Try our new research platform with insights from 80,000+ expert users

Cisco XDR vs Splunk Enterprise Security comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 30, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco XDR
Average Rating
8.8
Reviews Sentiment
7.5
Number of Reviews
5
Ranking in other categories
Extended Detection and Response (XDR) (21st)
Splunk Enterprise Security
Average Rating
8.4
Reviews Sentiment
7.4
Number of Reviews
327
Ranking in other categories
Log Management (2nd), Security Information and Event Management (SIEM) (1st), IT Operations Analytics (1st)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Cisco XDR is designed for Extended Detection and Response (XDR) and holds a mindshare of 2.0%, up 0.2% compared to last year.
Splunk Enterprise Security, on the other hand, focuses on Security Information and Event Management (SIEM), holds 9.4% mindshare, down 11.8% since last year.
Extended Detection and Response (XDR)
Security Information and Event Management (SIEM)
 

Featured Reviews

Aruna Udawatte - PeerSpot reviewer
Network visibility improves with centralized maintenance and responsive support
We are integrators, and we also resell Cisco XDR. Global customers are the primary users of Cisco XDR, while local customers often don't request it. For global customers, they directly request Cisco XDR and share all the part codes with us The single point of maintenance and dashboards are the…
ROBERT-CHRISTIAN - PeerSpot reviewer
Has many predefined correlation rules and is brilliant for investigation and log analysis
It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"One of my favorite features of Cisco XDR is the automation tool, which saves a lot of time because we can craft these automations and workflows."
"The feature I appreciate the most about Cisco XDR is the reliability."
"Technical support from Cisco is good and very helpful."
"The feature I appreciate the most about Cisco XDR is the reliability."
"One of my favorite features of Cisco XDR is the automation tool, which saves a lot of time because we can craft these automations and workflows."
"Cisco XDR offers threat intelligence and links with the Firewall."
"The features of Cisco XDR benefit my company since time is money. When outages happen and when a customer can't reach the internet, they get agitated. Therefore, the quicker we can mitigate an issue, our customers get happier in a quicker fashion."
"Cisco XDR offers threat intelligence and links with the Firewall."
"The two features I appreciate most in Splunk Enterprise Security are the content management system and the inter-incident review dashboard."
"I can create dashboards to collect and view information in a tabular, graphical format. This feature is important because it helps me understand time-series data over one or two hours."
"The features of Splunk Enterprise Security that I have found most valuable include the risk-based score and UBA/UEBA, user behavior analytics, or user and entity behavior analytics."
"The ability to manage large amounts of generated data and to protect all devices from unauthorized use are the most valuable features."
"We can ingest and correlate data from virtually any type of system."
"This solution helps us increase our productivity."
"The correlation capabilities are the first value that our clients say they like with Splunk."
"The breadth of the data sources that Splunk can ingest data from is broad and deep and it does an exemplary job at handling structured data."
 

Cons

"If we have a list of domains we need to block, such as 4,000 domains, I can only block 100 domains at a time because if I put in more than 100 domains, I hit that 2,000 character max and can't continue with an investigation. Being able to put in all 4,000 domains, without a character limit or observable limit, would make doing those case books a whole lot easier and blocking those domains a whole lot easier too."
"When we first started with Cisco XDR in August, everybody was having issues. There were three people in our organization, including me, who couldn't even log in to Cisco XDR."
"Cisco XDR can be improved by addressing the upfront cost. Everything matters for us since we're small, mom and pop, so every dollar counts."
"The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated."
"My only complaint about Cisco XDR is related to licensing, which is complicated."
"They need to provide better pricing and bundle XDR licenses with products like Meraki solutions or Firepower Threat Defense."
"They need to provide better pricing and bundle XDR licenses with products like Meraki solutions or Firepower Threat Defense."
"Cisco XDR can be improved by addressing the upfront cost."
"One thing that I probably dislike the most about the Splunk product is their support."
"The biggest problem is data compression. Splunk is an outstanding product, but it is a resource hog. There should be better data compression for being able to maintain our data repositories. We end up having to buy lots of additional storage just to house our Splunk data. This is my only complaint about it."
"Sometimes, the data does not match what we're looking for, or the tool contains incorrect data."
"Certain sections of the developer documentation could use some updating and clarification."
"Although the technical support is adequate, there is still room for improvement."
"I would like more assistance with use cases and help with teaching us how to use it once it's installed."
"Splunk could be improved by reducing the cost. The cost is one of the biggest challenges for us in keeping to our production requirements."
"The threat management part is still lagging. There are some gaps in threat management. Other vendors have built-in threat management systems, but Splunk lacks the threat management component in its portal. The UEBA and everything else is perfect, but it lacks a unified threat intelligence and management part."
 

Pricing and Cost Advice

"The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated."
"Splunk Enterprise Security is expensive but the solution is equipped with a lot of features."
"Although Splunk is an expensive product, it is designed to be utilized across your organization in order to maximize your ROI and lower your TCO."
"You will eat up whatever you purchase quickly. The level of insights that Splunk empowers is addictive."
"We have an unlimited one, and we pay yearly, but I don't know how much it costs. Previously, I worked for a startup, and when they started building it up, it was complicated for them because they didn't have the budget for that many licenses. It was very costly for them. So, startups might find it a little bit problematic because of the licensing, but for bigger companies, there is no issue."
"Splunk is priced higher than other solutions."
"In addition to the licensing fee, there is also a support and maintenance charge."
"Splunk Enterprise Security is not a cheap product, but I think it is worth every dollar that you pay."
"It is economical than other solutions."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
865,295 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
13%
Manufacturing Company
9%
Government
8%
Financial Services Firm
7%
Computer Software Company
14%
Financial Services Firm
14%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Cisco XDR?
The licensing of Cisco XDR is a bit complicated. The cost can depend on what it is, and the process can be a little complicated.
What needs improvement with Cisco XDR?
My only complaint about Cisco XDR is related to licensing, which is complicated.
What is your primary use case for Cisco XDR?
We use Cisco XDR for our network devices and data centers, as we are an internet provider. We deliver the internet to customers.
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...
How does Splunk compare with Azure Monitor?
Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Information Not Available
Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Find out what your peers are saying about CrowdStrike, Microsoft, SentinelOne and others in Extended Detection and Response (XDR). Updated: July 2025.
865,295 professionals have used our research since 2012.