidents, and we chose to move to the AWS cloud to be resilient and not be tied to our current infrastructure as we were before on-premise. I give this product a rating of 8 out of 10.

We recently upgraded to Splunk Enterprise Security version 8.4, and the terminology normalization is a good move. The Analyst Queue is very similar to previous versions incident review, and we have not yet utilized those workflows. We recently implemented the risk-based alerting (RBA) index, and I have yet to evaluate the improvements. We had the MITRE ATT&CK framework in place prior to this version, which has been useful. You should focus on data onboarding, indexing, and source typing per Splunk best practices. I gave this product a rating of eight out of ten.

Splunk Enterprise Security's risk-based alerting, also known as RBA, has allowed us to reduce some of the alerts and direct the analysts to work on the ones that have a higher risk, so it has been helpful. The threat topology and MITRE ATT&CK framework features are useful. Our threat detection team uses it, but I personally haven't, so I don't have a lot of insight into that. Splunk Enterprise Security has helped us detect threats faster. We do use it and believe it helps us identify threats in a more timely manner, although I can't give exact metrics on how much faster. I would tell others looking into using Splunk Enterprise Security that it meets our company's needs, and we're able to use it and resolve our use cases. I rate this product a seven out of ten.

I would advise others looking into using Splunk Enterprise Security to take advantage of all the free courses and seminars that they offer and also start to learn SPL, because that is another challenge that we faced. We did not know the language, so it was a bit complicated to start building the queries for gathering the data. I would rate my overall experience with Splunk Enterprise Security as a nine out of ten.

I have not used Splunk Enterprise Security's AI capabilities, so I cannot speak to that aspect. I have not used the AI portion of Splunk Enterprise Security, so I cannot speak to its accuracy and reliability of output. Splunk Enterprise Security is deployed on-premises in my organization. Splunk Enterprise Security's risk-based alerting has impacted my alert volume and analyst productivity. Risk-based alerting has made things more manageable for my team as it has decreased the number of alerts. I do not use Enterprise Security for assessing the threat topology or MITRE ATT&CK framework features. I have not used the integration of threat intelligence directly into the TDIR workflow. I rate this product a 10 out of 10. I advise others looking into using Splunk Enterprise Security that it is better than the alternatives, especially if you are working in a DoD environment, as we have a SIEM ingest and retention requirement for our networks and compliance and incident response and DCO strategies.

Regarding Splunk Enterprise Security's AI capabilities, it is definitely helping our organization in building our guardrails. Regarding Splunk Enterprise Security's AI capabilities, its accuracy and reliability of output are satisfactory. Splunk Enterprise Security's risk-based alerting, RBA, has led to increased productivity, while alert volume remains the same. I assess the threat topology or MITRE ATT&CK framework features of Splunk Enterprise Security as quickly giving us the ability to see where in the MITRE ATT&CK framework the information we're receiving applies. My advice to others looking into using Splunk Enterprise Security is to ask peers and other entities that are using it. I would rate this product 9 out of 10.

I love Splunk; it is fantastic and our account team is always willing to work with us and make sure we're getting the most for our money. My advice to others looking into using Splunk Enterprise Security is to make sure your data is clean and to be prepared for when you actually move to Splunk. I gave this review a rating of 10.

Splunk Enterprise Security Essentials has not significantly contributed to a reduction in analyst burnout or fatigue, as my team is small but critical, focusing on a limited number of servers. My advice to those looking into using Splunk Enterprise Security is to try it and see for themselves. I rate this review a 10.

Alerting is valuable. I do not think the integrations are comprehensive. It seems that Splunk Enterprise Security does not work well with other products that are not Splunk Enterprise Security. Splunk Enterprise Security has vastly improved the amount of time that it takes to respond to an incident, which has been truly helpful. It is not necessarily a percent improvement; it is an absolute transformation. We were not capable of responding correctly, and now we are, so I would say the improvement is from zero to one hundred. Splunk Enterprise Security has immensely helped in this regard as well. It is not a percentage increase but rather an absolute shift from no to yes. It provides many alerts, but it is almost excessive. When Splunk Enterprise Security has an error or is experiencing an issue, it will send hundreds, if not thousands, of alerts. I find the alerts helpful to some degree. It seems that many incidents are different. I would recommend attending Splunk conference and starting off a little faster. I would rate this review as seven out of ten.

My advice for others looking into using Splunk Enterprise Security is that if you are not using a tool where all security alerts are seen by your SOC in one pane of glass, this is definitely one of the good tools out there in the industry to take a look at. Splunk Enterprise Security's risk-based alerting, RBA, is something we want to enable, and I can see it will be beneficial, as we can enable more alerts and gain more insights into users and entities if the risk score is utilized, which also provides us with a narrative if alerts or findings trigger for certain assets or identities. I rate this solution 7.5 out of 10.

My advice to others looking into using Splunk Enterprise Security is that it's phenomenal; the ease of use, support, and the continued development of the product continues to evolve as the technology grows, and they are embracing AI to make the product even more effective. I think their governance and security are good based on all that I have seen and the demos that I have seen, as there seems to be a lot of capabilities around governance and security. So far, so good regarding Splunk Enterprise Security's AI capabilities; what I have been able to see seems to be very accurate, especially because it actually provides the data based on what it's identified, so I can validate it. I give this product a rating of 10.

I have no problems with Splunk Enterprise Security's AI capabilities regarding its governance and security; I think it is actually good. Regarding the accuracy and reliability of output, Splunk Enterprise Security seems to be right on. I am not using RBA at the moment, so I cannot describe how Splunk Enterprise Security's risk-based alerting has impacted my alert volume and analyst productivity. I give this review a rating of 7.

My advice to others looking into using Splunk Enterprise Security is that it is definitely built for enterprises and contains a substantial amount of information. We are an integration platform as a service, so we use Splunk Enterprise Security's APIs and have a business relationship with this vendor. The reason I chose a rating of eight out of ten is mainly due to the amount of information provided; I feel you really have to dig extensively and sometimes even use third-party systems to make sense of what you are seeing. I rate this product eight out of ten.

My advice for others considering Splunk Enterprise Security is to try it out, prepare definitive data sources, narrow down on the use cases they want to address, and focus on ensuring data availability to support those use cases. I want to appreciate the effectiveness of Splunk Enterprise Security, how well it is designed, and its capability to meet customer objectives. I would rate this product a 9 out of 10.

We do not use Splunk Enterprise Security for business resilience; we mainly use ITSI and some custom workflows that have been developed by other people than me. We annotate our detections; however, as far as helping us operationally, the threat topology and MITRE ATT&CK framework features are not very impactful. The consolidation of SIEM, SOAR, and UEBA into a single interface is not available to us yet. My advice to others looking into using Splunk Enterprise Security is to keep it on-premises.

My advice for others looking into using Splunk Enterprise Security is to go for it. You always get what you pay for, and I believe this product has everything you need to ensure it is a good investment for your company. I would rate this product a 10.

Splunk Enterprise Security has positively impacted my organization by making it significantly easier for us to do root cause analysis. A specific example of a situation where Splunk Enterprise Security helped with root cause analysis is that we have seen a significant reduction in the amount of time to identify false positives in certain situations. Splunk Enterprise Security has helped improve my organization's business resilience, and I found it to be very effective for helping identify when a system goes down or is operating at an improper level before an actual issue occurs. Splunk Enterprise Security has helped reduce my team's average mean time to resolve, MTTR metric, and while I don't have an exact percentage, it has helped us do root cause analysis. Splunk Enterprise Security has helped me detect threats faster, and while I don't know how much faster, it has seen an improvement as we use Tenable security, and it ingests that data to help us identify threats. My advice to others looking into using Splunk Enterprise Security is to optimize your data inputs so you can best use Splunk Enterprise Security to help you. I would rate this product an 8 out of 10.

For anyone looking into using Splunk Enterprise Security, I would advise really understanding the language and how to navigate; writing the correlation searches is just something that takes time, so just learn the language and you'll be good. I have provided an overall review rating of eight.

We are about to move to the Premier Cloud edition of Splunk Enterprise Security. I do not know what new features are going to be available there. Regarding Splunk Enterprise Security's AI capabilities, we have not really used any of the AI functions in Splunk Enterprise Security at all. My experience with them is incredibly limited, pretty much to the level of only testing. In general, I think it has good output and good understanding of the questions. Sometimes it goes a bit off the rails, but in general, the AI will understand the question, properly research the answer, provide a good answer, and even provide recommendations. Overall, it seems to be a very good product. We are currently on-premises. Within the next two to three months, we are moving to cloud. That has not been determined, but more than likely, it will be Azure. Splunk does have an incredible ability to react. Alerts are thrown almost in real-time. Currently, we are not using any agents, but even so, these alerts are put in front of analysts who are sitting there waiting for alerts. Our time to start work on these things is very small, even without the AI agents. With the agents, it is going to be even faster to respond. We will probably get a lot of these false positives worked out. That is currently one of the things I should have mentioned earlier. Splunk Enterprise Security does throw some false positives. It, as anything, needs some tuning. But it is pretty accurate. An agent would be very helpful in filtering out false positives. The MITRE material is incredibly helpful for audits, but in general, our analysts are not really using that piece of Splunk Enterprise Security very much at all. I do a bit more, but I would say it is underutilized. However, it is nice that it is there. This has been very helpful. It has also been a pain once in a while when intelligence feeds put something silly in there, and we end up blocking Google or something. That is generally a one-off occasion. The majority of the time, it is very helpful. We see domains blocked that we did not even know were bad. We had no reason to even investigate this domain, and Splunk Enterprise Security has already stopped any connection. It is very helpful. We do not currently have SOAR, UEBA, and Splunk Enterprise Security all in the same interface. Currently, they are different interfaces. We do not even have UEBA. Unfortunately, we have not made the move to the cloud yet, so I cannot really give you a good answer. We have not cut any employees because we do not have employees to manage alerts. We have employees for coverage. This, despite the advantages, and even when we bring in the automatic AI agents, we will not be losing any employees, as again, they are there for coverage. I would rate this review a 9.

