Splunk Enterprise

Splunk Enterprise Platform serves as our primary solution for centralized log collection, real-time security monitoring, threat detection, incident investigation, and alert management. The cloud deployment simplifies platform maintenance and scaling.

Beyond threat detection, we use Splunk Enterprise Platform daily for alert triage, incident investigation, threat hunting, dashboard monitoring, and reporting. It provides us with centralized visibility and helps us respond to incidents more efficiently.

For example, when Splunk generates a high-risk sign-in alert, I correlate authentication and endpoint logs, review the user's activity, source IP, device, and MFA events, and then determine whether it is a true positive or false positive.

I would highlight centralized log management, fast search, real-time alerting, correlation searches, customizable dashboards, scalability, and strong integration as the best features of Splunk Enterprise Platform.

Customizable dashboards in Splunk Enterprise Platform give our SOC team a real-time view of key security metrics, including critical alerts, authentication activity, endpoint detections, and incident status. This helps us quickly identify high-priority issues and monitor the overall security posture from a single screen. Correlation searches automatically combine events from multiple data sources to detect attack patterns that individual alerts might miss. For example, a phishing email click followed by a suspicious sign-in and unusual endpoint activity can be correlated into one high-confidence alert, which reduces false positives and speeds up investigation.

I would also highlight strong integration, scalability, powerful search language, reporting, and the app ecosystem within Splunk Enterprise Platform. These features make it easy to centralize data and adapt the platform to different security and operational needs.

While I cannot share internal metrics, I can say that Splunk Enterprise Platform has led to faster incident triage, better visibility into security events, and reduced time spent on manual investigations due to centralized log analysis and automated correlations.

While I do not have official figures, I estimate that investigation and triage time has improved by around twenty percent to thirty percent for many common security incidents due to centralized log visibility and automated correlation with Splunk Enterprise Platform.

I would like to see more flexible licensing, easier deployment and administration, enhanced AI-driven automation, and more built-in dashboards and detection content in Splunk Enterprise Platform.

I chose nine out of ten for my rating because of the licensing cost and complexity of deployment and administration.

I have been working in my current field for two years.

I would consider Splunk Enterprise Platform to be very stable. It has been reliable for log collection, search, and security monitoring with consistent performance in our daily operations.

I do not have direct experience with petabyte-scale deployments using Splunk Enterprise Platform, but it appears to provide strong scalability, flexible data residency options, and governance controls that support data sovereignty requirements in large enterprise environments.

I would rate Splunk Enterprise Platform's scalability as very high. It scales adequately with growing data volumes and users while maintaining strong performance for search, analytics, and security monitoring.

The customer support for Splunk Enterprise Platform is good.

In my previous project, we used another solution before Splunk Enterprise Platform, but in the project that I am working on currently, we have been using Splunk Enterprise Platform from day one.

The pricing for Splunk Enterprise Platform is on the higher side, especially as log volumes grow. Setup requires planning and expertise, but the platform's capability, scalability, and reliability justify the investment for enterprise environments.

My advice for others looking into using Splunk Enterprise Platform is to start with clear use cases, onboard the right data, train your team on Splunk Enterprise Platform, optimize the searches and dashboards, and keep an eye on data ingestion to control licensing costs. Proper planning will help you get the most value from the platform. I would rate this product nine out of ten.

First of all, I have to log in to Splunk Enterprise Platform with my login credentials provided by the company. Our company is RamnaSoft. Then I monitor the alerts coming in or analyze the logs coming in. I do the initial triage to the alerts. If I get some true positives, then I investigate further, examining IOCs and IOAs. I document it and forward it to my IR team or senior team, which is SOC 2 or SOC Level 3. Also, if I get some false positive alerts while initial triaging, then I update that in documents and also inform the IR team to monitor these false positive alerts to make changes according to their rules and procedures.

Federated Search is helpful, but it needs some basic knowledge of the log codes and query languages. I should know the queries to search on them.

What I like the most about Splunk Enterprise Platform is that it generates alerts with true positives only. There are fewer false positives, which is good for me. The alerts are good.

I use the Federated Search feature of Splunk Enterprise Platform for particular queries. I enter some queries there, and it responds accordingly.

