Splunk Enterprise Security Reviews

My main use cases for Splunk Enterprise Security include detection engineering tasks. I work with the SIM team handling various responsibilities, specifically ensuring uptime availability and correct log ingestion.

Splunk Enterprise Security has helped improve my organization's business resilience. We have definitely been able to get significant value out of it.

As an administrator, I mainly ensure other people can use the system effectively rather than using it extensively myself. 

My impressions of Splunk's ability to predict, identify, and solve problems in real time are solid. I definitely notice when it makes predictions and helps with what we're trying to find in general. The ability to identify risks as they come in is quite good.

The integration of disparate security solutions supports our security operations by providing multiple methods to handle things. We have 21 lines of business with different Splunk pods, each requiring different solutions.

Personally, the integration creates some challenges, particularly when trying to standardize processes and migrate to Splunk Cloud. Managing different Splunk pods on-premises and separate stacks leads to confusion and time inefficiencies.

The process for customizing, developing, testing, deploying, and refining detections in Splunk Enterprise Security works adequately. While I don't write the detections myself, I work closely with those who do, and it doesn't seem to be an issue.

Our Security Ops team's incident remediation time has improved significantly. Previously, it took approximately 11 hours, but now it takes a few hours, though we're still working to reduce this time further through our migration to Splunk Cloud.

There are ways Splunk Enterprise Security can be improved, though I might be speaking specifically about my organization's implementation. Better education for users would be beneficial as they often don't know what they don't know or how to look for certain features.

Regarding ease of use, Splunk Enterprise Security is adequate. The challenge arises when we have multiple users trying to differentiate between the regular search head and the Enterprise Security search head. While users can accomplish their tasks, the main issue stems from education rather than the platform itself.

I have been using Splunk Enterprise Security for three years, with a six-month break in between. I have been using it extensively for the last year.

The stability and reliability of Splunk Enterprise Security is very good. While we've experienced some downtime, crashes, and performance issues, these were caused by end users running poorly optimized queries rather than system problems.

Splunk Enterprise Security scales effectively with our organization's growing needs. We haven't encountered any problems with scalability.

I would rate customer service and technical support from Splunk at nine out of ten. I have had nothing but good experiences with Splunk support, receiving timely and helpful replies. In one instance, when I needed immediate support, I received a call within ten minutes of submitting the ticket, and we resolved the issue promptly.

I am uncertain if my organization used another solution prior to adopting Splunk Enterprise Security. I believe we have been using Splunk the whole time, but this predates my joining the team.

The deployment is fine. I don't really have much of a problem with that end of things.

I have seen a return on investment with Splunk Enterprise Security.

I am not familiar with the pricing of Splunk Enterprise Security. Regarding licensing, we face some challenges. The management of different pods makes it confusing and complicated, but it gets resolved by our senior team members.

I use disparate security solutions that integrate or import data into Splunk Enterprise Security. We utilize many different tools.

I would advise other organizations to consider Splunk Enterprise Security as it's an easy solution to implement and effective for its intended purpose.

On a scale of one to ten, I rate Splunk Enterprise Security an eight.

On-premises

My main use case for Splunk Enterprise Security includes SIEM, SIEM services, network monitoring, detections and response, and data correlation.

We had an incident where we experienced command and control activity from an endpoint, which was a Citrix server that we had that is air-gapped or essentially firewalled off from our network. We used Splunk Enterprise Security to correlate the data and see the activity that was taking place with the threat actor.

Splunk Enterprise Security helped us piece together what was going on in that incident by making the investigation easier. It helped us build a report much quicker and helped us trace the activity much quicker.

The best features Splunk Enterprise Security offers include the ability to normalize data and integrate with other security tools and products from other vendors.

I use data normalization and integrations in my day-to-day work because we have several Splunk Enterprise Security-based apps, which save us time in investigation and help us piece together data and normalize it.

Splunk Enterprise Security has positively impacted my organization by helping us see our attack surface more efficiently and have more visibility on our network more efficiently.

Splunk Enterprise Security can be improved with additional features and newer features and tools.

I have been using Splunk Enterprise Security personally for around six to eight months.

I do not have anything else to add about how I use Splunk Enterprise Security.

I do not have anything else to add about the needed improvements.

I do not have anything else to add about the needed improvements or specific features or tools I wish it had.