Splunk Enterprise Security's risk-based alerting, RBA, has improved productivity and provided more useful alerting than manual alerts. I am unsure if the integration of threat intelligence directly into the TDIR workflow has improved my ability to preemptively block threats. I assess the threat topology and MITRE ATT&CK framework features as very useful in helping me discover the overall scope of an incident. I have not used the native UEBA capability to enhance my visibility into unknown, sophisticated, or insider threats. I would recommend Splunk Enterprise Security to others looking into using it. I gave this review a rating of 10.

I think Splunk Enterprise Security helps identify what part of the MITRE ATT&CK framework that the incident falls under. I believe that Splunk Enterprise Security Essentials has contributed to a reduction in analyst burnout or fatigue; it removes having to go to multiple tools to pull data and find what I am looking for and puts the story together for me. My advice to others looking into using Splunk Enterprise Security is to make sure that you are aware of all of the capabilities and ask for demos so that you ensure that you are using everything possible to make the best of your environment. I rate this review overall as a ten.

I would tell others looking into using Splunk Enterprise Security to stay open-minded, continue learning, and go to trainings because even if it seems very complicated at first, it does have the potential to really help with metrics, especially in terms of SLA and analysis. I would rate this review a 9.

Regarding Splunk Enterprise Security's AI capabilities, I think they're a good starting point, but as Splunk Enterprise Security evolves, the AI features will change a lot and I'm not sure what direction it will take right now. Regarding Splunk Enterprise Security's AI capabilities in terms of accuracy and reliability of output, I think by default, they were not that good. When we input metadata and skills about where our content lives and how it lives, it got significantly better, but it was not good at finding these things by default. Splunk Enterprise Security is deployed in a public cloud environment in my organization. We use AWS as our cloud provider. Splunk Enterprise Security does identify problems, and with proper dashboards, it shows us issues and alerts and observability issues or when something is down very well. Splunk Enterprise Security has helped reduce my team's average mean time to resolve (MTTR) metric because it allows our alerts to be targeted and efficient, delivering direct alerts about specific things as opposed to broader, wider alerts that were harder to triage. Splunk Enterprise Security has helped reduce my team's average mean time to detect (MTTD) because it makes it easy and efficient to build alerts to detect these things and schedule them aggressively so that the detection appears very soon after the event. Splunk Enterprise Security's risk-based alerting (RBA) has impacted my alert volume and analyst productivity by being great for reducing alert volume. By combining multiple indicators, we can have a comprehensive alert and a full picture of what happened on a system as opposed to multiple similar alerts that may or may not be noise. I assess the threat topology and MITRE ATT&CK framework features for helping me discover the overall scope of an incident by noting they show us where holes are in our detections and what we have and don't have in terms of data sources and detection capability. My advice for others looking into using Splunk Enterprise Security is that it is a product that rewards knowledge and time put into it. It is something that you can use and learn about and become really proficient in, and it will help you a lot. I rate this product an 8 out of 10.

My advice for others looking into using Splunk Enterprise Security is to just buy it. I would rate this review a ten out of ten.

My advice to those considering implementing Splunk Enterprise Security is to conduct a full analysis, run a pilot, and only then make a decision. I would rate this review as an eight.

My advice for others looking into using Splunk Enterprise Security is to definitely give it a try; there are definitely trials to test out, learn about the product, take advantage of reaching out to the tier three support if needed, and integrate it into your ecosystem to understand what it's doing and what it can do for you. I would rate this product a nine out of ten.

Splunk Enterprise Security has not helped improve our organization's business resilience since resilience means the ability to recover from a disaster, and we are not using it in that capacity at all. Regarding the average meantime to resolve metric, we implemented Splunk Enterprise Security a long time ago. Providing quantifiable metrics would be very difficult because it was so long ago and it was such a generational leap when we did employ it that there was really no comparison. We have actually chosen not to implement risk-based alerting. We are in an environment where the alerts are not so voluminous that risk-based alerting would add value to our triage and resolving. I would assess the threat topology and MITRE ATT&CK framework features for helping me discover the overall scope of an incident by noting that we have MITRE enabled, but in our particular environment, we do not leverage it as one would in a non-air-gapped environment. The actual use of it being able to quantify various threats through the MITRE framework does not really apply to where I am. Splunk Enterprise Security has helped me detect threats faster, but as I mentioned before, we implemented it so long ago, and it was such a generational leap in our ability to have quantifiable metrics on how well or how much it improved things that providing specific measurements would be inappropriate. I would advise others looking into using Splunk Enterprise Security to give it a try. Because of the availability of those ongoing added detections from the Enterprise Security Content Update, you will not find a better value. The time to engineer new detections is greatly reduced, especially ones that are topical and in the news. I would rate this product a seven out of ten.

Regarding Splunk Enterprise Security's AI capabilities, governance and security are very solid, as they are restricted to the data within the platform itself and have relevant guardrails in place, which mitigates concerns about AI security. In terms of accuracy, Splunk Enterprise Security is reliable. I tested it recently around a detection, and its ability to explain detections in plain language allows non-technical people to understand what is happening and the criticality of findings to a business. Splunk Enterprise Security is the tool to choose if you are looking to have a good overview of security, manage detections based on risk scoring, and utilize Detection as Code. It offers many features, including AI and Agentic AI. Risk-based alerting in Splunk Enterprise Security has positively impacted alert volume and analyst productivity by helping to prioritize alerts based on their scoring, with lower-scoring alerts not being prioritized, which has increased analyst productivity. I have not implemented the threat topology or MITRE ATT&CK framework features, but when pushing detections via code, I have AI that automatically assigns a MITRE framework to an alert. We are in early stages with Splunk Enterprise Security and are not actively triaging from it, so I do not have applicable insights on analyst burnout or fatigue at this time. I would rate this review an 8 out of 10.

My advice for others looking into using Splunk Enterprise Security is to take advantage of Splunk's resources and training. Splunk Enterprise Security has helped improve my organization's business resilience, and Splunk Enterprise Security is really good at the ability to predict, identify, and solve problems in real time. I recommend other people use it for similar situations. Splunk Enterprise Security has helped reduce my team's average mean time to resolve, the MTTR metric. It allows us to search in one place for all the information we need to close an alert. Splunk Enterprise Security has helped reduce my team's average mean time to detect, MTTD metric, because it allows us to base alerts off of many different tools all in one place, and I would say by a couple of hours. Splunk Enterprise Security has helped me detect threats faster; it has decreased it. I have not used the threat topology and or MITRE ATT&CK framework features for discovering the overall scope of an incident. I would rate this review a 10 out of 10.

I rate Splunk Enterprise Security a seven on a scale of one to ten. I rate it a seven because it is tight, it is reliable, it will keep you gainfully employed, and nothing is perfect. I think the governance of Splunk Enterprise Security is very needed, especially for data wrangling, as any AI project needs proper data in terms of platform and security, reliability, and more. Its AI capabilities are quite accurate in terms of output reliability. Splunk Enterprise Security is deployed in my organization in a hybrid cloud environment. I use Azure and AWS as part of my hybrid deployment. I did not purchase Splunk Enterprise Security through the AWS Marketplace. Splunk Enterprise Security has helped improve my organization's business resilience, and I feel that it is a canary in the coal mine and a harbinger of things to come if you actually know what you are looking for in the logs. Splunk Enterprise Security has not helped reduce my team's average mean time to resolve (MTTR) metric. I have not upgraded to Splunk Enterprise Security 8.0. Splunk Enterprise Security's Risk-Based Alerting (RBA) has made me more hyper-vigilant in terms of alert volume and analyst productivity. Splunk Enterprise Security has helped me detect threats faster, very much so. Splunk Enterprise Security Essentials has not contributed to a reduction in analyst burnout or fatigue. The integration of threat intelligence directly into the TDIR workflow has improved my ability to preemptively block threats, making me realize that being proactive is my best offense and defense. My advice for those looking into using Splunk Enterprise Security is to test it first, get your hands dirty, understand what it is, and then think about implementing it system-wide. I would rate Splunk Enterprise Security a seven overall.

Splunk Enterprise Security has not helped reduce my team's average mean time to resolve, as they find it hard to use Splunk, and they are more used to Sentinel. Splunk Enterprise Security's risk-based alerting has decreased the alert volume a tiny bit. I haven't used the threat topology and MITRE ATT&CK framework features, so I cannot assess how they help discover the overall scope of an incident. The integration of threat intelligence directly into the TDIR workflow has not improved my ability to preemptively block threats, as it is not that important. I would advise others looking into using Splunk Enterprise Security to start planning. I rate this product a 9.