What I dislike about Splunk Enterprise Platform is that there are so many logs coming in. Sometimes, unwanted logs are present, such as file creations. I do not prefer those logs.

To clarify, if some legitimate users create unnecessary files, it generates a log. Those logs are created, so I find that frustrating. Those logs are not useful to us.

I have been using Splunk Enterprise Platform since last year, January 25th.

Regarding stability, I do not face any lagging, crashing, or downtime with Splunk Enterprise Platform. That is a very good thing.

Splunk Enterprise Platform is scalable. I think it should also scale in the pen testing side and the vulnerability assessment side because right now, I am only focused on monitoring logs and alerts. It can scale in fields such as pen tests and vulnerability assessments by doing reports and documentation.

I have not yet contacted the technical support or customer support of Splunk Enterprise Platform, but I only get in touch with my seniors, such as SOC 2s.

I have used something similar to Splunk Enterprise Platform, but I cannot remember its name. It is something similar to ELK.

The initial deployment of Splunk Enterprise Platform is somewhat time-consuming, but it is very easy. If I do it once, then it is not that hard, but it is a time-consuming process.

For the first time, I took around one hour to deploy Splunk Enterprise Platform. One hour was enough for me at that time.

I have a team with my seniors who helped me deploy Splunk Enterprise Platform.

I do not have any idea about the prices of Splunk Enterprise Platform. I think it is free.

I have used something similar to Splunk Enterprise Platform, but I cannot remember its name. It is something similar to ELK.

To maintain granular control over data using the trusted control plane, I deploy Splunk Enterprise Platform on multiple machines and connect through it.

I am just a user of Splunk Enterprise Platform; my company provided it for me. I would rate my overall experience with this product a 9.

Splunk Enterprise Platform serves as our SIEM tool where we receive alerts and we primarily depend on it. As a centralized logging and monitoring system, we use Splunk based upon different data types. We receive data from our EDR solutions, our email, and cloud sources, so Splunk acts as a centralized point where we receive alerts from multiple sources. Day-to-day operations include Windows event loggings, such as when we get brute force alerts and similar kinds of alerts. Another example is with respect to Office 365, which is our messaging logs where if there is a need and any email forwarding rules are detected, we set a set of alerts. We also receive alerts from the cloud, GuardDuty logs, and CloudTrail logs.

Splunk Enterprise Platform is a platform I truly love, whether it's the use cases, how we fine-tune them, how we parse them, or how we create dashboards exclusively in Splunk Enterprise Platform, and even the admin part. The dashboarding functionality provides a single-pane-of-glass view for us where whenever an alert comes or any part of threat hunting that we do, it stands exclusively, and we are able to monitor them at one place. Other features such as RBAC and risk-based alerting mechanisms provide a one-page view for us. With respect to the UI, we get all the details in; it is very user-friendly; we do not need to search here and there; we get it immediately.

Splunk Enterprise Platform has had a significant positive impact on our organization. We had a previous SIEM tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

In my current field, I have been working for about six years.

Splunk Enterprise Platform is stable with no doubt about that.

I rate the scalability of Splunk Enterprise Platform an eight on ten.

I rate the customer support of Splunk Enterprise Platform a nine on ten.

We had a previous SIEM tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

Pricing for Splunk Enterprise Platform is actually very high, but at the same time, the value that it gives is highly beneficial.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

As of integrations, we are good. Splunk Enterprise Platform can be integrated with multiple SOAR solutions, so I would prefer to focus on the threat intelligence side.

Accuracy regarding Splunk Enterprise Platform's AI capabilities should be termed as a normal figure between sixty to seventy-five percent because sometimes it is not just AI capabilities; human intelligence is needed as well. So I would keep it around that range.

With respect to cybersecurity, you have the best solution available. I rate this review a nine overall.

As an analyst, I use Splunk Enterprise Platform for monitoring, investigating, and analyzing and responding to alerts in a 24/7 environment.

In my daily work, we receive alerts in Splunk Enterprise Mission Control where we monitor our alerts. For example, if I receive any malware-related alerts, I will use Splunk and check the logs from different log sources such as host, proxy, and DNS. I check these logs from Splunk, analyze them, and based on that analysis, I write my analysis in Splunk.