Regarding Splunk Enterprise Security's AI capabilities, I think its governance and security are sufficient.

Regarding Splunk Enterprise Security's AI capabilities, I have no complaints so far as it is very accurate.

Splunk Enterprise Security has helped improve my organization's business resilience, and my impressions of Splunk Enterprise Security's ability to predict, identify, and solve problems in real-time are very efficient. It helps increase our response time and helps incident response in a more efficient and fast manner.

Splunk Enterprise Security has helped reduce my team's average Mean Time to Resolve, MTTR metric, but I cannot say by how much because I do not have access to those metrics in my position.

We are not utilizing risk-based alerting in Splunk Enterprise Security at this time.

I would rate this review an eight out of ten.

On-premises

My main use of Splunk Enterprise Security in my organization is to create detection rules for our clients.

Notably, the detection rule that I created with this tool is the RBA rules, Risk-Based Alerting, that we have used for many clients.

To implement an RBA rule with Splunk Enterprise Security, we took the templates provided by Splunk and adapted them to our needs, allowing us to detect things we were not able to detect before, such as pen tests.

The best features offered by Splunk Enterprise Security are the unified interface for managing content, whether it is detection rules, lookups, and so forth, and the identity part, which I think is the most important.

What I particularly appreciate about the unified interface and identity management is that it allows us to apply priorities to assets and identities and therefore respond in the best way to the alerts we receive.

Splunk Enterprise Security has had a positive impact on our organization by allowing us to detect new things with RBA.

The improvement I would like to see made to Splunk Enterprise Security is a unified interface across several Splunk tenants to manage our clients' Splunk content from a single place.

I have been using Splunk Enterprise Security for five years.

I find Splunk Enterprise Security stable in daily operation, and there is nothing to note about that.

Regarding the scalability of Splunk Enterprise Security in my different environments, I find it fairly slow, and new features take quite a long time to be developed.

I rate the customer support for Splunk Enterprise Security depending on the context, and on certain topics, we have considerable trouble finding information.

Splunk Enterprise Security is deployed in my organization in various ways since we are a service provider and it all depends on our clients' choices. We have on-premises, we have cloud, and we have various other configurations.

My company has a commercial relationship with this vendor other than as a customer because we are a partner, reseller, and service provider, so we advise and give guidance to our clients.

I have not seen a return on investment with Splunk Enterprise Security, and I cannot share concrete indicators such as time savings or human resource savings.

I do not have information on whether I have noticed a reduction in the mean time to resolve incidents (MTTR) thanks to Splunk Enterprise Security.

I have observed that the Risk-Based Alerting feature of Splunk Enterprise Security has not had a positive impact on the volume of alerts or on analyst productivity. On the contrary, it has actually generated quite a lot of alerts that are even longer to analyze, and the benefit is not necessarily immediate.

I do not really have an opinion on the Threat Topology features or the support for the MITRE ATT&CK framework in Splunk Enterprise Security in helping me discover the scope of an incident.

I have not noticed an improvement in the speed of threat detection thanks to Splunk Enterprise Security.

I would rate this review seven out of ten.

My main use case for Splunk Enterprise Security involves knowledge object development, detection engineering, data normalization, and alerting.

A specific example of how I use Splunk Enterprise Security in my day-to-day work is creating Splunk TAs to map non-normalized data to the Common Information Model.

The best features Splunk Enterprise Security offers include one single pane of glass for all your data, normalization, RBA built-in, assets and identities, detections, and everything built into one area.

Out of those features, I find myself relying on normalization and data models most often because that is how we structure our alerts to fire off all of our different data sources.

Splunk Enterprise Security has positively impacted my organization by giving our SOC a place to triage and respond to incidents and alerts as they come in, allowing us to respond to cyber incidents.

I believe Splunk Enterprise Security could be improved by costing less.

Splunk Enterprise Security's risk-based alerting, RBA, has slightly raised our alert volume because we have not turned off old alerts, but the fidelity of the alerts that RBA has provided us has been advantageous for uncovering true positives.

I have been using Splunk Enterprise Security for about five years.

Splunk Enterprise Security is stable on-premises, but in the cloud, we have had numerous outages.

I would not know about Splunk Enterprise Security's scalability because it is not managed by us.

My assessment of customer support is that it is terrible.