Concerning whether AI-driven detections and assistance improved the accuracy of my investigations with Splunk Enterprise Security, we are currently evaluating it from our side. We are getting false positives as well as true positives. It is currently under evaluation, so I cannot say 100 percent. Most probably next time when we will have a correct picture of it, I will share a more detailed update. The thing is we are using multiple security solutions. We have a SOAR solution as well that is integrated with Splunk Enterprise Security, and it is not Splunk SOAR, it is a different one. When we started using them, the collective meantime to respond was reduced. I cannot say it is definitely from Splunk, but it reduced after using both applications. We have improved 20 percent MTTR after using this. Regarding assessing the threat topology or MITRE ATT&CK framework features for helping me discover the overall scope of an incident, we are not using this particular feature as much. Splunk Enterprise Security has helped me detect threats faster. There are features like user behavior analytics and the AI feature helping us for fast detection and also detection for which there is no rule configured. Regarding whether Splunk Enterprise Security Essentials contributed to a reduction in analyst burnout or fatigue, analyst fatigue and burnout is directly proportional to false positive detections. If false positive detection is reduced and only true positives are triggered, then it is good for analysts. It is not about Splunk; it is about all SIEM solutions that require the fine-tuning of all the rules, including AI ones, user behavior analytics, and normal rules that we create in Splunk. We are continuously working on fine-tuning those rules. It is not the case that you will not get any false positives from a SIEM solution. You always get false positives, but it is your duty to find among all of those to get only true positives. That is what we are doing here. Out of 2,000 incidents in a month, around 40 to 50 are actually cyber threats. Concerning whether I would like them to improve the false positive ratio, the rest ones are not false positives. They are triggered, but there are some exceptions or many things in the background that you cannot filter out. They are triggered correctly, but the true cybersecurity-related incidents are like this. Regarding what I think about the pricing of Splunk Enterprise Security, pricing is something that comes with the territory. If you go for a good SIEM solution, then pricing is almost the same for all the vendors. There is some variation, but almost the same. It is going well, and it is management's decision, not my decision. We need to finalize the tool that we want to use based on what is most suited with the policies of our organization. My job was to finalize the tool that is as per the company's policies and what is best suited with the use cases we had, and we need to give our final judgment to the senior management. We were not involved in the pricing part. I would rate this review an 8 out of 10.

The biggest piece of advice I would say to people looking to use Splunk Enterprise Security in the future is to check the compatibility with the ecosystem of products they are using within the enterprise or within their own business, and see if it is supported by Splunk Enterprise Security. Because if they use a firewall which is not supported by Splunk Enterprise Security, then it will become a challenge in detecting any threats on the firewall because the logs cannot be ingested or consumed by Splunk Enterprise Security. The most important thing is to check their ecosystem and whether Splunk Enterprise Security supports logs from their ecosystem. I rate this product an 8 overall.

In comparison with other products like Honeycomb, Splunk Enterprise Security is one of the market leaders. If you are to say, then absolutely, Splunk Enterprise Security is considered one of the market leaders in log management. Organizations have chosen it because of its powerful search capabilities, real-time monitoring, scalability, and ability to integrate with a wide range of security and IT tools. It is especially popular in large enterprises where analyzing data from multiple sources is critical. Regarding threat detection, because Splunk Enterprise Security collects and correlates data from multiple sources in real time, it helps identify unusual problems and suspicious user behavior such as repeated failed login attempts, abnormal transactions, or access from unexpected locations. By using correlation rules, risk scoring, and machine learning features, Splunk Enterprise Security can detect potential fraud or threats much faster than reviewing logs manually. Splunk Enterprise Security is very strong when it comes to threat detection. It collects logs from multiple sources and correlates the events by itself. Features like correlation searches, risk-based alerting, and machine learning help security teams detect threats much faster and reduce false positives. While Splunk Enterprise Security focuses on detection and investigation majorly, remediation is typically handled by integrated tools such as Splunk's SOAR or other security platforms. Splunk Enterprise Security does its work very well, and threat detection is one of the biggest strengths of this tool. It is excellent in identifying and investigating suspicious activities in real time. I have been working with Splunk Enterprise Security for a good amount of time, and I have been happy to see that their technical teams and support have been generally good and responsive. They were very knowledgeable, especially when dealing with configuration issues, troubleshooting, and best practices. For more complex issues, they usually work closely with us until the problem is resolved. I also found that Splunk Enterprise Security has strong documentation and an active community, which helped us resolve many issues without opening a support case. Some people try to resolve use cases by themselves before putting them to somebody else. They prefer to work more closely with us until the problem is resolved. Splunk Enterprise Security has very strong documentation and an active community that is very supportive and can resolve many issues without opening a support case. Overall, my experience with Splunk Enterprise Security support has been positive. I would rate this review a 9 out of 10.

I am working with Splunk Enterprise Security. I use some third-party solutions for integration or to import data into Splunk. We are creating some custom add-ons. We are also using ServiceNow. When some alerts are triggered, then the incidents will automatically trigger and be assigned to the necessary team. That type of customization we are using for the data collection. If you have some API integration, then you can create your own add-ons using those APIs and the credentials, and you can directly pull the logs from the APIs into Splunk. It is easy to customize Splunk Enterprise Security for our needs. We can customize as per our requirement. If you want to create some dynamic dashboards, then you can also create them as per your use case. It is also the same for the saved search and for the extraction. We can customize things as per our use cases and ideas. I gave this product a rating of eight.

There are multiple ways that artificial intelligence has helped us. For instance, when I'm typing a query to fetch certain details from a certain index, previously I had to be very specific with the index name and everything. Now, if I type the initials of the index, it will automatically pop up with all the indexes that are already present. That's one feature that helps in writing the queries. Additionally, when I'm creating some kind of a metric or creating some applications into Splunk Enterprise Security, it will give me suggestions. Previously, I had to be very specific about what application I'm creating, for what all servers, or what components of Splunk Enterprise Security I'm creating that application for. But now, there's already a mechanism where I just have to toggle the buttons and then everything is already ready to use. Previously, if some incident occurred, it would take at least 30 minutes for us until the incident was detected and the right team was informed and the alert was triggered, and then everyone jumped onto a war room and analyzed the pattern. Now, Splunk Enterprise Security itself will detect it and block it. It will trigger an alert based on the condition and automatically take an action and the engineer can go and do an analysis of that event. The Mean Time to Detect has reduced significantly from 30 minutes to around 5 minutes. We have set up a threshold that we call a dampening frequency. For example, we have an alerting setup that anything with a response event of 500 should be captured. Previously, every time the 500 server response came, it used to trigger an alert. We have set up a query where if the 500 comes three or four times, then only trigger an alert. We call that server response dampening. This is how Splunk Enterprise Security helps us. Splunk Enterprise Security is really good. I do not have any comments or suggestions. I find it really good. I can access it directly through Splunk Enterprise Security. My overall rating for this product is 9 out of 10.

I am using a new threat detection feature in Splunk. When I implement Splunk, it provides a dashboard or methods to implement these threat detection processes. It gives me an email trail that identifies when services and which users are trying to breach security. If any service has failed, then it also triggers an email or a notification in the dashboard. These are rare cases, but I find the average number to be acceptable. I have used Azure for deployment. I rate Splunk Enterprise Security nine points out of ten, and my overall review rating for this product is nine out of ten.

