Splunk Enterprise Security Reviews

I primarily use it for SIEM operations including log monitoring, threat detection, and incident investigation. We collect logs from multiple sources such as firewalls, servers, and cloud platforms and use Splunk Enterprise Security to correlate events and identify suspicious activities. It acts as a centralized platform where we can monitor everything and respond to potential security incidents effectively.

What I like the most about Splunk Enterprise Security is the flexibility and customization it offers. You can create dashboards, write custom SPL queries, and design detections exactly as per your environment. The correlation capabilities are very strong and everything gets visualized in a single place, which makes analysis easier and far better than other solutions. The out-of-the-box apps and Security Essential help significantly by onboarding new data sources or building new use cases more quickly.

Regarding the mean time to resolve and mean time to detect, I have seen one major improvement in incident response time. After proper tuning and process improvements, our mean time to resolve incidents has reduced by around 50 to 60 percent. Splunk Enterprise Security helps prioritize alerts using risk-based scoring, which allows us to determine which incident poses a higher risk to the environment. This makes it easier for SOC teams to focus on critical issues first instead of wasting time on low-value alerts.

Risk-Based Alerting is one of the most useful features in Splunk Enterprise Security. Instead of generating too many individual alerts, we can assign risk scores to different events based on their severity and context. For example, if a user shows multiple suspicious activities such as failed logins, unusual location access, or privilege escalation attempts, each of these events contributes to a cumulative risk score. Once that score crosses a defined threshold, it generates a notable event which helps us focus only on higher priority incidents. This approach has helped us reduce alert fatigue and avoid chasing false positives. It also makes prioritization much easier for the SOC team because we can clearly see which users or systems are actually risky instead of reacting to every single alert.

I would say that the AI component of Splunk Enterprise Security should be improved. The AI and automation features can be improved further. Right now they are helpful, but they heavily depend on accurate data. If the data is not reliable, automation can sometimes lead to incorrect actions. Improving the trust and accuracy of the AI-driven insights would definitely make the platform even better.

Regarding AI-driven detections and assistance, sometimes human error may occur, but with the AI insights of detection, it could be negligible up to 90 to 99 percent. This has helped us considerably. The AI feature for building SPL queries, the Splunk Processing Language, has helped us create queries for our particular use cases, which is a great feature of Splunk Enterprise Security.

I have been using Splunk Enterprise Security for 10 to 11 months.

Regarding stability, I have not faced any major downtime or performance issues so far. It can easily handle large-scale data ingestion very well and is highly scalable, especially for mid-sized to larger organizations where there is a high volume of logs being processed continuously.

Regarding scalability, Splunk Enterprise Security is quite scalable. It supports whatever customization we want and provides all backend capabilities to us. We could make any kind of out-of-the-box dashboards or alerts and any kind of use cases from Splunk Enterprise Security. It is very scalable.

For Splunk Enterprise platform, I have contacted them many times and within 48 hours, we received a good response from them. Not everybody has 100 percent knowledge, so response can take a longer time depending on the issues we are facing.

It depends on the support team. If they have no knowledge regarding Splunk Enterprise Security, then nothing can happen. We could ask them if they have the troubleshooting guide for Splunk Enterprise Security or if we need to contact any other support. It depends on that.

Regarding alternatives to Splunk Enterprise Security, I could say in my experience I have not used this kind of platform particularly. However, I have gone through CrowdStrike incident response and CrowdStrike Falcon. There is Splunk Enterprise Security and there is CrowdStrike Falcon.

The initial setup of Splunk Enterprise Security is manageable if you have experienced resources. It may take a few weeks depending on the environment size and integrations, but overall, the process is straightforward as most of the documentation is provided by Splunk. Most of the effort goes into proper configuration and onboarding data sources rather than the installation itself.

Regarding the impact on operational efficiency, manual work has been reduced. The automation of alerts has helped us significantly. A human could miss alerts, but AI could not so far. Splunk Enterprise Security has helped us considerably regarding this. The AI component of Splunk Enterprise Security is great as it can automate any kind of use case we have and detects and gives us notification for that particular alert. While you could expect a false positive, they are negligible compared to the correct ones they are providing.

Regarding pricing, Splunk Enterprise Security is on the higher side in terms of cost. It is more suitable for enterprises that can fully utilize its capabilities. Smaller organizations might find it expensive, especially when dealing with large volumes of data and licensing models. Splunk Enterprise Security has two kinds of licensing. One is SVC-based licensing and the second one is ingest-based licensing. The old model charged based on the volume of data ingested on a daily basis, while the current SVC-based model charges based on the compute utilized for searching that data, regardless of volume. They have improved the licensing structure, but it is still higher for smaller organizations.

Regarding alternatives to Splunk Enterprise Security, I could say in my experience I have not used this kind of platform particularly. However, I have gone through CrowdStrike incident response and CrowdStrike Falcon. There is Splunk Enterprise Security and there is CrowdStrike Falcon.

Regarding the feature called Risk-Based Alerting, I have tried using it.

For Splunk Enterprise platform, I have contacted them many times and within 48 hours, we received a good response from them. Not everybody has 100 percent knowledge, so response can take a longer time depending on the issues we are facing.

Regarding the impact of Risk-Based Alerting on alert volume or analyst productivity, Risk-Based Alerting is one of the most useful features in Splunk Enterprise Security. Instead of generating too many individual alerts, we can assign risk scores to different events based on their severity and context. For example, if a user shows multiple suspicious activities such as failed logins, unusual location access, or privilege escalation attempts, each of these events contributes to a cumulative risk score. Once that score crosses a defined threshold, it generates a notable event which helps us focus only on higher priority incidents. This approach has helped us reduce alert fatigue and avoid chasing false positives. It also makes prioritization much easier for the SOC team because we can clearly see which users or systems are actually risky instead of reacting to every single alert.

Regarding the impact on operational efficiency, manual work has been reduced. The automation of alerts has helped us significantly. A human could miss alerts, but AI could not so far. Splunk Enterprise Security has helped us considerably regarding this. The AI component is great as it can automate any kind of use case we have and detects and gives us notification for that particular alert. While you could expect a false positive, they are negligible compared to the correct ones we are receiving. I would rate this product eight out of ten.

The business case we use Splunk Enterprise Security for is internal security and organizational security purposes. We use it for all kinds of use cases, depending on the project.

