Splunk Enterprise Security Reviews

Strong correlation searches and analytics help spot threats quickly, not hours later.

It’s expensive, especially since pricing is based on data ingestion. Costs can climb quickly as your environment grows.

Centralizes data and logs from multiple sources

The best thing about Splunk is the deep visibility it provides across the environment, along with its strong ability to correlate large volumes of security data into true positive, actionable alerts. This really helps make investigations/incident response faster and more efficient.

The initial implementation is complicated and requires significant expertise, time, and resources. In our case, we had to extend the contract to a third party to onboard Splunk ES in our environment.

It’s a great SIEM tool to have in a cybersecurity platform for a larger organization like us. It has really helped our SOC with real-time monitoring and alerting for security incidents, onboarding and improving visibility across multiple log sources, and enabling faster investigation and response to threats.

What I like most about Splunk Enterprise Security is its ability to give clear and comprehensive visibility across the entire environment. The correlation searches, use cases, and dashboards make it easier to identify patterns and prioritize threats. As someone who works in SOC operations and consulting, the flexibility to customize detections and build my own dashboards is a huge advantage and everything feels scalable, structured, and analyst-friendly.

What I dislike about Splunk Enterprise Security is that some of its features can be quite resource intensive. The platform is powerful, but it sometimes requires significant tuning and infrastructure capacity to keep everything running smoothly. Additionally, certain configurations or customizations can take more time than expected. It’s not a major drawback, but it does require proper planning and optimization.

Splunk Enterprise Security helps solve the challenge of getting clear, real-time visibility across a wide range of security logs and events. It centralizes everything from correlation searches to threat intel also I can quickly identify what really matters.

✅ Powerful Search and Correlation Capabilities

Splunk Enterprise Security excels at log aggregation, correlation, and threat detection. The Search Processing Language (SPL) allows advanced querying that lets our team pinpoint suspicious activity across multiple systems.

✅ Strong Integration with Multiple Systems

Splunk ES is easy to manage and understard even if you are new with SIEMs. The workflows are easy to follow and the language the splunk uses is easy to learn. Also, it has integration with anything so you can ingest logs from pretty much everything you can think of.

Might be very expensinve depend of how much data you are ingesting.

Correlate all logs, create use cases and content rules and have visibility over all log sources and security events.

Splunk ES is very helpful in seamless integration and automation, Data analytics, Investigation, Log source onboarding, dashboard, SPL, ease of search, use-case modification/fine-tuning, you name it. Every task and job in Splunk ES is perfect. Its vendor support is very responsive. Splunk ES has ease of implementation and integration.

Apart from cost, no one dislikes Splunk ES. Due to its costly services, most organizations use other cloud-native security solutions. Recently, one of our clients also proposed another security solution over Splunk ES. so that's cost is the main disadvantage of Splunk ES in my opinion.

Splunk ES has provided a very good services to us. Our SOC team was enjoying working on Splunk ES due to its sailient features. We didn't required extra human efforts to help our engineers to do investigate or analyze any security alerts. Due to its Splunk processing language and everything come-up in one go that helps most of the time. That's why our engineers doing their job without breaching the SLA.

It uses machine learning to identify abnormal user and entity behaviour. It effectively identifies threat by analyzing patterns of behavior that are not matching with normal patterns.

It integrates well with broader splunk ecosystem, allowing users to leverage their existing splunk investment and data.

Setting up and configuring this solution can be complex and time consuming.

It may generates false positives, especially in the early stages of deployment.

Uses unsupervised machine learning to identify abnormal behaviors that may indicate insider threats or external attacks.

Identifies suspicious activities from employees, contractors, or partners that could pose risks to the organization.

Seamlessly integrates with Splunk Enterprise and other security tools, enhancing existing security operations with advanced analytics.

Organizations should be prepared for the complexities of implementation and the resource requirements associated with deploying such an advanced system

It helps us montior spam post in our support community. Very realible and easy to use product. It helps our community clean and meets all our customer support needs. Very easy to implement as well

Analytic could be improved. Overall excellent product for all B2B industires

Helps us keep our community with spam free environment.

Splunk User Behavior Analytics establishes baseline behaviors for users, devices, and applications using unsupervised machine learning algorithms. It then looks for deviations to identify insider risks and unknown threats. This can be easily integrated with other tools and is easy to use. Has good customer support. Can be implemented on cloud and can be used from anywhere in current hybrid work environment. We have been using it since last 3 years.

There is nothing which is least helpful in this tool hence i do not have any dislike for Splunk User Behavior Analytics.

Instead of taking hours, can carry out tasks using IT and security tools in seconds. Many playbooks are included with Splunk to assist you in addressing the most important use cases. Splunk makes it easier to divide up, assign, and document tasks, which promotes a well-organized and cooperative investigation process.