AI-driven detection is a hit or miss at best because we get hundreds of alerts daily. There are a few incidents where AI-driven detections do give us false positives, but 90% of the time it has helped us in detecting attacks faster and taking action on it. AI-driven detection basically analyzes patterns and identifies suspicious patterns. Many traditional rules or traditional alerting mechanisms may miss these patterns. This has helped us in making decisions based on incidents which even human analysts cannot determine clearly. This could have happened because AI has all the log sources and all the patterns, making it very easy for AI to correlate these logs and identify a pattern. AI indicates to the analyst that this could be an attack and to please look into it. If a human had to do it, it might take them a lot of time compared to AI. In my experience, risk-based alerting has been very helpful. In my company, we have set it in a certain way that when we have set certain parameters, if there is some amount of risk, we trigger an investigation or incident or escalate this incident to L2 or L3 accordingly. We have a mechanism where if it is above 50, we alert L1. If it is above 75, we alert L2s. If it is above 90, we alert both L2s and L3s. Risk-based alerting has helped us in segregating these alerts, and because of that, the time of analysts is divided and they can focus on other areas of their expertise. MITRE ATT&CK mapping, as I have mentioned before, with any incident we get, it easily maps it to MITRE ATT&CK and gives us the whole log or storyline that shows which MITRE attack it is mapped to. Threat topology is based on certain incidents. For example, if it is an unusual user login, it gives us a detailed topology of who the user is, which host the user has logged into, how many login attempts they made, and whether the source IP is known or unknown. Threat topology helps us in these aspects, and MITRE ATT&CK mapping helps us in auditing as well later on. The credit mainly goes to AI-based detection because of how fast it correlates and works on the logs. The speed at which AI identifies patterns and gives us an alert based on that, indicating this could be a potential attack, is one major reason. Real-time log ingestion from different sources of devices like firewalls, endpoints, EDRs, and network devices is another factor. Since this is happening in real-time with no delay in between, we can catch AI-based attacks which will happen in the future, helping us get an advantage over them. Risk-based alerting also helps in a certain way. Since we know it is of a particular risk level, if it is about 85 or 90 risk, we have to take certain action on it depending on the risk level. Essentials has helped accelerate detection because it has avoided pre-built correlation rules and MITRE mappings, providing MITRE mappings with dashboards and use cases that can also be built. We do not have to build everything from scratch. It is built on its own, which is a good thing. This helps us with faster deployment and reduced time in creating dashboards and other things. In percentage terms, Essentials has improved the time taken to detect or respond to an alert by approximately 25%. It is a rough estimate between 25 to 50%. We do depend moderately on Essentials helping us detect alerts faster. We have built custom threat intelligence feeds in my company which help for certain clients. We built these custom threat intelligence feeds in-house first, and when we insert them into our environment, they specifically look out for malicious IPs or hashes which we provide in the threat intelligence feed. Based on that, if we get any incident or any malicious IP which traditional Splunk Enterprise Security or Essentials cannot detect, the TI feed works well in that case and helps us block the IP and gives the analyst an alert that a malicious IP was found and to please look into it. It has helped me in prioritizing things. We can prioritize easily. If there is a hit from the TI feed, we can look at it first because it was custom built by us and we know how malicious or bad the reputation is. The best thing is that it reduces the load of checking every time the reputation of an IP or a hash. For example, if we get a normal incident, we have to check the IP and hash to see if it is malicious, check certain platforms or Splunk Enterprise Security or other tools. The effort and navigation fatigue gets reduced, and the TI feed gives the analyst the information directly that this is malicious with references or that this hash is malicious and has been found malicious by these websites. We have also built correlation rules based on the TI feeds. If we get a hit from a TI feed plus AI-driven detection also gives it a suspicious rating that the patterns are suspicious, then it is automatically escalated to our L2s and L3s and they look into it carefully. Operational visibility is another important aspect. It detects service failures, app crashes, or if any firewall is down or if any devices are down. We will get an alert as soon as possible after a certain time if a device stops responding. The operational visibility is pretty good so far. Compliance support is another benefit. We have many audits quarterly, and it helps in generating reports based on compliance protocols and procedures, whether HIPAA, NIST, or PCI DSS. We get reports very easily. It gives me more context since it combines all the logs from various sources. One major thing is log validation. One log can be verified across various sources against another source. If we get only failed logins or if we get a failed login incident, we can also see which endpoint it is from or which firewall is connected to it or who is connecting to it and what the user privileges are. This builds stronger confidence overall. SOAR has helped us a lot in our environment. Consolidating SIEM, SOAR, and UEBA has improved visibility, detection, response speed, and efficiency. SIEM's main use cases detect the alert, UEBA adds some context to it, and SOAR does the rest by automating the alert generation and the required processes that need to be done. UEBA gives us very deep insight into the behavior of certain users or certain devices. It helps to make a baseline for behavior. UEBA learns the normal user and host behavior. It knows when it is a normal time for a user to log in and when it is unusual. It detects deviations and anomalies such as unusual login time, impossible travel, VPN usage, unusual process execution, or requesting higher privileges. This happened last week. UEBA helped us detect an impossible travel for a user who was present in the office working with us. UEBA detected that another login was observed from the Philippines, which was very unusual because the user was with us at that moment. We asked the user if they had logged in from a VPN. The user said they did not log in from a VPN. We had to look into it very carefully, and L3s and L2s were brought on to investigate it very carefully. It was then later realized that the user was indeed using company VPN but was not aware of it. I would say it is a very good tool that everyone should get experience with Splunk Enterprise Security. However, I have heard that it is not accessible to everyone because of its cost, but it is a very good tool and every analyst should have some hands-on experience with it. My overall rating for Splunk Enterprise Security is nine out of ten.

My advice for anyone considering Splunk Enterprise Security is to understand the basics of logging systems first and determine your use cases before building specific functionalities in Splunk Enterprise Security. We have recently upgraded to Splunk Enterprise Security 8.0, and we are evolving everything now. We are evolving frameworks and many other things within it. I would rate this review an 8.5 overall.

On average, the time a SecOps team takes to remediate security incidents with Splunk Enterprise Security depends on projects. If the team is working as a threat hunt team, they do not have a proper SLA, but for incident handling, some projects have 15 minutes, others 30 minutes, one hour, or in some cases, up to four hours. It varies according to the project and client requirement; incident handling is different from incident response, which usually requires more time for detailed analysis. I am totally satisfied with Risk-Based Alerting because it works well; it works on intermediate findings. If multiple detections occur for the same host or IP, it looks for behavioral analysis and generates alerts for the analyst based on that risk, so it is actually working well in Splunk Enterprise Security. I can recommend Splunk Enterprise Security to other users. My overall rating for this product is eight out of ten.

Splunk Enterprise Security is a worth buying product if you are able to leverage all the features and the capabilities or if the team is strong to leverage all of them. The percentage of savings depends on what we are comparing. It is straightforward; if the team is experienced with Splunk Enterprise Security, it is quite straightforward and quite fast. Regarding business resilience, Splunk Enterprise Security does improve business resilience because I am able to protect my assets and hence improve the resilience. I am able to solve problems in real time, to predict, and to identify threats. It helps my detection to be faster, which is about 40 percent faster. The overall review rating for this product is 8 out of 10.

Splunk Enterprise Security represents a fair price for what it can accomplish. I would rate this product a ten out of ten.

The platform's ability to predict, identify, and resolve threats in real time is exceptional — but that capability is not absolute. It is heavily contingent on the team behind the platform. A highly skilled, experienced team with deep knowledge of Splunk's configuration complexity can genuinely extract a 9 out of 10 level of performance from the platform. However, a growing or maturing team navigating diverse and complex scenarios — particularly in hybrid and multi-cloud environments — would realistically deliver around 8 out of 10, as the learning curve and operational complexity inevitably introduce some gaps. The one point I withhold from a perfect score is precisely because of this team dependency — the platform's effectiveness ceiling is ultimately defined by the people operating it, not the technology alone.

Splunk Enterprise Security is the most significant challenge. I rate this product at nine out of ten.

The mean time to resolve in Splunk Enterprise Security will increase. On other platforms, whenever you create alerts, you only need to see what is there and then troubleshoot everything. In Splunk Enterprise Security, when you create an alert, you can add many additional things. For example, once an unknown IP is detected, it will send an email, create an incident, and create a notable inside the security system. It can do many things and you can add more information. You can check a lookup, check an IP, or follow specific steps. You can add multiple steps to follow as well. All of this will be included with the alert, which resolves a lot of mean time. People do not need to go searching to find how to do things. This significantly reduces the time needed and alerts are immediate. Whenever something goes wrong, you will be notified quickly. With Splunk Enterprise Security, we detect threats frequently. I work with a major client in the Emirates, and we find a lot of attacks happening and many phishing emails. Sometimes we have two firewalls, one is a DC firewall and one is a Palo Alto firewall, with many compliance requirements. People attempt to access these systems and sometimes send vulnerability emails. For all of these things, we are blocking and detecting with Splunk Enterprise Security and immediately notifying the candidate to not open emails or notifying our team via email. It reduced the analyst's workload in Splunk Enterprise Security. However, after purchasing Splunk Enterprise Security, we hired more people to analyze the data. By purchasing this product, we came to understand that we can implement additional features and security rules. Our team is continuously and actively working, checking the MITRE ATT&CK framework, finding detections, and implementing them on our platform to make it more secure. MITRE ATT&CK helps detect patterns that have occurred before. ES Essentials is in our environment for Splunk Enterprise Security, though I have never focused much on working with it and do not know much about what it does. Overall, I would rate this review as a nine.

Regarding the feature called Risk-Based Alerting, I have tried using it. For Splunk Enterprise platform, I have contacted them many times and within 48 hours, we received a good response from them. Not everybody has 100 percent knowledge, so response can take a longer time depending on the issues we are facing. Regarding the impact of Risk-Based Alerting on alert volume or analyst productivity, Risk-Based Alerting is one of the most useful features in Splunk Enterprise Security. Instead of generating too many individual alerts, we can assign risk scores to different events based on their severity and context. For example, if a user shows multiple suspicious activities such as failed logins, unusual location access, or privilege escalation attempts, each of these events contributes to a cumulative risk score. Once that score crosses a defined threshold, it generates a notable event which helps us focus only on higher priority incidents. This approach has helped us reduce alert fatigue and avoid chasing false positives. It also makes prioritization much easier for the SOC team because we can clearly see which users or systems are actually risky instead of reacting to every single alert. Regarding the impact on operational efficiency, manual work has been reduced. The automation of alerts has helped us significantly. A human could miss alerts, but AI could not so far. Splunk Enterprise Security has helped us considerably regarding this. The AI component is great as it can automate any kind of use case we have and detects and gives us notification for that particular alert. While you could expect a false positive, they are negligible compared to the correct ones we are receiving. I would rate this product eight out of ten.