I would say we have seen a return on investment because Splunk Enterprise Security has been sufficient for our operational and SOC needs, which have allowed us to provide security as a service to the enterprise.

My experience with pricing, setup cost, and licensing shows that pricing is massively high.

Before choosing Splunk Enterprise Security, we are continuously evaluating other options, but none seriously at the moment.

We do not use Splunk Enterprise Security for business resilience; we mainly use ITSI and some custom workflows that have been developed by other people than me.

We annotate our detections; however, as far as helping us operationally, the threat topology and MITRE ATT&CK framework features are not very impactful.

The consolidation of SIEM, SOAR, and UEBA into a single interface is not available to us yet.

My advice to others looking into using Splunk Enterprise Security is to keep it on-premises.

Public Cloud

Amazon Web Services (AWS)

My main use case is for log management and checking the logs. We have rules running in Splunk Enterprise Security. We are using it as a main SIEM solution for our customers.

Alert fatigue is a common issue with security solutions, but Splunk Enterprise Security reduces alert fatigue. When we encounter real incidents, we get to dive deeper to check out the main cause of that incident. It is useful because it reduces alert fatigue.

The best feature of Splunk Enterprise Security is the documentation. Splunk Enterprise Security's documentation is well-organized. For example, if you have a problem or if you want to read about what you're looking for, you can easily go there and read from the documentation. It also has many resources worldwide. It is a de facto standard of the SIEM solutions. For example, I have used IBM QRadar, which is another solution many companies are using.

One of the most beneficial use cases for me is that Splunk Enterprise Security is fast. I cannot speak to how the SIEMs work in the backend, but I can say it is fast to find any logs. 

Its UX and UI experience is getting better. It is much better than one year ago. Some of the buttons and other features are much easier to locate and choose. The user interactions are much better than one year ago. The advanced queries are much faster. The UI design is much better. That is one of the best changes that happened in one year.

AI is an area that has room for improvement in Splunk Enterprise Security. I would say that AI plays a significant role in many of the cybersecurity tools I've used, not just Splunk. Many AI tools offer some form of assistance. By "AI assistance," I mean that while AI may not have complete knowledge of all customer flow data, it can still help engineers who often encounter unfamiliar situations. For example, during incidents, a large volume of logs can be generated, and it can be difficult to analyze all of them in a timely manner. In such cases, AI tools can be beneficial, even if they are not universally applicable. Certain events, like denial-of-service attacks, can result in massive log flows, which complicate detection and response efforts. Additionally, there may be similar collective issues affecting multiple customers.

Many cybersecurity tools incorporate some limited AI capabilities, which can assist operators. For instance, if a specific endpoint security issue arises with a customer, AI can help identify potential causes and suggest improvements. In my experience, most cybersecurity operators and companies rely on security tools that may not offer full-fledged SIEM solutions but do provide integrated security functionalities such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). My expectation is that even small, incremental integrations of AI will significantly enhance these tools' effectiveness.

I have been using the solution for approximately one year. I used it for 12 months in the company.

It's stable. I would rate it a ten out of ten for stability.

The scalability of Splunk Enterprise Security rates as an eight out of ten. I have not used the scalability option, but I would say the other procedures and processes are flawless. Scalability might be the same.

I have not reached out to their technical support because whenever I have an issue, I use the documentation rather than reaching out to technicians. When there is an issue, people need swift assistance to solve it. People do not want to wait, so I mainly use the documentation.

Neutral

I have worked with other SIEM solutions. Splunk Enterprise Security is great but can have some frustration points. It can sometimes be slower to use. On the other hand, when I use IBM QRadar, it rarely experiences slowdowns, especially when using the Incident Command Module (ICM). In the case of Splunk Enterprise Security, the speed might be affected by the number of systems in use or possibly due to how the security engineers configure it. As an operator, I find that the speed is a reason I would rate it an eight out of ten. Overall, it's very fast and accurate, and the user interface is excellent for various uses, such as querying data. However, I do notice that it can be slightly slower compared to other large enterprise solutions.

Most of the time, it is deployed on-premises. We don’t rely heavily on cloud solutions, although we have explored them a bit. Our customers, particularly in the financial industry, tend to prefer on-premises systems due to their concerns about cloud security.

Having good documentation is helpful for deployment. If the documentation is lacking, it can be challenging. The ease of navigating the systems really depends on a person's experience. 

