Splunk Enterprise Security and Cortex XSIAM compete in the cybersecurity space. Splunk Enterprise Security has the upper hand in log management and dashboard customization, whereas Cortex XSIAM is strong in AI-driven threat intelligence and third-party integration.
Features: Splunk Enterprise Security provides strong log management, scalability, and data analysis, making it flexible and comprehensive. It excels in dashboard customization and operational intelligence, allowing fast availability of operational data. Splunk can ingest data from various sources, providing compliance support and integration across solutions. Cortex XSIAM integrates machine learning for threat detection and offers advanced automation and integration features. It focuses on AI-driven threat intelligence and seamless third-party integration, enhancing its overall adaptability.
Room for Improvement: Splunk Enterprise Security users suggest improving its operational workflow, integration complexity, and customization capabilities. The initial setup can be complex, and users want better visualizations. Cortex XSIAM needs improvement in data onboarding integration and expanding its pre-built automation capabilities. Splunk focuses on streamlining features, while Cortex XSIAM works on improved integrations and performance.
Ease of Deployment and Customer Service: Splunk Enterprise Security is flexible in deployment across public, private, and hybrid clouds, yet complex and requires familiarity with the platform. Its technical support is knowledgeable but sometimes delayed. Cortex XSIAM supports diverse deployments, but the licensing process can be complex. Despite the challenges, Cortex XSIAM offers positive cost predictability and customer support.
Pricing and ROI: Splunk Enterprise Security is known for its high cost, particularly for data ingestion, offering significant ROI through comprehensive features but proving expensive for smaller organizations. In contrast, Cortex XSIAM provides competitive pricing that aligns well with budget expectations, though optional add-ons incur additional costs. Both solutions provide valuable returns, with Splunk’s versatile features justifying its higher price in extensive use cases.
The documentation for Splunk Enterprise Security is outstanding. It is well-organized and easy to access.
I have noticed a return on investment with Splunk Enterprise Security, as it delivers substantial value for money.
Customers see the value in investing in this solution, particularly when it helps resolve issues quickly, turning a potential 20-hour response into one hour.
With premium support, core Palo Alto technical experts handle issues directly.
It is ineffective in terms of responding to basic queries and addressing future requirements.
The Palo Alto support team is fully responsive and helpful.
We have paid for Splunk support, and we’re not on the free tier hoping for assistance; we are a significant customer and invest a lot in this service.
If you want to write your own correlation rules, it is very difficult to do, and you need Splunk's support to write new correlation rules for the SIEM tool.
They try to close issues as soon as possible, often just offering documentation links.
Without proper integration, scaling up with more servers is meaningless.
Cortex XSIAM is highly scalable.
They struggle a bit with pure virtual environments, but in terms of how much they can handle, it is pretty good.
It is easy to scale.
It's big in a Central European context, and small from a Splunk North American context.
The product was easy to install and set up and worked right.
Overall, Cortex XSIAM is stable.
They test it very thoroughly before release, and our customers have Splunk running for months without issues.
It provides a stable environment but needs to integrate with ITSM platforms to achieve better visibility.
I would rate it a ten out of ten for stability.
Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long.
Cortex XSIAM needs improvements in terms of data onboarding, parsers, and third-party integration supports.
Cortex could improve the detection and online resolution of security vulnerabilities.
Improving the infrastructure behind Splunk Enterprise Security is vital—enhanced cores, CPUs, and memory should be prioritized to support better processing power.
Splunk Enterprise Security is not something that automatically picks things; you have to set up use cases, update data models, and link the right use cases to the right data models for those detections to happen.
For any future enhancements or features, such as MLTK and SOAR platform integration, we need more visibility, training, and certification for the skilled professionals who are working.
The first impression is that XSIAM would be more expensive than others we tried.
The product is very expensive.
Cortex XSIAM is pretty expensive, and the licensing process is not very comfortable.
I saw clients spend two million dollars a year just feeding data into the Splunk solution.
The platform requires significant financial investment and resources, making it expensive despite its comprehensive features.
I find it to be affordable, which is why every industry uses it.
One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities.
The flexibility for creating manual workflows stands out.
Its signature-less subscriptions and robust detection power stand out in improving threat detection.
This capability is useful for performance monitoring and issue identification.
I assess Splunk Enterprise Security's insider threat detection capabilities for helping to find unknown threats and anomalous user behavior as great.
Splunk Enterprise Security provides the foundation for unified threat detection, investigation, and response, enabling fast identification of critical issues.
Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.
Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.
What are Cortex XSIAM's key features?
What benefits are evident in Cortex XSIAM reviews?
Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.
Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.
Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.
What are the key features?Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