My overall experience is eight years, and relevant to this field is six years. Whenever any new add-ons and integrations we are doing, we actually need to upgrade ourselves. We recently had an upgrade of utilizing Python scripting for scripting. For on-premises Splunk ITSI (IT Service Intelligence), I would give six out of ten. For the cloud solution, I would give nine out of ten. For the overall score for the support of Splunk ITSI (IT Service Intelligence), I will give seven out of ten. I am a customer of Splunk ITSI (IT Service Intelligence). I am continuing to learn on Splunk things based on different platforms, Linux, Windows, and also on cloud. So far it has been so good. It is a good journey and I am feeling positive about it. Splunk ITSI (IT Service Intelligence) is very understandable. Everybody says Splunk is a complex environment, but it is not much complex. We can adapt and we can quickly learn if anybody is starting a new journey on Splunk ITSI (IT Service Intelligence). I have thoughts on legal statements and the process of creating an account. My overall review rating for Splunk ITSI (IT Service Intelligence) is nine out of ten.

There is integration between third parties with Splunk Enterprise Security. For example, we can connect a Tenable vulnerability assessment tool. It has inbuilt features to trigger automation actions. We have integrated a lot of products, and when you want to trigger SOAR or something of that nature, third-party applications are already available. For instance, when you integrate Tines, there are extensions available, making it a more powerful tool. This systematic integration is beneficial to us. Regarding risk-based alerting in Splunk Enterprise Security, there are a lot of contents available from Splunk used as rules or searches. If we design systematic inputs and use cases, it does provide a lot of threat-based detection, showing what detection is happening right now and how advanced automation is expected to happen. Those visibilities are available with Security Essentials. The resolution of security incidents using Splunk Enterprise Security is quite faster. However, faster remediation ultimately depends on the security operations. The detection with Splunk Enterprise Security is effective, but the story starts afterward. In the actual products, such as Splunk Enterprise Security, 20 to 30% of the time is spent on detection and investigation for incidents. The combination of Splunk Enterprise Security, ITSM tools, and SOAR on a single platform provides a value-add, allowing for a more efficient resolution process while considering costs for security teams. For threat detection features in Splunk Enterprise Security, it is necessary to build use cases. SIEM tools are not purely threat detection tools; they are notification tools for threats detected elsewhere. We can do anomaly detection, but detecting actual threats requires specific signatures that we haven't explored yet in depth. For threat detection features, it is vital to build use cases and compare anomalies such as a significant increase in login attempts. Anomalies can be detected in Splunk Enterprise Security, but defining signatures for threats is a task we still need to explore. We work in both cloud and on-premises models, with our on-premises being integrated with cloud services from certain vendors. I would rate this product overall a 9 out of 10.

Product adoption improves once you have the trained resources in the market, but if you do not have trained resources, then they will make mistakes in the implementation and deployment, and then people see that. If there are limited resources in the market, they will be very costly. Whoever is on that particular technology will not be affordable, and that also decreases the chance of the company to grow.

I am currently working with Splunk products. I work with Splunk Enterprise and Splunk Enterprise Security. The process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security is pretty easy for me as an expert, but I'm not sure for a new user; being a Splunk architect, I feel it's a little easy and the customization is very helpful. We have it integrated with various disparate solutions including RSA, CrowdStrike, AWS, Google, Microsoft, Docker, firewalls, switches, and multiple other technologies. This integration supports my security operations by fetching logs about user activity and audit logs and actions taken by the user; for normal products, this allows me to analyze, detect, and correlate two or three different datasets to build up a use case from which I can deduce some information, and with the queries I have using SPL queries, I can get some data analytics or alerts or reports based on which I can take action. I use risk-based alerting in Splunk Enterprise Security. My experience with risk-based alerting, while not mainly focused on the SOC part of Splunk Enterprise Security, provides support to my engineering efforts. I am not currently using any new threat detection features in Splunk Enterprise Security; I have no idea about that part of it. My impressions of Splunk Enterprise Security's capability to predict, identify, and solve problems in real-time depend on what kind of data is being received and the use cases being written; it is not straightforward, but because Splunk Enterprise Security is an analytics platform without AI on top of it, it feels that some data sources are less predictable, yet for jobs that are repetitive or similar, Splunk Enterprise Security works well. I would rate this product a 9 out of 10.

I do not see a real difference between XSIAM and Splunk Enterprise Security; they both have a search query functionality. Splunk Enterprise Security has Splunk query language, so it is just a different language and different way of searching logs. Eventually, we get the same logs including source, destination, port, and traffic allow and deny information.I used to be a customer with Splunk Enterprise Security. I have hands-on experience but not extensive experience with Splunk Enterprise Security products in the past. I am more focused on networking than the security team. I do not have an answer about how long on average it takes SecOps teams to remediate security incidents using Splunk Enterprise Security. I would rate this review an 8.

I do not have additional data for providing more detailed advice. My overall rating for this solution is eight.

For any user who wants to have a cost-efficient and next-gen SIEM solution, I wouldn't recommend Splunk Enterprise Security. However, if a user is not concerned about cost and is looking for an on-premises solution, then I would suggest Splunk Enterprise Security. For anyone who wants to go for a cloud and cost-effective solution with next-gen capability, I wouldn't recommend this. I would rate it a seven out of ten.

I am reviewing Splunk Enterprise Security today, and I am working on one simple product and creating simple SPL. My thoughts on customizing, developing, testing, deploying, and refining detections are focused on detection. The testing is just the last component. My thoughts on the testing feature in Splunk Enterprise Security involve the network traffic to Cisco traffic, Uniper, or low car infrastructure. I am using new threat detection features in Splunk Enterprise Security and would work on big projects in the future. I do not use disparate security solutions that integrate or import data into Splunk Enterprise Security. I am wanting to learn more because I create simple SPL, and my friends are not Splunk Enterprise Security expert admins. I would recommend Splunk Enterprise Security to other users because it is a platform for monitoring all traffic, network infrastructure, hardware, software, and everything. I rate the solution overall as a five out of ten.

I would rate it an eight out of ten.

I know that our SOC team does use Splunk Enterprise Security to prioritize and investigate high-fidelity alerts, however, I'm not sure how it helps them specifically. I can say that many different teams in the business use it very heavily. We do utilize UEBA in our company, yet not Splunk Enterprise Security UEBA from my understanding. I'm not part of those teams, so I wouldn't have an answer for how it specifically functions. I would rate Splunk Enterprise Security a ten out of ten. I advise other companies considering Splunk Enterprise Security to recognize that it is utilized by massive companies and is more practical. I would suggest finding what works for their environment and evaluating all related costs as those are important factors. Overall, Splunk Enterprise Security delivers, which is what truly matters.

I would advise other organizations considering Splunk Enterprise Security to use it and also utilize the built-in ES Content Pack, where you have many rules ready, instead of trying to figure everything out. Use that content pack to start, and once you have the basic fundamental detection rules, then you can expand on it. On a scale of one to ten, I rate Splunk Enterprise Security an eight.

The most significant challenge I face when using Splunk Enterprise Security for advanced threat detection is alert fatigue. Although there are ways to mitigate it, it remains a persistent issue, as evidenced by complaints from analysts. While alert fatigue is alleviated to some extent, it still persists. My advice to other organizations considering Splunk Enterprise Security is to at least give it a try; I know there are other solutions in the market, some of which may even be better than Enterprise Security, however, you have everything on a single pane of glass, so I think it's definitely something that enterprises should test. On a scale of one to ten, I rate Splunk Enterprise Security an eight out of ten.

On a scale of one to ten, I would rate Splunk Enterprise Security an eight.

My advice for other companies considering Splunk Enterprise Security is that if they're looking to enhance their security visibility or establish a security operation center, this tool is an excellent starting point, and they can scale and automate processes using SOAR effectively. On a scale of one to ten, I rate this solution an eight.

Splunk Enterprise Security has helped improve our organization's business resilience. It helps us respond to various needs in our different regions or plants, aiming to obtain critical information to reduce the impact of hacks in our plants. I would absolutely recommend Splunk Enterprise Security. Every time I have the opportunity to promote or explain how it works, people say it is amazing, and I agree. It is an integrated solution that stands out against competitors, and though it may be expensive, it delivers good quality. I would rate Splunk Enterprise Security overall a nine on a scale of one to ten, considering the current improvements.

For the future of Splunk Enterprise Security, I would want the Edge Processor to be able to send to multiple destinations rather than just Splunk, though that is more about Observability. The advice I would give to other organizations considering Splunk Enterprise Security is that everybody wants to drive a Ferrari, so get the Ferrari of SIMs. I rate Splunk Enterprise Security ten out of ten.

We just started turning on UEBA in our company, but we haven't really started utilizing it yet. There is a roadmap to try to do some of that stuff from the program side, and we just have to get access to it once the enterprise is ready to implement it and hand it over to the program office. Even though we just started using UEBA, it's very useful, and it helps us set a bar for what normal activity is, and then it sets alerts and gives us awareness for anything that's out of the norm in terms of normal user behavior and the data that's being accessed. My advice to other companies considering Splunk Enterprise Security is that you should definitely look into it, get your folks a proof of concept and try it out, send folks to training, and let them learn about it, and see how it can help you be better at securing your environment. I rate Splunk Enterprise Security nine out of ten.