The duration varies depending on the company. I can't give a specific answer because it depends on several factors, such as the number of people working in the system, the number of endpoints, and how many on-premises servers are running. In my case, I haven't experienced a full deployment, as I've only deployed a few endpoints and on-premises services. This process took just a couple of days for me, but I haven't dealt with a large-scale on-premises deployment. When I joined the company, they were already using Splunk for various on-premises services, so I haven't gone through a complete zero to one hundred type of scenario.

Splunk Enterprise Security absolutely requires maintenance, but I don't deal with maintenance. It needs maintenance, but I have not encountered much of it. 

From a return on investment standpoint, Splunk Enterprise Security saves a lot of time. I have used other SIEM solutions, and they are not so great. They create lots of exhaustion and frustrating periods of checking queries, and the response times are slower. This leads to a lot of frustration because many companies don’t rely on just one SIEM tool; they often use multiple alternatives simultaneously.

The documentation for Splunk Enterprise Security is outstanding. It is well-organized and easy to access. You can simply go to the Splunk documentation website, search for what you need, and by the end of the day, you’ll have a great solution for any issue you encounter with Splunk Enterprise Security. In contrast, other SIEM tools often lack this level of documentation, which is quite disappointing. 

Splunk Enterprise Security also excels with its user interface. It is easy to navigate and integrates seamlessly with other services, which is a significant advantage. You can easily search for solutions, try out different features, and create reports.

As a security operator, one of our main responsibilities is writing reports. If an issue arises, clients will often ask, “What happened around noon? Can you explain the main issue?” Other SIEM tools can make it difficult to find the appropriate buttons or functions to navigate and analyze these incidents. However, with Splunk Enterprise Security, you just look up the documentation, write what you’re searching for, and apply the same rules in Splunk Enterprise Security. Everything is easy to follow, and the system works effectively. In summary, I would say that the well-documented guidance is one of the most valuable aspects for saving me time.

I have not used the advanced correlation capabilities so much because mainly all of them are running. Specifically, I have not gone very deep into the use case of Splunk Enterprise Security. I have used advanced queries a couple of times. For example, there was a sort of attack, a false positive attack. We had to check out all the timelines or block queries to find out what might have happened or what the reason was for the false positive. I used that and it is quite fast.

I have not used the risk-based alerting feature. It is more for log management and checking the log flow. 

Whenever you want to apply for any exams, such as the SOC exam or Blue Team certification exams, they mainly ask for Splunk rather than other SIEM solutions. For me, it is overall the best SIEM solution to use.

I can recommend Splunk Enterprise Security to other users. It is fast and well-documented. User interface and user interaction are well-designed compared to other SIEM solutions. It is a great SIEM tool.

I would rate Splunk Enterprise Security an eight out of ten.

On-premises

We primarily used Splunk Enterprise Security for data and cloud ingestion. We also leveraged it for enterprise security use case engineering, which encompassed malware analysis, threat management, detection, and the integration of threat and vulnerability intelligence, culminating in comprehensive reporting and dashboards. This was the principal use case for our SIEM platform. In recent years, we have also employed Splunk for user behaviour analytics to bolster insider threat protection.

We implemented Splunk Enterprise Security to improve security monitoring, threat detection, and incident response.

Although Splunk is not the only tool we use, it is essential that it provides end-to-end visibility into threats in our environment.

Splunk is effective for helping find security events across multiple cloud, on-premises, or hybrid environments.

Splunk helps improve our organization's ability to ingest and normalize data.

Splunk helps us identify threats in real-time.

We integrated 50 percent of the MITRE ATT&CK framework's techniques to enhance our incident detection capabilities.

Splunk Enterprise Security effectively analyzes various security events and has helped improve my organization's ability to ingest and normalize data.

Splunk helped us detect threats faster. 

Splunk Enterprise Security reduced the investigation time by consolidating datasets for quick access.

Splunk Enterprise Security enhances business resilience and assists with threat detection by centralizing security data.

I have a positive impression of Splunk's ability to predict, identify, and solve problems.

Splunk Enterprise Security helps reduce our mean time to resolve.

The Splunk Enterprise Security's threat-hunting capabilities have been particularly useful in later releases.