We are satisfied with Splunk Enterprise Security, and it comes with a wide number of out-of-the-box applications which do help us to fix the problems. The out-of-the-box applications are majorly important for any log source onboarding. When you bring in log sources, you can do anything with it. It has inbuilt Security Essentials, which is the application that helps when you get a lot of log types onboarded, enhancing the use cases based on what you need. For example, after onboarding XYZ log sources, you can develop use cases based on that, such as security contents on that, then you can take it ahead. Those features are the best which we have.

After that, you can develop advanced dashboards or use the new AI feature that can translate something you say into SPL language, making it easy for us. Those features are better right now.

Splunk Enterprise Security has achieved a high level of product functionality. Improvements can focus on bringing various features together for easier use and potentially addressing human versus machine threats with AI-based detection, along with educating organizations about compliance.

I have been working with Splunk Enterprise Security for almost four years now.

Data ingestion is crucial, and I have mentioned this feedback in previous calls. Splunk Enterprise Security is stable and provides a good infrastructure for large organizations. For a Splunk Enterprise Security product in organizations with 20,000 to 80,000 people, it is very stable. However, for smaller organizations, the deployment and management can be expensive, leading them to choose other SIEM tools. For mid-sized organizations, Splunk Enterprise Security is indeed the best option, especially when ingesting a lot of data.

Data ingestion is crucial, and I have mentioned this feedback in previous calls. Splunk Enterprise Security is stable and provides a good infrastructure for large organizations. For a Splunk Enterprise Security product in organizations with 20,000 to 80,000 people, it is very stable. However, for smaller organizations, the deployment and management can be expensive, leading them to choose other SIEM tools. For mid-sized organizations, Splunk Enterprise Security is indeed the best option, especially when ingesting a lot of data.

We were previously using IBM QRadar and McAfee products, but right now we haven't explored that part because for a few years, I am working for an organization where we only explore Splunk Enterprise Security or Azure Sentinel or any freeware market SIEM solution. That is the kind of project I am doing right now, but I am not working with IBM QRadar.

The setup process for Splunk Enterprise Security is simple. An experienced technician can complete a systematic installation within a few weeks. Splunk Enterprise Security offers success partner provisioning for additional support and implementation.

We usually use Splunk Enterprise Security and Azure Sentinel, and we are researching Wazuh EDR and solution.

Right now we are working on Tines and Scramble, and there are few SOARs which we are looking at like LogRhythm and Sumo Logic source. We are assessing the products right now. We haven't adopted any of them right away.

There is integration between third parties with Splunk Enterprise Security. For example, we can connect a Tenable vulnerability assessment tool. It has inbuilt features to trigger automation actions. We have integrated a lot of products, and when you want to trigger SOAR or something of that nature, third-party applications are already available. For instance, when you integrate Tines, there are extensions available, making it a more powerful tool. This systematic integration is beneficial to us.

Regarding risk-based alerting in Splunk Enterprise Security, there are a lot of contents available from Splunk used as rules or searches. If we design systematic inputs and use cases, it does provide a lot of threat-based detection, showing what detection is happening right now and how advanced automation is expected to happen. Those visibilities are available with Security Essentials.

The resolution of security incidents using Splunk Enterprise Security is quite faster. However, faster remediation ultimately depends on the security operations. The detection with Splunk Enterprise Security is effective, but the story starts afterward. In the actual products, such as Splunk Enterprise Security, 20 to 30% of the time is spent on detection and investigation for incidents. The combination of Splunk Enterprise Security, ITSM tools, and SOAR on a single platform provides a value-add, allowing for a more efficient resolution process while considering costs for security teams.

For threat detection features in Splunk Enterprise Security, it is necessary to build use cases. SIEM tools are not purely threat detection tools; they are notification tools for threats detected elsewhere. We can do anomaly detection, but detecting actual threats requires specific signatures that we haven't explored yet in depth.

For threat detection features, it is vital to build use cases and compare anomalies such as a significant increase in login attempts. Anomalies can be detected in Splunk Enterprise Security, but defining signatures for threats is a task we still need to explore.

We work in both cloud and on-premises models, with our on-premises being integrated with cloud services from certain vendors. I would rate this product overall a 9 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

We are consuming Splunk Enterprise Security because Wells Fargo routes all alerts and logs into it. I work on the reporting side that leadership uses to see the alerts and logs. Whenever threats or alerting occurs, we have kept a couple of algorithms based on which we can assume that this is not normal behavior on the server or any other devices that we are monitoring. It will alert to our systems, then we'll capture all the logs and present them on the reporting side through a dashboard.

Security monitoring, threat detection, and risk-based alerting are the key features that we use daily. Because this is a cybersecurity project, leadership wants to get alerts about what is happening overall at the enterprise level, whether there are any threats, and how to improve cybersecurity. There are a number of applications that are customer-facing, and they are under compliance, so we monitor those applications closely for any cybersecurity threats or issues. If there is something detected, we alert the application team that there is a vulnerability in their systems and these are the measures they can implement. It is a complete cycle. When we detect a threat or potential vulnerability, we report to the application team stating which vulnerabilities exist in their application and what they have to work on. Automatically, that dashboard vulnerability points get captured into a service board and from service board to the application team's Jira board. This is also called TCI activity.

My job and responsibility involves pushing the data to the corresponding team whenever we get an alert. The alert mechanism and all the algorithms have been completely designed by the admin team and the architect teams. As an analyst, I focus more on the data side. This is my source of record for my reporting. I access the Splunk web-based application directly through an API. I verify whatever comes to my database to ensure it is correct and check all the logs. There is a particular index that we use to check. We have a dedicated index for authentication-related items or data-level encryption items. All threats get alerted in the logs, and it is completely based on the risk score, which is an algorithm created for threats with a specific score. We track mostly scores where the score is more than 20.

A score of 50 will show in red. Suspicious network activity gives around more than 40 points. We track above 20 only, as 20 is a warning for us, but above 20 is an issue that we have to work on. It gives a priority based on the points, and leadership also tracks it the same way.

I access data through the search command only. I use a correlated search command on the events on the particular index and get the output. We have two instances: one runs on-premises and one runs on cloud. On-premises runs on a Windows server, and cloud runs on AWS as of now. Soon the Windows will get decommissioned, and everything will go to the cloud.

We do real-time monitoring, so within no time, we send alerts to the respective teams and they can start working on it. By this, the risk has been minimized, and it is completely automated till the end with the back tracing workflow as well. There is a middleware team that tracks closely for all these vulnerabilities and gets them resolved on time, or it becomes an escalation to the team if the app team is not able to resolve it within the timeframe.

