What is our primary use case?
I have some experience with Splunk solutions as I worked in a cybersecurity company, an MSSP company, for about two years. Before that, I worked within global technology IT companies like British Telecom and other Telco companies. I sit on both sides of the table in both domains.
I have some experience, though not very deep, with some projects involving Splunk MCP Server SIEM solutions. During my last job with CFN Chemicals, I worked as an IT manager within a chemical manufacturing company where we used a SIEM solution with Splunk MCP Server.
Installation of Splunk MCP Server is generally acceptable, but depending on the service and overall experience, I received service from one of the MSSP companies that provided a Splunk MCP Server solution for us. Some customizations and alert configurations after the installation are more problematic. It is important to configure Splunk MCP Server according to the organization's requirements and structure, which is mostly not handled well in our region.
I mostly handle things myself using Splunk MCP Server portal and its documents or checking in a demo environment, which I believe is the best way. The MSSP company's response time is acceptable, but their overall experience and knowledge may not be as high as European MSSP companies, according to my experience.
The product has a significant impact on my real-time decision-making by providing automated messages and notifications for security issues proactively. These notifications are essential for us to check if there is an issue before a major incident, even if they can sometimes be false positives. Alerts from this perspective, even one or two times per year, are very valuable, so the product does its job well.
What is most valuable?
Splunk MCP Server is a standard SIEM solution.
Splunk MCP Server offers a huge opportunity to configure the solution according to organizational needs, but this is not easy for most companies. It is better to get support from external MSSP companies. As far as I can see, MSSP companies in Turkey are also not very capable, and this is the issue.
I learned that Splunk's capabilities in Machine Learning and AI are very powerful. I started to read and try to understand this part, but I have not had a chance to work with it in a real product, demo, or production environment.
I used the product from both MSSP companies and managed it mutually, so I had a chance to access the product. This is one of the powerful sides of Splunk MCP Server.
The product does provide benefits in terms of performance, but my team has not had the chance to learn and develop themselves. We cooperated with the MSSP company on this part, which has been acceptable.
Splunk MCP Server is one of the main functions of our security strategy and cyber defense strategy. It is crucial to configure it to get information, logs, and alerts from other infrastructure and security systems. If this integration part is not done properly, Splunk MCP Server cannot detect and alert us, which is a critical aspect. We need to develop ourselves, as my company and MSSPs need to advance their integration capabilities with customers.
What needs improvement?
There is definitely room for improvement in terms of customization and alert configuration.
For how long have I used the solution?
I have two to three years of experience with Splunk MCP Server.
How are customer service and support?
I rate the support as seven out of ten.
How would you rate customer service and support?
How was the initial setup?
The last deployment of Splunk MCP Server occurred before I started at CFN Chemicals, so I do not know the exact timeline. However, the deployment, standard configuration, and installation are generally acceptable and do not take much time.
After that, the pre-configuration and final configuration according to organizational needs is the main and more difficult part.
What about the implementation team?
I used third-party services from an MSP company to deploy the product.
What's my experience with pricing, setup cost, and licensing?
Since we mostly use it on-premises, I am not fully aware of all licensing pricing information, but I can see that the price is very high.
I do not know if cloud license prices are more moderate or acceptable compared to on-premises licenses.
I believe that the on-premises license cost is higher than the cloud license cost; I could not confirm this, but this is one of the main reasons I believe Splunk MCP Server solution costs are very high for Turkish companies.
What other advice do I have?
I have very limited knowledge of solutions such as Splunk User Behavior Analytics, Splunk Attack Analyzer, Splunk SOAR, or Splunk AppDynamics. I have heard the names or features of these products, but I never had a chance to use them.
I started to work as a programmer or project engineer around 1998, or even 1996.
Since I am based in Turkey and we have strict regulations for the Telco domain and finance sector, we need to deploy SIEM solutions on-premises.
All these domains require an on-premises deployment of a SIEM solution.
There are different regulatory authorities in Turkey depending on sectors such as Telco, energy, and finance. A SIEM solution is almost mandatory in all these sectors, and Splunk MCP Server is one of the best to meet the regulatory requirements. The main hurdle is that you need to use an on-premises environment due to regulatory perspectives.
Considering the ongoing improvements with the cloud and especially Machine Learning and AI, I rate Splunk MCP Server between eight to nine, and it is closer to nine. I have given this product an overall rating of nine.