Splunk Enterprise Security would benefit from a more robust rule engine to reduce false positives. While its detection capabilities are efficient, there is room to improve its alert volume reduction and false positive management efficiency. Furthermore, enhancements in its integration capabilities with other security infrastructures could optimize its overall effectiveness.

I have been using Splunk Enterprise Security for 13 years.

In terms of stability, Splunk is good. It provides a stable environment but needs to integrate with ITSM platforms to achieve better visibility.

Splunk Enterprise Security is efficient and scalable, especially for large environments with substantial scalability needs.

The technical support for Splunk met my expectations.

Positive

I haven't switched to Splunk from another solution, but I have used various products, such as Google Chronicle, Securonix, ExtraHop, and Sumo Logic, to meet different customer needs. Securonix is used more for behavioural analytics and insider threats, whereas Splunk is used for logging and monitoring.

The initial setup of Splunk Enterprise Security is straightforward, but it does require skilled personnel.

The implementation involved an architect, cloud DevOps engineer, data engineer, full-stack developers, and cybersecurity engineers. A team of five to six members, tailored to different roles, was typical.

Splunk's cost is justified for large environments with extensive assets. However, for smaller organizations, other products may provide better value for money.

Splunk is priced higher than other solutions.

I would rate Splunk Enterprise Security nine out of ten.

Splunk Enterprise Security requires continuous maintenance and support, which requires a dedicated team. Previously, seven to eight personnel were focused on platform maintenance. Additional resources may be required to optimize for multiple customer environments. 

For those evaluating SIEM solutions solely based on cost, Splunk might not be suitable. It is essential to consider security, context, and specific use cases rather than just choosing based on price. Critical assets need the right platform for effective protection rather than opting for a cheaper solution.

On-premises

Splunk Enterprise Security serves as my main security solution. We raise notable events and pass them to the SOAR for security purposes. When I raise notable events and pass them to the SOAR, I track insider threats and external security incidents.

Splunk Enterprise Security offers excellent correlations, enhancements, and risk features that help my team. Data scrubbing for anomalous events stands out most for me because it ensures we focus on crucial alerts.

Splunk Enterprise Security has positively impacted my organization as it is embedded in our workflows and raises notables that are investigated by CERT analysts. The embedding and investigation process has improved things for my team by yielding better detection rates.

The assets and identities framework in Splunk Enterprise Security could benefit from more integrations for improvement.

I chose eight out of ten because of the lack of retroactive IOC hunts and potentially missing data, which prevented me from giving it a ten. Splunk Enterprise Security has helped improve my organization's business resilience, though my impressions of its ability to predict, identify, and solve problems in real-time are somewhat lacking due to a delay in search windows and possible overlap in data availability.

I have been using Splunk Enterprise Security for thirteen years.

Splunk Enterprise Security is stable.

Its reliability is good as it scales well.

The customer support for Splunk Enterprise Security is sufficient.

We have had Splunk Enterprise Security for over ten years and did not previously use a different solution.

I have not seen a return on investment; my focus was on the quality of alerts and detections, as our detection framework was previously version controlled.

My experience with pricing, setup cost, and licensing indicates that the licensing is prohibitively expensive.

Before choosing Splunk Enterprise Security, we conducted a bake-off with Google SecOps and Palo Alto's XSIAM.

We recently upgraded to Splunk Enterprise Security version 8.4, and the terminology normalization is a good move. The Analyst Queue is very similar to previous versions incident review, and we have not yet utilized those workflows. We recently implemented the risk-based alerting (RBA) index, and I have yet to evaluate the improvements. We had the MITRE ATT&CK framework in place prior to this version, which has been useful. You should focus on data onboarding, indexing, and source typing per Splunk best practices. I gave this product a rating of eight out of ten.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Splunk Enterprise Security is reviewing incidents in the Mission Control dashboard for our clients. When an incident occurs, my analyst team and I review every incident and conduct investigations to view logs and perform formal investigations.

A specific example of how I have used Splunk Enterprise Security recently is when an incident in the Analyst Queue occurs or triggers. We review every property of the incident, including the host name, the user involved, and any risk events. Meanwhile, we work in an investigation file, and for the client, we deliver this as a PDF file or a Word file. Everything that we find in the alert or in the logs, we build a timeline so that when an incident occurs, we provide the client with the scope. When we deliver an investigation, the client knows what happened, who did it, and other relevant details.