I am not directly involved in pushing new detection in Splunk Enterprise Security. However, I do tune detections; if a detection is firing too much or I feel we could edit the detection, I find it quite easy to do. My organization does not use risk-based alerting in Splunk Enterprise Security yet; we're working on it. The advice I would give to other organizations considering Splunk Enterprise Security is to contact them, contact the sales rep, the tech rep, and ask them for a PoC trial. They're very open with this and even with new features. Before we buy anything new, such as SOAR, Splunk offers us to do a PoC. They give us a license to try it for free for a few months and give feedback if interested or not. For any enterprise thinking about it, I would contact them and get them to do a free trial for a while. On a scale of one to ten, I rate Splunk Enterprise Security a nine.

My advice to other organizations considering Splunk Enterprise Security is to weigh their options, but I would definitely recommend it. On a scale of one to ten, I rate Splunk Enterprise Security an eight.

I rate this product seven out of ten. Nothing is perfect, and there is still room for improvement.

My advice to other organizations considering Splunk Enterprise Security is to follow the documentation and not build your own stuff. On a scale of one to ten, I rate this solution a nine.

My advice to other organizations considering Splunk Enterprise Security is that while not everyone needs the top breed, ensure you have the resources and time to invest in it if you decide to use it. Anything off the shelf won't be as valuable as something you invest in and put time into, so the more you put in, the more you get out. I would rate Splunk Enterprise Security overall as probably an eight out of ten; it is industry-leading.

The advice I would give to other companies that are considering Splunk Enterprise Security is that if you've never used Splunk, it can be a little daunting at first, learning a new language, Splunk SPL. That said, it's worth it. The cycle time that's going to be taken in training and upskilling, once your staff is familiar with that, and you don't even have to do a lot of training, just a couple of the basic classes from Splunk University to get proficient, it's going to open a lot of doors. On a scale of one out of ten, I rate Splunk Enterprise Security a nine out of ten.

Splunk Enterprise Security handles problems in real-time. When rating Splunk Enterprise Security overall, I'd give it a nine out of ten. I appreciate that it has a good UI that looks good and works well. I would recommend Splunk Enterprise Security.

My advice to other organizations considering using Splunk Enterprise Security is to do your homework. Attend industry peer sessions and learn from other organizations. Splunk's partner program, RBA Community offer compelling resources for new customers. I would rate it an eight out of ten.

I'd give Splunk Enterprise Security a rating of ten out of ten. My advice to other companies considering Splunk Enterprise Security is to just do it. Don't look at any of the competitors; Splunk, hands down, is the product that I would recommend to other companies.

My advice to other organizations considering Splunk Enterprise Security is that it's the leader in SIEM globally. You have a lot of customization and data normalization, meaning you can detect anything you want compared to other SIEMs. Splunk Enterprise Security is worth the investment because it provides exactly what you need if you are a true cyber defender. I also network with friends from a company, Next-Gen Systems, which is leading in detection and investing in developments and integrations with Splunk due to its scalability. On a scale of one to ten, I rate Splunk Enterprise Security a ten.

The advice I would give to other organizations considering Splunk Enterprise Security is to work with professional services. It's a large undertaking for your SOC, so work with professional services that have seen different examples and situations and lean on their expertise to help you develop the right solution. I would rate Splunk Enterprise Security overall on a scale of one to ten as probably about an eight; there's still some work to be done, however, it's the best that we can do right now.

My advice to other organizations considering Splunk Enterprise Security is that it is definitely worth implementing, but it must be done properly. Make sure you have all preparations complete before getting the implementation package. I rate Splunk Enterprise Security eight out of ten.

In our strategy to combat insider threats and advanced persistent threats, Splunk Enterprise Security plays an important role with its UEBA features, helping us identify outliers from baseline behavior that assists in detecting anomalies or insider threats that may otherwise slip through traditional defenses. I advise organizations considering Splunk Enterprise Security to proceed if you are already a big Splunk shop with an underlying platform deployed, as it seamlessly integrates with your existing data and allows easy onboarding of additional technologies within the Splunk ecosystem without additional overhead. Considering the overall performance, I would rate Splunk Enterprise Security as an eight out of ten, recognizing it as a powerful platform within our SOC toolkit.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection relate to the RBA, which is something that we were struggling with. We are working with the SIM and our reseller to streamline that process. That's something that's not easy for every organization. We are going through the same turbulence. My organization does not completely utilize risk-based alerting in Splunk Enterprise Security as it's not fully mature. It is supporting our SOC in a limited way. We still have a long way to go. The product is not completely mature. We are a unique organization, so it requires additional resources to get that work done. My organization is in the process of expanding our security use cases. It's a multi-year model where we are strategizing and exploring all our security needs. I would say we are still in the early phase. Although we have the product in place, it was not yet mature due to some resource issues. My advice to other organizations considering Splunk Enterprise Security is that it's a good product. It's definitely helpful. If somebody is looking for security and log management, investigations, incident, and IRP, then they can look into this product and explore it. It's one of the market-leading products. It definitely stays up to the mark. On a scale of one to ten, I rate this solution an eight.

Regarding whether Splunk Enterprise Security's ability to ingest and normalize data from diverse sources has enhanced our threat detection capabilities, it is based on a system we have, and since we have a SIM, the data is already segmented coming in. In terms of whether Splunk Enterprise Security has helped reduce our team's average meantime to detect, it's still very early in the rollout phase. I can say that as time goes along, it's a bit quicker and has sped up, however, we haven't yet gotten any specific metrics. We haven't used UEBA, but we've used UBA, which is what the system is based on. There's Splunk UBA and then there's Splunk UEBA, which is integrated into Splunk Enterprise Security. I would rate Splunk Enterprise Security an eight out of ten. My advice to other companies considering Splunk Enterprise Security is to avoid setting it up as a separate test system. It's crucial to integrate it into your main system because one of the main issues we've faced is managing the amount of data and understanding that you want to feed it as much data as you can.

My organization uses risk-based alerting in Splunk Enterprise Security, which supports our SOC by negating through false positives. On a scale of one to 10, I would rate Splunk Enterprise Security an eight.

We use multiple best-of-breed products to provide data to Splunk Enterprise Security for correlation and malicious activity determination. My organization does not use risk-based alerting in Splunk Enterprise Security. We use third parties for threat detection features. Splunk Enterprise Security's impact on business resilience is unclear as we use it exclusively for cyber purposes. My advice to other organizations considering Splunk Enterprise Security is to use it. On a scale of one to ten, I rate this solution a nine.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are that it takes some time to get the hang of the platform, and it has a slight learning curve associated with it. Other than that, I have no complaints. The advice I would give to other organizations considering Splunk Enterprise Security is to try it out and see if it fits their requirements. It's highly flexible, highly customizable, and can scale according to needs. On our rating scale, I give Splunk Enterprise Security an eight out of ten.

My advice to other organizations considering Splunk Enterprise Security is that unless you're really big, don't spend the money. On a scale of one to ten, I rate this solution an eight.

I would advise other organizations considering Splunk Enterprise Security that the new version looks impressive. If organizations want the new, complete package, I would recommend ES Premier, as it combines ES with TIM, UEBA, and SOAR. On a scale of one to ten, I would rate Splunk Enterprise Security a seven. I believe ES is doing its job, but it is slightly behind its competitors. Other competitor platforms already have AI integrated, and they just announced it today, so it feels somewhat behind. However, I am looking forward to this new feature.

The biggest advice I would give to anybody considering Splunk Enterprise Security is to understand what you want your organization to look like. What kind of things do you need your SOC to do? If you're just looking at doing basic auditing and alerting and reporting, there are features you can use. If you're wanting to do more threat hunting and incident response and go from ordinary to extraordinary, there are many features Splunk will help you utilize. It's really important that you understand what you want your SOC's identity to look like. As you partner and do your proof of value with Splunk, you can focus on those features that align to your immediate needs, as those you're curious about growing into, where you might see your organization in the next one year, two year, three year, five year type of journey and how those features really align, knowing that you've got a partner that's going to allow you to happily exist where you're at, yet also support you on the growth where you're wanting to go. I'd rate the solution nine out of ten.

The advice I would give to other organizations who are considering Splunk Enterprise Security is to just do it. It's honestly one of the best investments you'll make. You'll start noticing the return on investment really quick. You'll start to notice answers that you did not know you had to questions that didn't exist. You'll start to notice your meantime to detect goes down as you start implementing RBA and embracing the Splunk base itself. On a scale of one to ten, I would rate Splunk Enterprise Security a solid ten. It answers questions you didn't even know you had, and as you drill through the dashboards and go through the different features that are available, you start to realize all this available information that's there that you didn't even know your data had those answers to. It really starts bringing that value within your first 30 days of using it.

The features that have been demoed and debuted in Splunk Enterprise Security are of particular interest, and I'm interested to see where that journey continues. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security relatively easy with training. My advice to other organizations considering Splunk Enterprise Security is to try it. I would suggest getting a demo from Splunk as that's the worthwhile approach. It's better to see all the powers that this tool can bring in terms of those capacities rather than trying to figure it out on your own journey. I would rate Splunk Enterprise Security an eight out of ten. The only reason for this rating is, from an outside-in perspective, as someone who hasn't spent time either deploying it themselves or learning more of the nuances of how clustered designs work, it can be an intimidating experience and requires a lot of hand-holding. This creates a barrier to adoption.