We capture logs that applications generate. For cybersecurity purposes, we also monitor people who have logged in using Windows logs, DHCP logs, and DNS logs. For example, if someone is based in London but has logged in from a different country or region, such as Germany, we identify it. We alert that the person has logged into Germany without informing their supervisor. These kinds of alerts we do against compliance and company policy. For these reasons, including logging or remote logging through VPN, we capture VPN data from Splunk as well. We do two types of reporting on Splunk Enterprise Security. One is log-based reporting to identify if a user is based in one location but their activity is showing from a different country altogether, then it shows as a flag and goes back to their supervisor.

In terms of improvement, the dashboards are not up to the mark. If you compare with Tableau and Power BI reports, they are more customized, more user-friendly, and more interactive. Therefore, we have to do an ETL pipeline to inject those logs into an intermediate system, which is a SQL server, and from SQL server, we do reporting for the leadership.

Actually, there is a feature that got updated, but it is not working on our board. Splunk 2 has not been updated, but we have received AI-related features that are not working as of now. Convert to SQL2 is the new feature they have added, but it is not working as of now.

We have been using Splunk Enterprise Security for around 10 years.

Splunk Enterprise Security is very much reliable and pretty reliable. Sometimes we used to face peer issues on-premises, but when we migrated to the cloud, I do not see any issues. For one index, data has multiple peers. If any one of the peers is down for five seconds, the retrieval of logs will fail or be incomplete just due to one. When we migrated to the cloud, since then I have not seen any of those issues.

In terms of scalability, I think they have come up with something, but Wells Fargo has not implemented it. I attended the training as well, though it was almost a year ago and I do not recall the details. It was a two-day training. When we talk about scalability, it depends on the business requirement and the use case. It varies.

I am not familiar with all aspects of Splunk Enterprise Security as I am more focused on the alert and reporting part. The admin and principal engineers handle most of the other work. My work involves reporting and the alert part of it.

We run special Splunk queries on two indexes. One is threat intelligence and I believe that is AI-based, though I am not sure what the mechanism is behind it. I have heard in conversations that they are working on the threat intelligence, but it has not been rolled out yet.

I believe that is an AI-based tool that they are working on. Beyond my pay grade, I just raise a request for getting access and pricing information. Because I work for Wells Fargo, which is a big enterprise with a lot of hierarchy, I am not familiar with certain decisions. The requirements come from the leadership level, and if they say this is the tool and I need to get the required data from it, then I have to go for it. I cannot ask why this or that because it is beyond my pay grade. In a huge organization, we have to work on the requirements that come from leadership, even though there are many features that I am not aware of because other team members handle them. My knowledge is based on requirement to requirement and use case to use case. I have explained the two use cases I am working on. In the future, if there is something coming up, I am happy to explore, but as of now, I have two use cases that I have already shared.

At the enterprise level, there are different use cases. Some other developers have different use cases for Splunk Enterprise Security beyond what I am working on. I rate this product a 9 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

We are currently in beta mode with AI-driven detections, connecting with AI while using Splunk forwarders and API connectors to ingest data from SCADA systems, historian databases, firewalls, endpoint security platforms, and cloud services. So far, the beta platform is working as expected, although we are not fully integrated with AI yet. Splunk Enterprise Security includes threat intelligence feeds, which summarize alerts in bullet points for analysts, helping them investigate incidents.

I use Splunk Enterprise Security as a SIEM management tool that gathers SIEM, log management, and operational monitoring. We are using it to integrate with different systems and centralize logging in one place, where we create rules or alerts that generate when there is a match. We are using that tool as a necessity and for compliance as well.

Risk-based alerting in Splunk Enterprise Security has positively impacted our alert volume and analyst productivity. We currently have a lot of alerts, including out-of-the-box alerts provided by Splunk. The risk-based alerts allow us to create alerts tailored to our needs, significantly impacting our organization by helping us prioritize events that truly matter and reducing false positives in our monitoring environment. For example, if one alert detects malware or a decommissioned user account, the risk-based alerting reduces noise from less severe alerts, allowing analysts to focus on more critical issues without having to investigate low-severity alerts extensively.

The integration of the threat intelligence feed and MITRE ATT&CK framework in Splunk Enterprise Security is significant for discovering the overall scope of incidents. When an alert generates, understanding the attacker's motive helps us recognize how they gain access to our environment, including the tools and techniques they use. Using MITRE tactics alongside threat intelligence feeds adds value to those alerts, allowing us to reduce response times significantly.

The correlation rules and risk-based alert models are effectively detecting threat factors early, enabling analysts to get to work immediately. The correlation rules, threat intelligence, notable event prioritization, and risk-based alerting help navigate the root causes of threats, thus reducing the threat landscape.

My overall experience with Splunk Enterprise Security in the energy sector has been overwhelmingly positive. Splunk Enterprise Security has proven to be a powerful and reliable tool for centralizing logging, monitoring critical infrastructure, creating alerts and reports, and improving both operational and cybersecurity sides. It also provides security, giving us visibility into the OT and IT environments to ingest and correlate large volumes of data. After generating alerts, we detect anomalies and respond to incidents faster, all within a centralized platform. We have approximately fifty software solutions that we are using, and we ingest the logs into Splunk, allowing us to monitor them flexibly and scalably, which fits our organization's needs in a high-volume energy sector environment.

Using Splunk Enterprise Security improves our average mean time to resolve because we aggregate logs from endpoints, IAM logs, spam logs, EDR logs, and firewall logs into a centralized platform. It creates alerts that analysts can prioritize. P1 incidents should be resolved within two hours, demonstrating significant improvement from utilizing the product in our environment. It is a strong platform that faces some challenges, but overall, we receive positive feedback about reducing that mean time.

Before Splunk Enterprise Security was onboarded, finding alerts across multiple dashboards demanded considerable effort. After using Splunk Enterprise Security, we see significant improvement because everything is centralized on one dashboard. Analysts no longer need to look for firewall or EDR alert points individually; all data is accessible on Splunk Enterprise Security's dashboard. The AI model also helps minimize real-time metrics for security events, presenting everything in real time. Analysts can contact customers or end users and complete their analysis in approximately fifteen to twenty minutes, gaining insights about the ongoing environment, detecting anomalies and responding to incidents faster.

In the energy sector, where infrastructure and regulatory requirements are critical, the triage phase's capability allows us to detect significant ransomware attacks early. By triaging incidents right away, we strengthen our visibility and can swiftly take action, such as isolating virtual machines or user accounts, or changing passwords, which helps us assess the risks involved with alerts and how we can remediate them.