I have been using the RBA framework increasingly. When an incident is happening, we review many things in this dashboard. When a host is involved, we review the most recent incidents in the risk framework, and when we review the alert, we know what was happening with this host.

Splunk Enterprise Security has positively impacted my organization because as a team, we have built a framework for how we can investigate things. Before we used Splunk Enterprise Security, when an incident happened, the team did not know how to start an investigation. Now that we are using most of Splunk Enterprise Security's features, we review the alert, the properties of the alert, and with that information, we can start to build an investigation. The most important part that Splunk Enterprise Security gives us is a framework to investigate incidents.

Since we have been using Splunk Enterprise Security, the most important part for our team is that we can build investigations very quickly. While I do not have specific numbers or metrics, I have seen this improvement in the team and in our framework to work.

The best features that Splunk Enterprise Security offers are the intelligence side, which is the most important aspect for my team and our investigations. When we were searching for traffic in the network, we use a lot of features including the traffic search or the intrusion search, and most of these features give us context of what is happening.

The intelligence features help my team in daily work and investigations because when an alert is triggered in the network side, we review this dashboard. When we have a malicious IP, we search this IP in all the traffic and we know what hosts this IP may have targeted. With these dashboards, we build a story so that the client has a great scope of what is happening or the incident.

I have noticed with a lot of clients that the instances in the cloud have been really slow. When the team performs an update in the instance, some features are missing. The most recent thing we have noticed is that when a version is updated, we miss the button of the short ID, which we use to identify our investigations or reports. Since the update was applied, we did not see that button, so these types of things in the dashboard or in the metrics of the operation in the cloud instance have been impacted.

I think it would be great if Splunk Enterprise Security could add an EDR solution. If we install a sensor in the endpoint, the sensor could forward the logs of Sysmon into a SIEM in a more rapid and efficient way.

I have been using Splunk Enterprise Security since the beginning of 2025. I have been using it for Mission Control and detections.

In my experience, Splunk Enterprise Security is stable. However, when Splunk applies an upgrade, the instance could suffer some impacts. When the team applies an upgrade, we are very careful to control what happens in the instance.

When it comes to scalability, I think that is more of the license involvement. I do not know if the technical side has some part in that.

The customer support for Splunk Enterprise Security is very good. When we open a ticket with PS or something similar, the team responds very quickly and with complete information. I would rate the customer support a 10.

Since we are using the RBA framework, I think Splunk Enterprise Security has helped improve my organization's business resilience because we can know when a host or a user is acting in a suspicious or malicious way. If we identify this behavior, we can have answers for our clients. With this framework, knowing how an endpoint or a user behaves, we can understand if something is malicious or not.

Splunk Enterprise Security has helped reduce my team's average mean time to resolve, MTTR metric. While I do not have a specific number in metrics, what I have seen is that the team can investigate findings in a more specific way by reviewing logs. When we deliver an investigation, the client knows what is happening.

When we configure an alert in Splunk Enterprise Security, we map the attacks in every detection, and when the client or the team reviews an alert, we know what is happening and what MITRE ATT&CK it is related to.

While I do not have the exact numbers since I work more in the technical side, I think we have seen improvements in alert fatigue using RBA with Splunk Enterprise Security.

The advice I would give to others looking into using Splunk Enterprise Security is to understand what kind of information from indexes they are currently ingesting in Splunk, so when an incident occurs, the team would perfectly know what is happening and where to search for it.

Public Cloud

Microsoft Azure

My main use case for Splunk Enterprise Security is investigations. A specific example of how I use Splunk Enterprise Security for investigations is diving deeper into triage alerts.

The best features Splunk Enterprise Security offers include searching for data to correlate with Jira alerts.

The ability to search for data and correlate with Jira alerts helps my daily work by enabling me to identify false positives, find traffic that can be tuned, and quickly identify malicious IP addresses. Splunk Enterprise Security has positively impacted my organization by providing SOC as a service and allowing us to find information quickly and escalate in a timely manner.

Regarding Splunk Enterprise Security's AI capabilities, we are currently not using the AI capabilities; however, I am excited about the AI capabilities that are being developed and hope that the government is more open to using the AI capabilities of Splunk.

As far as reliability goes, I think that the AI capabilities will still need some human interaction, and I do not feel comfortable yet truly trusting everything that AI does.