My advice to other organizations considering Splunk Enterprise Security is to make sure you understand all the functionality of it, not just what they show you, but also the integration points; understand the automation side of it and get a good holistic understanding before making a decision. On a scale of one to ten, I rate this solution a seven out of ten.

The most significant challenges I face when using Splunk Enterprise Security for advanced threat detection are related to the data. Onboarding the data, trying to get only what we want and what matters for security is a challenge every day. We're trying to onboard what matters and what is significant for security. We use Splunk solely for security purposes. Some people see Splunk as a data analytics tool, which it is, but changing people's minds that we use Splunk for security is an everyday challenge. I am not using any new threat detection features in Splunk Enterprise Security currently. My impressions of its ability to predict, identify, and solve problems in real time are good, even though we don't use many things out of the box. We use most of the out-of-the-box features and customize them. We have just a few out-of-the-box use cases in place. The advice I would give to other organizations considering it is to send people to training before getting Splunk Enterprise Security. You can use my real name when publishing my review. On a scale of one to ten, I would rate Splunk Enterprise Security a nine.

My organization does not use risk-based alerting yet. My security ops team takes 60 or 70% longer to remediate security incidents with Splunk Enterprise Security compared to our previous solution. The advice I would give to other organizations considering Splunk Enterprise Security is to design, design, design, and design. Expanding on what that means, you need to be very organized with what you want and what you want to achieve from the product because the deployment is very crucial; once you install it, it's very hard to change the topology and to add more tenants or search heads, which is very complex. The vendor can contact me with any questions or comments about my review. On a scale of one to ten, I would rate Splunk Enterprise Security overall an eight.

I would advise other organizations to consider Splunk Enterprise Security as it's an easy solution to implement and effective for its intended purpose. On a scale of one to ten, I rate Splunk Enterprise Security an eight.

The most significant challenges I've faced when using Splunk include getting the code right. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security to be good, as changes are easy to make. On average, my security ops team takes about three days to remediate security incidents with Splunk Enterprise Security, depending on what the incident is. My advice to other organizations considering Splunk Enterprise Security is that it depends on their needs and costs, but I think it can cover everything from a small business to a large business, so I would definitely recommend it. On a scale of 1-10, I rate Splunk Enterprise Security an 8.

My advice to other organizations considering Splunk Enterprise Security is to try it if you don't know about it yet. On a scale of one to ten, I would rate Splunk Enterprise Security overall as an eight. Sometimes it is a bit hard to get the searches and the data done, but all in all, it's a great product.

Splunk Enterprise Security can make mistakes, so we do not solely rely on the out-of-the-box detections. It can also be part of a hybrid or multi-cloud environment. Everything depends on who teaches you Splunk Enterprise Security. Someone can teach you, and it becomes simple, or it can become complex. To me, it is not complex as I am experienced in using Splunk Enterprise Security. I utilize Splunk Enterprise Security to analyze and conduct investigations as part of my job. There is minimal intrusion, so I receive few alerts regarding malicious threats. We do not have a partnership with them; we use it as a normal user through the internet. Regarding sustainability, manufacturers must continually update their products, add new features, and optimize them. They need to optimize extensively because with threats and vulnerabilities, we always have to update to the latest features. Overall, when it comes to performance and reliability, I rate Splunk Enterprise Security an eight out of ten.

I rate Splunk Enterprise Security higher due to its user-friendliness. That is something on top of my list. Splunk Enterprise Security is on top in terms of how users or administrators can manage it. Everything else looks pretty fine regarding the support we get from Splunk Enterprise Security. I would rate Splunk Enterprise Security overall as eight out of ten.

I would rate Splunk Enterprise Security an eight out of ten.

I would rate Splunk Enterprise Security an eight out of ten.

Splunk Enterprise Security has approximately seven different AI capabilities. These include natural language processing for search query assistance, machine learning for alerts and data processing, and plugins such as Tensor for external AI processing. However, I remain cautious about enabling all AI features without understanding their performance impact. I would rate Splunk Enterprise Security a nine out of ten.

This product requires significant investment in learning as it is not easily understood. Organizations purchasing the solution should expect 6-12 months with a dedicated team before meaningful insights can be delivered. On a scale from one to ten, Splunk Enterprise Security rates as a seven.

I am preparing my master's degree and conducting this review for completing it at KFUPM University, King Fahd University of Petroleum and Minerals, located in Saudi Arabia, to prepare for my defense. I have experience with blue team tools, specifically Splunk Enterprise Security and some other solutions. The company name is Cyberani Solutions, and my email is first name dot last name at cyberanisolutions.com. PeerSpot will create an account and email the login credentials, and my feedback will be published and possibly shared with third parties if I choose to not remain anonymous. I would rate Splunk Enterprise Security an eight.

On Splunk Enterprise Security, we imported from the content library, specifically from the content management page that contains many rules; we are importing rules from there, enabling rules, and editing them. I'm not a deep down administrator of Splunk Enterprise Security, so I'm not arranging the data models. I'm mostly editing the rules. On a scale of one to ten, I rate Splunk Enterprise Security an eight out of ten.

I would rate Splunk Enterprise Security an eight out of ten.

Overall, I would rate Splunk Enterprise Security an eight out of ten.

Overall, I would rate Splunk Enterprise Security a nine out of ten.

I participated in the deployment process of Splunk Enterprise Security, and we performed UAT before moving it to production. It's not the most affordable solution, as I've witnessed several companies considering leaving due to cost factors. The pricing of Splunk Enterprise Security is not very affordable, and I have seen many companies planning to leave because of cost concerns.

We are currently using Splunk Enterprise Security for our SOC in our office, and as long as the office continues its use, we will still be using it. I haven't faced any other difficulties apart from the CPU resource issues. I find Splunk Enterprise Security to be very customizable and user-friendly. The only consideration is that if we want to increase the volume of logs processed, we need to buy more licenses. Maintaining Splunk Enterprise Security requires personnel, especially due to the existence of different search heads and various forwarders in our robust setup, supporting a centralized logging environment. I find it easy to scale Splunk Enterprise Security for our environment, and I would recommend that potential users consider their capacity to invest financially based on the criticality of their infrastructure, as adoption comes with licensing costs. I would rate Splunk Enterprise Security an eight out of ten.

Instead of going for the cheapest solution available, you should go for the one that meets your needs. It takes time for an organization to onboard a new solution, so it is important to choose the right solution from the start. I believe all available solutions are pretty good, so you should see what suits you better. It is a great tool. If you learn to navigate it, you can access a wide range of information about any application or product. It is a very helpful tool, provided you know how to use it. Overall, I would rate it a nine out of ten.

Splunk has disadvantages such as cost and resource requirements. However, once I invest, it's a powerful platform that ranks number one in SIEM and observability. I rate the product nine out of ten due to pricing concerns and threat intelligence management not being advanced. I believe Splunk is the top SIEM tool. However, the term "enterprise security" is misused when applied to Splunk. While many vendors claim to offer "enterprise security," true enterprise security should cover all aspects of cybersecurity. Splunk excels in SIEM, SOAR, and UEBA, but it doesn't address other crucial areas like firewalls, PAM, or web/mail gateways. Therefore, Splunk shouldn't be categorized as an "enterprise security" solution. Although Splunk leads in SIEM with its superior visibility and observability, it lacks presence in other essential cybersecurity domains.

I would rate Splunk Enterprise Security nine out of ten. Splunk Enterprise Security requires continuous maintenance and support, which requires a dedicated team. Previously, seven to eight personnel were focused on platform maintenance. Additional resources may be required to optimize for multiple customer environments. For those evaluating SIEM solutions solely based on cost, Splunk might not be suitable. It is essential to consider security, context, and specific use cases rather than just choosing based on price. Critical assets need the right platform for effective protection rather than opting for a cheaper solution.

Overall, Splunk is among the top three SIEM tools due to its capabilities and agility in bridging business analytics with security needs. They very much deserve where they stand on the Gartner Magic Quadrant. I like it a lot better than ArcSight, which was owned by HP at one point or another. In comparison to that, Splunk is much more agile and quick. It comes from a business analytics perspective. It is a lot easier to build the bridge between the business and security based on that platform. As far as stability and scalability are concerned, it is a brilliant solution. I would rate Splunk Enterprise Security a nine out of ten.

Cost and vegetative growth in the medium/long term. It is a great tool but you have to be careful in storing a lot of data (without any criteria). Use it as an "smart-data/small-data repository", not as a "raw centralizer, stage-area or pure-SIEM". The quantity of "use-case" is not so big when compared with others tools (and for example, you dont have specific use-cases divided by industry-segments". Before choose any tool and define your BOC (Business Operation Center), read about datamart/datawarehouse concepts and models (design and archicture too) defended by Inmon & Kimball. You'll saving a lot of $ in future.