Splunk Enterprise Security significantly improves our ability to detect threats faster.

While Splunk Enterprise Security is a great product, I observe a few challenges compared to other products. The first challenge is the licensing cost, which is significantly high, especially for organizations generating a large volume of logs common in the energy sector. The learning curve can also be steep for new users, particularly when working with SPL and building advanced dashboards. Learning SPL, a query language in Splunk, is not hard, but for a newly onboarded analyst, it can be challenging. Building dashboards is easy, but when making special requests for management, it can be tricky. Additionally, Splunk can be resource intensive, requiring careful planning around storage, indexing, and hardware performance. These factors do not diminish the product's value, but they do require thoughtful management and ongoing training to ensure teams leverage their capabilities fully.

I recommend that Splunk improves its pricing model since the pricing is based on the logs ingested, which is currently quite high. Users and admins of the product must pre-plan and thoughtfully manage the logs to fully leverage its capabilities. Reducing pricing would be a great suggestion from my side.

I have been working with Splunk Enterprise Security for three to five years on my current job and probably on my previous job as well.

Regarding reliability and stability, Splunk Enterprise Security is a significant tool. We have not experienced outages or downtime. The documentation states 99.9% availability, and it consistently operates 24/7 without any stability or reliability issues at this time.

From a scalability standpoint, as we transition from a smaller mid-sized company to over one thousand employees, we have not encountered any hiccups or roadblocks using Splunk Enterprise Security. It effectively meets our needs in terms of log ingestion and performance.

Splunk support is quite good; they reply within twenty-four hours. We have opened some support tickets, and they responded promptly to address the root cause of our issues. I would rate Splunk support as very responsive.

We evaluated IBM QRadar, Elastic Stack, and ArcSight through POC, but so far, Splunk Enterprise Security's ecosystem, documentation, and functionalities stand out the most.

My deployment experience with Splunk Enterprise Security was smooth and well-structured. We began by pre-planning the architecture to define indexer, search head, and storage requirements based on expected data volume. Once completed, we deployed the forwarder across various servers, firewalls, and OT gateways, followed by data forwarders from the SCADA system, historian database, and enterprise applications. Once ingestion was stable, we began building dashboards, alerts, and compliance reports tailored to our operational and security needs. Our team required training, which Splunk provided to help us understand how SPL works and how to create dashboards. With their assistance, we started ingesting data and the platform is fully operational. Overall, it was a smooth and standard deployment process.

I participated in the initial setup of Splunk Enterprise Security, serving as the admin of the console overseeing onboarding and offboarding processes.

In terms of improving business resilience, the ROI from Splunk Enterprise Security is significantly positive. Implementing Splunk Enterprise Security has improved our organization's overall resilience by providing real-time visibility in both IT and OT environments, enabling faster anomaly detection and addressing operational disruptions and security threats. With centralized logging, correlation searches, and risk-based alerting, we can identify issues earlier, prioritize events posing high risks, and respond before impacting critical infrastructure or service delivery. This approach reduces downtime, ensures compliance readiness, and enhances continuity across energy operations. By utilizing data from our SCADA systems, network devices, identity platforms, and cloud services, Splunk Enterprise Security supports a more adaptive, informed, and resilient operational posture while ensuring day-to-day reliability and long-term strategic stability.

Compared to other products in the market, Splunk Enterprise Security's standard is much higher, though other options are cheaper.

I am an admin of Splunk Enterprise Security. Currently, we have Splunk Enterprise, and I would consider my role as a user.

We are using the enterprise version, which is best suited for us with a higher top-layer model.

I observe a significant reduction in analyst burnout due to utilizing Splunk Enterprise Security. Analysts face a high risk of burnout working for thirty minutes to several hours on a single alert to find the root cause. However, with everything centralized on a dashboard, burnout rates decline. Splunk Enterprise Security monitors our systems 24/7, allowing analysts on different shifts to evaluate the dashboards in a consistent manner. This standardization of dashboard alerts and reporting has significantly improved our operations and reduced burnout.

Currently, we are on a trial license for third-party vendors ingesting security event data while streamlining incident management. We receive real-time monitoring for threat intelligence feeds, using a SOAR platform for automated response workflows and an AI platform that helps narrow down visibility across our entire energy infrastructure.

Based on my experience with Splunk Enterprise Security in every aspect, I would rate it nine out of ten.

Currently, we are monitoring all logs for retention as well as real-time monitoring using Splunk Enterprise Security, and there is a log management component that utilizes the retention period. These are the things we are currently doing.

Threat detection in Splunk Enterprise Security is more than 60 to 70% faster compared to other tools. The main advantage is not only detection but also proper analysis, as other tools sometimes miss fields, while here we can search the raw logs for detection as well as evidence, which is very helpful.

Currently, Threat Topology and the MITRE ATT&CK framework in Splunk Enterprise Security are helpful, but we have not explored them in-depth.

The integration of threat intelligence directly into the TDIR workflow in Splunk Enterprise Security allows us to block more than 50% of threats, but due to our maximum customer environment, we cannot adopt it directly, so it is not fully automated right now.

The best feature I have in Splunk Enterprise Security is Mission Control, which enhances our SOC to real-time monitoring of incidents. The second notable feature is the threat feeds, which capture the IOCs very well.

The solution has improved my mean time to detect and resolve by about 20 to 30% in real-time for resolving an issue.

Risk-based alerting in Splunk Enterprise Security has impacted us because higher risk alerts are more critical and can be easily identified by our SOC team, providing a proper solution on that. The risk-based analysis is very good, but we need to apply this for all the correlation rules, which is not fully automatic and requires manual effort for risk.

From my point of view, the AI-driven detections in Splunk Enterprise Security scale at about 10 out of 6 in terms of helping improve the accuracy of my investigations, but I still miss a few correlation rules because the maximum correlation is based on the MITRE framework and other factors. There is still a need for improvement related to AI-based detection.

My thoughts on UEBA in Splunk Enterprise Security is that the user behavior analysis feature is very good, but it relies heavily on the identification of logs. We are capturing the data, and while Splunk Enterprise Security is good, proper integration with devices such as Active Directory, single sign-on devices, PingID, and multi-factor ID is essential, with configuration and data model creation being manual rather than automatic.

I have been working with Splunk Enterprise Security for six years or more.

Regarding stability, I rate Splunk Enterprise Security at 9 out of 10. Right now, it is stable, and the other components are much better.