I have been using Splunk Enterprise Security for two years.

Splunk Enterprise Security is stable.

I think the scalability of Splunk Enterprise Security is good.

I believe that the customer support for Splunk Enterprise Security is excellent; as we are government, we have our own reps that we can reach directly out to, and they are always very responsive. I would rate the customer support on a scale of one to ten as ten.

I think Splunk Enterprise Security helps identify what part of the MITRE ATT&CK framework that the incident falls under.

I believe that Splunk Enterprise Security Essentials has contributed to a reduction in analyst burnout or fatigue; it removes having to go to multiple tools to pull data and find what I am looking for and puts the story together for me.

My advice to others looking into using Splunk Enterprise Security is to make sure that you are aware of all of the capabilities and ask for demos so that you ensure that you are using everything possible to make the best of your environment. I rate this review overall as a ten.

On-premises

Other

We use it for real-time monitoring and alerts for all instances and servers on our sub-prod instances. It helps in monitoring, getting alerts for specific errors, and identifying various logs. We also use it for log analysis, which is very beneficial.

My use case is more related to production issues. Threat detection is taken care of by another team.

It is our go-to tool for monitoring multiple cloud environments. The difficult part initially is to understand how the logging is happening for particular applications or instances. Once you have an understanding of what you want to see and how they are getting generated, you can just write queries, and you can create exhaustive dashboards for anybody to look at and understand how things are.

Splunk Enterprise Security is good for analyzing malicious activities and detecting breaches. Its threat detection capabilities are good. We can look at the exact activity and task. We can look at a trace and understand what is happening. It gives a very granular understanding. I see emails from the security team mentioning what they have identified, so it seems to be helpful for threat detection.

Based on the org mail that we received, they were able to block almost 95% of threats in real time. That is a pretty good number.

Splunk Enterprise Security helps to reduce alert volume because you can understand patterns, such as where your requests are going and how everything is happening. There has been a 40% to 50% reduction.

Splunk Enterprise Security has helped speed up our security investigations by 40% to 50%. It has helped the security team to get a head start and understand where the issue is originating and where the problem is. We are operating in a very dynamic environment, so any time lost costs the company money.

I can create dashboards to collect and view information in a tabular, graphical format. This feature is important because it helps me understand time-series data over one or two hours. It creates graphs, allowing us to check spikes and examine average values and 90th and 95th percentile values. This capability is useful for performance monitoring and issue identification. I believe it has helped speed up security investigations.

Data retention can be better. If we want to look at the data for five months or six months, that is not available to us. We only have a history of 20 or 30 days. After that, the information gets lost. That is a drawback. 

Splunk's dashboards are pretty basic. In comparison to Grafana, the dashboards are not as detailed. There is room for improvement in that area.

I have been using it for about one and a half years now.

It is stable. I have not encountered any stability issues so far.

It is easy to scale. We have multiple instances, sub-instances, and prod instances running, so scalability is not a problem.

It is being used by development teams, QA teams, performance teams, and security teams. We have about 500 people using it.

It is good. I have not had any major issues where support was lacking, so I would rate it positively.

Positive

In this organization, I did not use any similar solution. In my previous organization, we used APM tools like Dynatrace and AppDynamics, which helped us monitor real-time data and performance. Splunk is a similar tool but offers more capabilities and is also cost-effective.

It was an organizational decision to go with Splunk Enterprise Security. It involved financial considerations and the kind of deal Splunk provided, as we are using the enterprise version and another version. Economics, capabilities, and support were factors.

I was not involved in its deployment. When it comes to maintenance, another team looks after it and takes care of maintenance.

I have not been involved in the finance part, so I cannot comment on ROI or costs. However, preventing incidents or solving performance issues saves money, converting time saved to money. Customers are happy. Employees are happy. There is less downtime.

I am not aware of the costs; that is handled by a separate team. I only use it for logs and performance issues.

Instead of going for the cheapest solution available, you should go for the one that meets your needs. It takes time for an organization to onboard a new solution, so it is important to choose the right solution from the start. I believe all available solutions are pretty good, so you should see what suits you better.

It is a great tool. If you learn to navigate it, you can access a wide range of information about any application or product. It is a very helpful tool, provided you know how to use it. 

Overall, I would rate it a nine out of ten.