Make sure it fits your use case. Be clear about what you want to achieve, get out of the product, and how you want to integrate it. Once you tie the solution into your systems, it is not trivial or easy to walk away from. Therefore, due diligence needs to be made to understand what your requirements are before choosing a product. Some companies may not even want to host, and prefer to go the managed services route. We have it integrated with every product that I can think of. We use both the AWS and on-premise versions. The AWS hosted version typically caters to all the microservices that we run on AWS, so there is a clear segregation between on-premise and cloud. In terms of usability and experience, both of them have been similar. We have seen a few bottlenecks on the cloud, but that can probably be attributed more on the user side of the house in terms of the way we write our applications and the type of payloads that we sent this month. This is an optimization which is ongoing from our end. Other that, we have been fairly happy with Splunk and what we get out of it.

Splunk's website is quite useful. You can find a lot of information on it. I would recommend to use it and try to figure out the product's features and what you can actually do with Splunk. You can do a lot of things with Splunk, but you need to know what to do first. I have used both the AWS and on-premise versions, but in two different environment, so I am unable to compare the versions.

It works well when searching logs. If you looked to try to do things beyond this, the problem that we ran into is that we treated it as the hammer which hits all nails. That is not really feasible, and there are other tools out there that can do more specialized things. User administration is key. Trying to prevent users from being able search records all the time is a huge problem. You need a tight approval process on dashboards, making sure the dashboards are queried in the most efficient way possible. The on-premise version that we had was not scalable at all. It was very difficult to use. We have EC2 instances in the cloud with Splunk installed, which is more scalable and easier to use. It now works much better.

I rate Splunk Enterprise Security nine out of 10. If you want to use Splunk, you can try the free version, which goes up to half a gig. You can feed a log from the Active Directory. If you take that information directly from Active Directory, it will be hard to read. Splunk provides a good dashboard. Splunk is an excellent choice for an organization that needs a fully scalable and highly customizable solution. We can customize the dashboard to combine all the device logs. Unfortunately, others still need to learn how to do that. It depends on an organization's needs and resources because it's not cheap. It's on the higher end of pricing, which can be a significant factor for small organizations with budget constraints. It's more appropriate for the enterprise level and companies with over 500 employees.

I would rate Splunk Enterprise Security seven out of ten.

I rate Splunk Enterprise Security nine out of 10.

I would rate Splunk Enterprise Security eight out of ten. Splunk Enterprise Security is easy to maintain and doesn't require much time due to its full automation. Splunk is a good solution if you haven't automated your log management, as manual log reviews are no longer efficient or practical.

The solution helps us see what's actually happening in our environment. Some things we might not expect at times, and others we do expect. The tool helps us respond based on what we see from our logs. I've seen and thoroughly liked some AI, automation, and single-pane-of-glass updates coming to the solution. It is very important to our organization that Splunk Enterprise Security provides end-to-end visibility into our environment. You can't respond to what you can't see was ingested. So, the visibility provided by the tool into our logs and alerting environment is critical. From an ingestion point of view, the solution alerts you to what you'd tell it to. It's pretty agnostic log-wise. Splunk Enterprise Security has helped improve our organization’s ability to ingest and normalize data. It has helped reduce our alert volume. You're getting the same alerts. You can see what's noise, what's actionable, and what's not as actionable. Splunk Enterprise Security provides us with the relevant context to help guide our investigations. We see what's coming into the environment, including specific logs that we wouldn't expect as much. All of that gets filtered into alert data, potentially operational data, and sometimes even billing data, so we can adjust and move forward with that in the environment. Splunk Enterprise Security helped reduce your mean time to resolve by somewhere between 20% to 35%. Splunk Enterprise Security has helped improve our organization's business resilience for some ingestion purposes. The unified platform helps consolidate networking, security, and IT observability tools. Splunk is pretty log-agnostic. All of your logs, tools, and sometimes even dashboards can get ingested into one specific tool. That way, you have a single platform where you can view all those logs and respond based on that data. Overall, I rate the solution a nine out of ten.

Splunk Enterprise Security is really strong, capable, and great at what it does. There are obvious areas of improvement, but it looks like Splunk has already identified them and is working on road maps to enhance SOAR integration and AI digital assistance for Splunk Enterprise Security. Once those are fully implemented, the product will further improve. Overall, I rate the solution an eight out of ten.

Splunk Enterprise Security is just a tool you can use, and then it's really up to the customer how they leverage it best. Overall, I rate the solution a six out of ten.

Overall, I rate the solution an eight out of ten.

Overall, I rate the solution a seven out of ten.

Overall, I rate the solution an eight out of ten.

I would rate Splunk Enterprise Security an eight out of ten. It is an amazing tool that provides so much visibility and streamlines so much. The main issues I have encountered with Splunk are the difficulties in configuration and keeping everything up to date as the data sources change.

I would recommend the solution to other users. Overall, I rate the solution a nine out of ten.

There is a threat intelligence management feature. However, customers don't use it in our case. Typically, customers want something superior in that nature. Price is a major concern for most customers, big or small. However, price should not be the determining factor when seeking a solution. Users need to think about performance and quality. They need something that will help them prevent security incidents, and they need a product that will be stable. If you can monitor your environment better, you can prevent incidents that may lead to financial loss - and when incidents happen, companies can spend far more dealing with an extended phishing attack than they would on a service like Splunk that will protect them effectively. When it comes to security, while it's not necessary to have the most expensive solution on the market, you should at least seek out a solution that's best suited to your company and its needs. I'd rate the solution eight out of ten. It's a great option for enterprise-level companies. However, a smaller customer with a smaller budget may not be a good match. They may not need such a powerful solution in any case. That said, if a customer is about to grow a lot, I might suggest Splunk as a primary option. I'd advise potential users to look at the environment size and complexity, consider the budget, and then decide if Splunk makes sense.

The end-to-end visibility the tool provides is not that big of a deal. They have so many tools that can do that kind of part. Splunk doesn't have to be the one place for total visibility, but at least for visibility when it consolidates on threats. Splunk has helped improve our organization's ability to ingest and normalize data. The tool pretty much consumes everything that we have. Everything from dozens of different vendor products gets ingested into Splunk. Splunk Enterprise Security is just that one central place where everything goes. Splunk Enterprise Security has helped speed up our security investigations. Something that requires someone to work on it at the beginning of the day would not take more than 15 minutes with Splunk Enterprise Security. Overall, I rate the solution an eight out of ten.

Overall, I rate the solution a nine out of ten.

The tool provides much more insight into what users and our apps do. We also use the solution to monitor a lot of machine-to-machine traffic. We have a hybrid environment. All of our internal tooling is in our internal data centers, but we also have a big cloud presence for some of our other tooling and mostly for our customers. Speaking from the internal side, Splunk Enterprise Security has been fantastic in helping us find all kinds of security events every day. Splunk Enterprise Security has helped improve our organization's ability to ingest and normalize data. The solution has helped us have everything in one place and grab everything at once. The tool has also helped us solve problems in real time. The Ops team will approach us when they are stuck with a problem ticket. We can look instantly, see what's happening, and track it down. The solution provides us with the relevant context to help guide our investigations. This context information makes things easier and faster for us. We get more information about exactly what's going on. Splunk Enterprise Security has helped us save around 50% of our time. Splunk Enterprise Security has helped reduce our mean time to resolve by 50%. Overall, I rate the solution ten out of ten.

Splunk Enterprise Security provides end-to-end visibility into an environment, but it is not our use case currently. Splunk Enterprise Security does not really provide the relevant context to help guide our investigations because, in our country, Splunk is not represented, so it is pretty hard to get the relevant information. Overall, I would rate Splunk Enterprise Security a seven out of ten. Its pricing is not good, and the learning curve for machine learning is not good. However, the parts that are working are working very well.

I work in cybersecurity consultation. I'd recommend the product to others. I'd rate the solution overall 9 out of 10.

I would rate Splunk Enterprise Security eight out of ten. Splunk is widely used across larger organizations. While large organizations often have extensive teams dedicated to Splunk projects and upgrades, smaller organizations can also use Splunk, taking advantage of more affordable pricing options like the free tier for limited data. Cost isn't a significant concern for larger organizations, who prioritize Splunk's security features and are willing to invest in its capabilities. Splunk Enterprise Security is deployed across all departments, processing millions of data points. Over 500 people manage this data: building dashboards and reports, working with Enterprise Security, discussing use cases, and creating custom data models. This represents a massive effort for any large organization where every department utilizes Splunk. Government departments are transitioning to Splunk, with daily onboarding increasing the current user base of 5,000. Because the deployment is cloud-based, the Splunk DevOps team handles maintenance. Splunk offers a resilient SIEM solution with comprehensive capabilities for research and a wide range of use cases. It is constantly updated, ensuring it remains a valuable and comprehensive SIEM package. I recommend Splunk Enterprise Security. It is an excellent tool widely used by many organizations, making it a valuable choice for security information and event management.

I rate Splunk Enterprise Security 8 out of 10. I would recommend Splunk to others. It's one of the most powerful tools available. It's a valuable tool for monitoring infrastructure.

I would recommend Splunk Enterprise Security to anyone who is looking for a similar solution. This is the only solution with all these features. I would rate Splunk Enterprise Security a 9 out of 10. It is stable, user-friendly, and feature-rich. It is very helpful. Even though it is expensive, the stability, support, and technical documentation make it very effective.

I would rate Splunk Enterprise Security eight out of ten. For someone who wants to use the cheapest solution, I would tell them that this is the best solution and worth the cost. I recommend Splunk Enterprise Security to others.

Overall, I would rate it eight out of ten.