I would rate the scalability of Splunk Enterprise Security at about 9 since the maximum component is on the cloud, so we encounter no issues with scalability.

In comparing Splunk Enterprise Security with other solutions or vendors, the timely support is one noticeable aspect, and I rate it a 7 out of 10. Some vendors provide good support, but I have experienced some delays with RCA when integrating other solutions such as QRadar, IBM, and other SIEM tools, indicating a lack of customer support.

I would rate the customer support for Splunk Enterprise Security at 7.

My thoughts on the pricing of Splunk Enterprise Security is that it is not cost-efficient. Splunk Enterprise Security is very costly compared to other market tools.

I have upgraded to Splunk 8.0, and it is currently running on version 10.3.2.

In our company, there are 20 specialists working with Splunk Enterprise Security.

Our clients are not small; they are enterprise businesses.

I would rate this review 7 out of 10.

Hybrid Cloud

Other

In my organization, there are many use cases for Splunk Enterprise Security, including potential risk, brute force attack, malware attack, ransomware attacks, and firewall-related use cases. We also have switch-related, inbound traffic, outbound traffic, login failure, and successful login use cases. I estimate there are more than 150 use cases in our organization.

What I appreciate about Splunk Enterprise Security is that it is very intuitive and basic to use.

The best features of Splunk Enterprise Security that I value include its ease of use, the SPL query language, and its straightforward handling. It provides real-time monitoring and investigation, which are the main features in SPL.

Splunk Enterprise Security helps improve our organization's business resilience because it is very useful for real-time monitoring and investigation. When any incidents occur, we can check and detect them in real-time.

I would like to see improvements in Splunk Enterprise Security regarding the integration of device automation and more automatic use cases in the licensing model, as well as reducing the incident time period and incident remediation time.

The technical support can be improved because sometimes when we call them, the issues are not resolved immediately and tickets take time to be addressed.

I have been working with Splunk Enterprise Security for more than three years.

Splunk Enterprise Security is stable and I have not experienced any downtime or significant performance issues. I rate the stability of Splunk Enterprise Security as good.

Splunk Enterprise Security scales well with the growing needs of my organization, though urgent support is required for projects deployed at customer premises.

I evaluate customer service and technical support from Splunk as requiring the raising of a ticket or calling a toll-free number for any technical issues, which they resolve with assistance.

Before Splunk Enterprise Security, we used RSA NetWitness and also Sentinel.

I am not directly involved in the deployment of Splunk Enterprise Security, but during the integration of devices, we have a team working on the onboarding process.

I have seen a return on investment with Splunk Enterprise Security. It is cost-effective since not many companies are using it right now compared to other SIEM tools.

My experience with pricing, setup cost, and licensing is that Splunk Enterprise Security is very costly compared to other SIEM tools, but the advanced features justify the cost due to its real-time capabilities and user-friendly SPL features as a key differentiator. The licensing is also costly and based on events per second.

I am currently working with Splunk Enterprise Security products and solutions. I work as a Splunk Admin with Splunk Cloud platform and Splunk Enterprise Security.

I do work with Splunk Enterprise Security but not with the Cloud. I find the process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security manageable.

There are many tasks we have to perform in the detection of Splunk Enterprise Security, but if we categorize them, we use the SPL commands. We have to use a query language of the SPL command and optimize and sort out the issue in a limited, minimum time period. These are the command lines we use to reduce the time and prioritize the issues.

We use disparate security solutions that integrate or import data into Splunk Enterprise Security, including Windows devices, Linux devices, and firewall devices. Many other devices are integrated, including the three main components of Splunk Enterprise Security: the forwarder, indexer, and search head. The forwarder collects data from different sources such as switches, firewalls, databases, or routers. These are the data sources integrated with our Splunk devices. The log source then collects the forwarder and sends it to the indexer. The indexer parses the logs, licenses the logs, and minimizes the logs in different formats including JSON format and TXT.IDS format. These are the two formats in which we have the logs stored in the indexer. The third component is the search head, where we perform searches in the dashboard and search console by redirecting to the indexer and extracting the necessary data.

My overall impressions of Splunk Enterprise Security's ability to predict, identify, and solve problems in real-time are positive. These include real-time investigation, incident identification, and minimizing the time required for response. The main components include the SPL command as a useful search processing language. We check the logs of the last three to four days and utilize the indexing box, including hot and cold buckets for storing logs. There are five types of buckets in Splunk Enterprise Security for this purpose.

I am using new threat detection features in Splunk Enterprise Security, including malware analysis, phishing email detection, and detection of malicious IPs, malicious tools, and URLs.

We have not faced any challenges in using Splunk Enterprise Security for advanced threat detection.

My organization uses risk-based alerting in Splunk Enterprise Security. We have a threshold in the search console for incidents. When any incident occurs, it can be categorized based on the number of occurrences as minor, moderate, major, or critical alerts depending on the threshold values.

I am not aware of specific enhancements or new features that should be included in future releases of Splunk Enterprise Security.

I decided to switch to Splunk Enterprise Security because my organization uses it and I have received training on it. The integration of devices with Splunk Enterprise Security is a significant factor, as it is a new technology with advanced real-time monitoring features.

The deployment model for Splunk Enterprise Security that I am using is on-premises.

I would advise other organizations considering Splunk Enterprise Security that it is a new product and new technology. It is easy to handle and has a straightforward deployment model. Use cases are also easy to create, and it provides real-time monitoring and incident detection, which is a valuable feature. My overall review rating for Splunk Enterprise Security is seven out of ten.

On-premises

Splunk Enterprise Security is used for many different things. Primarily, it is used to create alerts for different use cases that need to be monitored, and then investigations can be created. At a high level, that is where many investigations start from.

Business resilience is valuable, though I am not completely certain about Splunk Enterprise Security in that regard. Visibility would be considered a valuable feature. The more I think about it, business resilience is probably valuable as well.

The pricing of Splunk Enterprise Security is probably one of the main pain point areas. It is probably the only area that has us looking elsewhere for other options, just to see what is available even just because of the price. While it is a good product, the huge price increases that have been experienced over the last couple of years do not appear to be justified by new features or items in general. Pricing is the area that has everyone looking elsewhere to see what other options exist. The prices definitely make your eyes water when you see them.

Splunk Enterprise Security could improve its pricing. This seems to have been a theme across the board at the Splunk conference this year. The general consensus is that pricing continues to increase significantly every year, not just by a couple of dollars.

Splunk Enterprise Security has been used in my career overall for about six years.

The only instability that has been experienced with Splunk Enterprise Security is from inefficient searches and things configured incorrectly. Stability is ranked pretty high for the product.

Scalability for Splunk Enterprise Security is ranked pretty high.

I have tried contacting Splunk Enterprise Security support, and I am currently dealing with some technical support items. Technical support is relied upon pretty regularly. Generally speaking, their support is pretty good and their response time is pretty good. The caveat to that is that recently, there are some pretty interesting issues that seem to take a long time and a lot of back and forth just to get to the right people for some advanced challenging issues. When you open up a support case, you are assigned somebody at tier one support. There is no way to bypass that or indicate that this is a more advanced issue. Everything goes through the same process, and there is no way to really get advanced technical support from the beginning. You have to start at level one, and they set up a meeting and a call to explain the issue and show what is being experienced. There is a lot of back and forth, and then maybe if you are fortunate, you get assigned a more senior person after a week or two. For some cases, it takes maybe three or four weeks before you are actually in touch with people who can actually help with the issue. There is a lot of back and forth, a lot of emails, and a lot of troubleshooting and screenshots and communication for three to four weeks later before you can finally get a hold of somebody who is actually able to point you in the right direction.

Splunk Enterprise Security would be given a score of eight or nine overall for support. It is just the amount of time that it takes to get support for some advanced issues. You have to start at the bottom and keep communicating and working your way up that chain. Overall, it is a solid eight or nine, but sometimes it takes a decent amount of effort and time to get there.

Positive

Nothing has been used before Splunk Enterprise Security.

When first starting to use Splunk Enterprise Security, the initial deployment was already stood up, so much of it was personal learning. I cannot really speak on behalf of other people who have stood Splunk Enterprise Security up.

Splunk Enterprise Security is a pretty complex tool, and it is always changing. There are always new things, even with 8.0 to 8.2. There are always things that are being renamed and moved around and called different things and the UI is changing. That has definitely added to the learning curve. It is a pretty complex tool, so there is a pretty steep learning curve personally just because there are so many things that it does and controls and a lot of things to consider.

Splunk Enterprise Security has not helped to reduce the team's mean time to detect, the MTDD metric. A service provider, managed service provider, is utilized for items like that.

Splunk Enterprise Security is not being used with the observability platform at this point.

Splunk Enterprise Security has not been upgraded to 8.0. The upgrade to 8.2 is in the works, probably in the next two months or less.

Risk-based Alerting, as Splunk Enterprise Security calls it, is being used. There are some pros and cons associated with it. The organization is not mature enough for Risk-based Alerting to speak on any pros or cons too much because of how Risk-based Alerting works. Many of the underlying fundamental pieces have not been built or are not mature enough to really calculate the risk scores correctly. While Risk-based Alerting is enabled and turned on and some risk-based alerts have been created, generally speaking, the organization is not mature enough in some of the other areas to really use a lot of the granular details of what Risk-based Alerting is for. However, it is on the path for progression. The overall review rating for Splunk Enterprise Security is nine.

On-premises

Other

As a SOC analyst, I use Splunk Enterprise Security primarily for real-time threat monitoring and incident investigation, and my main use case involves correlating logs from various endpoints, especially integrating alerts from CrowdStrike.

Splunk Enterprise Security's best feature is definitely the visibility, having everything centralized, especially with how well it integrates with CrowdStrike logs, which means I don't have to jump between platforms to get the context I need.

The best functionality in Splunk Enterprise Security is search flexibility. Once I get knowledge of SPL queries, I can hunt for almost any threat pattern I need, and the incident review dashboard is a lifesaver for my workflow as it keeps my alerts organized, which makes it much easier to triage and investigate, even when things get busy.

The AI-driven detections and assistance have improved the accuracy of my investigations. The anomaly detection is great, but static rules miss a lot of weird behavior, and Splunk uses machine learning to outline threats and user logging, such as a new location or a sudden spike in data volume not caught by our standard alerts, helping me catch things that could otherwise fly under the radar. The UEBA feature helps me focus on actual risk by baselining normal behavior and analyzing highlights between normal and suspicious activity.

Splunk Enterprise Security's capabilities save real time for our team. If my team is stuck on a complex SPL query or needs a quick summary of a long investigation, I can just ask the AI assistant in plain English.

Splunk Enterprise Security has helped to reduce my team's mean time to resolve by 5 to 15 minutes for each alert.

It has reduced my team's average mean time to detect slightly by an average of two to three minutes.

Splunk Enterprise Security's risk-based alerting system is pretty good, and honestly, one of my best features because it changed how I handle alerts by aggregating suspicious events into a single risk notable incident instead of pinging for every single suspicious event.

When I am looking at one aggregated incident in Splunk Enterprise Security that shows the full story of what that user has been doing, it makes my investigation more efficient and keeps me focused on real threats rather than getting buried in noise.

Splunk Enterprise Security helps me detect threats in real time, and we also use it for threat-sending purposes proactively in our organization by feeding threat intel lists into Splunk Enterprise Security and running a surface to see if any malicious IPs, hashes, or domains have appeared in our environment recently.

Splunk Enterprise Security has reduced our manual work by half an hour for in-depth analysis.

The AI features, UEBA, and other risk-based analysis features help reduce alert fatigue, and the anomaly detection feature significantly decreases the workload of our team to investigate real threats behind the noise.

Splunk Enterprise Security improved a lot for our security team. Before we were overwhelmed by alerts without specific context. Now, using Splunk Enterprise Security in my daily routine, I triage new alerts focusing on high-severity items first, checking the logs in Splunk Enterprise Security, and pivoting to CrowdStrike if I need to see processes on endpoints.

Integrating threat intelligence directly into the TDIR workflow with Splunk Enterprise Security improves my ability to preemptively block threats. We have integrated our threat intelligence platform, such as VirusTotal, seamlessly into Splunk Enterprise Security, which is one of the biggest time-savers for me as an analyst, pulling various feeds while the platform handles the heavy lifting.

In proactive defense, Splunk Enterprise Security improves a lot in our organization. We don't just monitor alerts but carve out time to look for tactics, techniques, and procedures that might not trigger a specific rule yet, and we also use the behavioral analytics feature to flag anomalies before they become full-blown incidents.

Splunk Enterprise Security's native UEBA capability enhances my visibility into unknown, sophisticated, or insider threats, especially as it helps mitigate alert fatigue by focusing on entity risk scoring rather than single noisy events.

We have implemented UEBA use cases for abnormal login spikes, such as a VPN login spike and suspicious entity processes.

Splunk Enterprise Security's consolidation of SIEM, SOAR, and UEBA into a single interface improves my team's operational efficiency as we monitor and detect suspicious activities from a centralized SIEM where we can manage all endpoints.

Splunk Enterprise Security has improved my visibility across hybrid or multi-cloud environments as we integrated it with our AWS infrastructure, and it effectively handles cloud log injection and ingestion flows.

Using Splunk Add-on for AWS, we pull in everything we need, such as AWS CloudTrail for audit logs, VPC Flow Logs for network traffic, and GuardDuty for immediate threat alerts, significantly boosting my confidence in our overall security posture.

Splunk Enterprise Security has significantly improved our business resilience, as we provide security services to our clients, and their feedback indicates it has boosted our productivity.

I would like to see improvements in user-friendliness, as it is quite challenging for a newcomer to learn SPL queries or get hands-on with Splunk Enterprise Security.

Missing features I would like to see in Splunk Enterprise Security include improvements in AI for UEBA, as it frequently gives false alarms when historical data is not correctly parsed, and I also suggest enhancing the parser for switches.

I have been using Splunk Enterprise Security for two months.

I find Splunk Enterprise Security stable, as it has been rock-solid for us over the three months we have been using it, reliably handling massive data streams without major hiccups, although it occasionally takes time to collect logs.

In terms of scalability, Splunk Enterprise Security is quite flexible. When we need to inject more data, we simply add more indexers, but it demands careful attention to compute and storage requirements for sustained performance.

I would rate Splunk's customer service and technical support an 8 out of 10.

We previously used the open-source Wazuh for SIEM.

Splunk Enterprise Security's key differences with Wazuh include integration capabilities. Splunk Enterprise Security allows sourcing logs from various endpoints and products, such as CrowdStrike and XDR platforms, while Wazuh has similar features but lacks the ingestion efficiency that Splunk Enterprise Security provides.

From my experience, the initial deployment of Splunk Enterprise Security isn't easy or plug-and-play. It's a heavy-duty platform that requires careful planning, especially when integrating with various products or different types of servers.

I wasn't there for the initial setup of Splunk Enterprise Security, but based on maintenance, it definitely requires a solid strategy and expertise for smooth operation. It's not just installing the app but entails ongoing tuning and infrastructure balancing for optimal functionality.

Splunk Enterprise Security has provided measurable benefits. It significantly reduced the mean time to detection and response, which has lessened my workload and improved our team's efficiency.

I haven't worked with the team dealing with pricing, but the operational perspective indicates that pricing is usually tied to data injection volume and workload.

We decided to go with Splunk Enterprise Security because its features and customer support are the best in the market. Troubleshooting during deployment or for new features has direct access to effective Splunk customer support.

For deployment, we use a hybrid model, incorporating both on-premises and cloud components.

We purchase Splunk Enterprise Security directly from Splunk and have an official license, contacting the sales team for our needs.

I would overall rate Splunk Enterprise Security as a product 9 out of 10.

My main use case for Splunk Enterprise Security is for security alerting, triage, SIEM, and incident response.

We use Splunk Enterprise Security for incident response with an MSSP that will triage findings or events, and then they will escalate them up as investigations in which our analysts will then respond to them. We then take in and start doing our investigation, adding notes, and eventually closing with disposition. If the incident comes from external to Splunk, we typically just conduct the investigation through Splunk and document it externally via our IR processes.

The best features that Splunk Enterprise Security offers include case management, which has come a long way in terms of being able to collaborate and have multiple people working inside of the case management platform at the same time without necessarily overlapping, as well as the ability to work out of one platform with integrations via SOAR and being able to search all inside of the same investigation and keep all of your notes straight.

Splunk Enterprise Security has positively impacted our organization by helping to formalize our SOC program, enabling us to fundamentally respond to alerts as well as create detections around security events, and providing a single source of truth for our analysts to work out of instead of having multiple different platforms.

One of the big things that's important in my industry currently is being able to measure your time, whether that's for implementation of AI and automation or just simply for headcount and asset allocation. I think the ability to track how much time is spent in different portions of a runbook playbook or in triage of an alert would be a beneficial addition to Splunk Enterprise Security's case management.

I have been using Splunk Enterprise Security for three to four years.

Splunk Enterprise Security is stable.

I think Splunk Enterprise Security is relatively scalable, but it relies on your company's capability to get the appropriate and good data inside of Splunk. Without that maturity, Splunk suffers immensely.

My experience with customer support has been good.

On a scale of one to ten, I would give customer support an eight or a nine. It's been good for when I need it.

I did not use a solution prior to Splunk Enterprise Security for SOC operations.

I was a part of the conversations regarding pricing, setup cost, and licensing, but ultimately, I was not the only decision maker in renewing Splunk Enterprise Security. There were multiple teams consolidated for the multiple use cases in our organization.

Splunk Enterprise Security was selected prior to my job responsibility as a SOC manager. I believe it was actually bought for site reliability engineering primarily, and then it was just a product that was available when we started SIEM and SOC operations.

I think the ROI typically has been in risk reduction and the building of the program. We're looking to start getting better ROIs on reduced analyst time and potentially fewer analysts with some of the agentic triage capabilities. But as of now, I don't have much to compare. We have recently started using the i4S add-on for insights, so I'm hoping that also proves valuable insights for ROI.

I was a part of the conversations regarding pricing, setup cost, and licensing, but ultimately, I was not the only decision maker in renewing Splunk Enterprise Security. There were multiple teams consolidated for the multiple use cases in our organization.

Splunk Enterprise Security was selected prior to my job responsibility as a SOC manager. I believe it was actually bought for site reliability engineering primarily, and then it was just a product that was available when we started SIEM and SOC operations.

I have not really gotten to use too many of the AI feature sets in the current state, so I do not believe that I can speak to the efficacy of those features.

I think the functionality is there. The implementation is probably the hardest part, which is just a lot of work on the engineering and architecture of an organization, as well as if there are deficiencies in the IT infrastructure side, bad data equals bad Splunk. We have to ensure that we continue to implement things to be able to use Splunk Enterprise Security to its full potential.

From a directional standpoint, I think Splunk Enterprise Security is on the right path of observability taking the forefront of any sort of AI implementation. The biggest concerns about agentic capabilities is how you arrive at that decision making, which are the same concerns you would have with a human in terms of triage. Ensuring that observability always maintains the forefront of the decision making in the feature sets that are provided is important.

I'm not sure if the consolidation really has much of an effect on us as of date. UEBA, I believe, will have a huge benefit, but it's not fully implemented, so I can't speak to it in a full manner. The investigation capability of being able to search while inside of an investigation and that single pane of view has been beneficial for path consolidation for us to be able to focus on the alert that we're looking at.

I would say to ensure that you're getting the right data and getting it formatted appropriately when looking into using Splunk Enterprise Security. While you don't need to ingest everything, you do need to make sure that you're ingesting everything that is important from a detection engineering perspective. If you're missing a large portion of your logs, it's going to be very difficult for you to adequately triage the situation, and the fewer places you have to go for the right information, the easier the investigation and the better Splunk Enterprise Security tools work.

I would give Splunk Enterprise Security an overall rating of eight on a scale of one to ten.

Public Cloud

Other

In our organization, we use log management tools that collect data from multiple types of devices such as system applications and network devices like firewalls. We can collect logs from these network devices, analyze them, and report findings to the client side. We primarily use this for security purposes.

For our business improvement, we manage security for multiple clients on our side. This supports greater business development and improves our security posture. We can improve system reliability and reduce downtime while providing real-time operational insights. This helps our organization make data-driven decisions to improve customer trust, ensure compliance, and reduce operational costs.

We have achieved improvements by enhancing dashboard performance, reducing search execution time, and simplifying complex queries. The queries we work with are very complex. We have also benefited from better AI-driven threat detection and improved data management. These are areas where Splunk Enterprise Security can be further improved.

The best advantage is that Splunk Enterprise Security helps our organization collect and analyze logs from multiple systems in one place. It provides real-time monitoring, faster threat detection, and quick incident response and investigations. This improves security visibility, reduces response times, and helps our team make better decisions.

We can continuously monitor logs, detect suspicious behavior in real time, correlate events from different sources, and generate alerts before threats escalate. With AI threat intelligence and automations, our security team can identify and stop attacks as early as possible. This type of proactive defense is what we need.

Regarding pricing, we have compared multiple SIEM tools, and the pricing for Splunk Enterprise Security is the best. Multiple features are included, and the pricing reflects the value it delivers. It helps reduce security risks, automate tasks, minimize downtime, and improve incident response. The long-term savings and strong return on investment often outweigh the initial licensing cost. According to my assessment, the pricing is the best compared to other SIEM tools.

The MITRE ATT&CK framework is a knowledge base of real-world cyberattack techniques used by attackers. It helps our security team understand attack behavior, map threats, and detect malicious activity. We can track what attackers are doing, understand what happened, and follow the appropriate steps to strengthen incident response.

We manage alert fatigue multiple times, as false positive alerts are triggered frequently, sometimes 200 to 300 alerts. Alert fatigue is something we observe and analyze properly. Managing this is one of the biggest tasks we handle. We analyze these alerts to determine which types of alerts are key matches and what we should focus on.

I have two years and three months of experience with Splunk Enterprise Security.

According to my experience, there is no downtime. During updates, we occasionally observe slowness, but generally everything performs well.

We have not experienced any impact on our security posture. We have integrated multiple types of devices including multiple firewalls, network devices, and IPS systems. These help our organization and clients to improve features. We have found no negative impact from scaling.

When we have raised multiple types of alerts to the support team and cannot manage them ourselves, we escalate to the client side support. The response time is excellent, with resolution typically occurring within 10 to 15 minutes. The support team provides links to join sessions and conducts troubleshooting. The support quality is the best for our needs.

The setup is not fully straightforward and is somewhat complex. However, installing the agents on the client side is very easy, taking between two to three minutes, or less than five minutes total. We can continue monitoring immediately after installation. According to my experience, the setup is straightforward and not very complex overall.

When comparing tools we have used, including IBM QRadar and Splunk Enterprise Security, we created and tested multiple types of alerts. Splunk Enterprise Security generates real-time alerts, while IBM QRadar is slower with only seconds of difference rather than minutes. The AI-driven features are more improved in Splunk Enterprise Security than in IBM QRadar. However, the dashboards are better in IBM QRadar compared to Splunk Enterprise Security, which is why we suggest improving dashboard features in Splunk Enterprise Security.

We can improve Splunk Enterprise Security by simplifying queries and creating automatic alert raising features with AI-driven capabilities and machine learning. These AI-driven improvements would be better than current features.

Splunk Enterprise Security can enhance its AI capability by improving threat prediction and reducing false positive alerts through automating alert triage and providing smarter incident response. Generating natural language questions and AI-driven analysis can help our security teams detect threats faster and improve response time while reducing manual effort.

The AI capabilities provided by Splunk Enterprise Security are improving threat predictions and automating alert triage, creating and raising alerts to the client side. This is the best AI-driven feature according to my assessment.

When we have generated alerts, we can reduce resolution time from 10 to 15 minutes for our organization and client side. As an MSSP partner, we can provide this service to the client side.

Multiple features are available in Splunk Enterprise Security that help manage our client side. We can create multiple types of dashboards and rules, which helps reduce false positive alerts. Automations are available, which is why the alert raising speed is very fast compared to manual alert raising.

Threat detection is faster because of the AI-driven features. We receive alerts faster as a result. The AI and machine learning can analyze large volumes of data to detect unusual behaviors and identify potential threats while reducing false positive alerts. Automated investigations are also available, helping our security team find any critical alert faster and improve incident response and decision-making for more efficient threat reporting.

We work with multiple environments because our clients are diverse, including leaders and medium-sized organizations. Deployment types include multiple types of servers we can integrate on the client side. Deployment options include on-premises, cloud, or hybrid environments. The organization can choose the model that best fits their needs. Splunk Enterprise Security is scalable, easy to integrate with existing infrastructures, and supports businesses of all sizes while ensuring reliable data collection and monitoring.

In our organization, we are an MSSP partner portal partner with Splunk Enterprise Security. This partnership allows us to purchase directly from Splunk and then provide the tool to our clients.

We can add threat intelligence feeds on our side. When any malicious activity or known activity is found, we can create those types of alerts. When any malicious indicator of compromise or other activity is detected in our network teams, firewalls, routers, or switches, alerts are triggered.

I give Splunk Enterprise Security a rating of 9 out of 10. I would give it a 10 out of 10, but I reduced the rating by one point because some features such as dashboard capabilities could be better, which is why I give it a 9 out of 10.