For specific use cases, such as the malware example I mentioned, if any malware-related alert is triggered in an environment, I check the logs of the host, identify who the user is, determine what happened, understand what actually occurred in that alert, and identify which file or process that alert was triggered for with the help of Splunk.

Splunk Enterprise Platform features such as risk-based alerting, which is the most important one, and advanced search, search processing language (SPL), along with the new add-on of Splunk AI that is integrated in Splunk Enterprise Platform, leverage analysis and writing Splunk queries. Additionally, the real-time alerting and scalability that Splunk Enterprise Platform provides if you want to scale it to a larger space are impressive.

Regarding risk-based alerting, it adds risk to any identity such as a host, IP address, or user, quantifying how many alerts trigger on that user, and adding a risk score to the particular entity, which I believe is a good feature. For SPL, we use it daily for analyzing logs, and Splunk Enterprise Platform's three modes—verbose, smart, and fast mode—speed up our process or provide detailed insights based on our requirements.

Splunk Enterprise Platform has drastically improved our monitoring capability in a 24/7 environment. I used other tools such as ArcSight, which is not as effective compared to Splunk Enterprise Platform, where everything is in one place, whereas ArcSight requires different tools for logging and monitoring alerts, showcasing Splunk Enterprise Platform's superior scalability.

One improvement for Splunk Enterprise Platform would be to slightly lower the licensing cost, which I believe is quite high. If possible, making SPL queries a bit easier would be beneficial, though the introduction of Splunk AI helps in writing queries automatically. Performance and scaling are also areas to consider.

I have been working in this current field for 2.6 years.

Splunk Enterprise Platform is stable.

Splunk Enterprise Platform offers excellent scalability, perfectly handling data growth and allowing us to scale from gigabytes to petabytes as our business expands.

Customer support is very good. I had one query that was resolved within 24 hours.

I have used ArcSight previously, but I did not switch. Rather, I transitioned to a different project where I began using Splunk Enterprise Platform, and I prefer Splunk Enterprise Platform for its comprehensive features that offer everything in one place.

We have seen a return on investment with Splunk Enterprise Platform, which is expensive but pays for itself through preventing costly downtime and security breaches.

We saved one ransomware alert in our organization.

My experience with Splunk Enterprise Platform's pricing is that it has a high overall cost. Licensing fees require a large budget commitment, and traditional volume-based pricing can become unpredictable and expensive as data grows, alongside the costly setup for building infrastructure requiring specialized staff.

I advise others looking into using Splunk Enterprise Platform to consider its great user interface, comprehensive features, superior scalability compared to other products, and the growing integration of AI into the platform, making it a compelling option over other products. I would rate this product a 10 out of 10.

I was a partner with Splunk for around six years, and later I moved to customer projects. As part of Splunk, I worked as a professional services consultant, and later I began working with multiple customers through a different company as an independent consultant.

Splunk Enterprise Platform is exceptional as a SIEM platform, with the breadth and depth built over the last 20 years. The main benefit is that it serves both core operations and security through Enterprise Security.

My experience maintaining granular control over the trusted control plane within Splunk involves working with numerous log types that can be ingested, whether from custom application events, OS events, access and identity information, or security or EDR events.

Regarding AI usage in RBAC, I have primarily used it for use case management and taking actions once a security notable event is generated.

I have used Splunk Federated Search, which I implemented for one of my customers about a year ago.

In my experience with Federated Search, I will provide some context on why it was introduced. Splunk was pushing more on Splunk Cloud platform, which is one of their SaaS-based offerings.

In terms of scalability, I would rate Splunk Enterprise Platform between nine and ten because all you have to do is add one indexer to the platform. Splunk architects and consultants are involved in that process, but it is quite fast.

One area that has room for improvement is the log onboarding problem with all the AI aspects, which has not yet been solved.

I have been using this solution for around eight years.

My experience with technical support leads me to rate it between six and seven, leaning toward seven, as they have outsourced most of the support, and support in some regions is not excellent.

The deployment model of my clients is a mix, as I have a few customers who ingest between 40 to 50 terabytes a day who are on enterprise, and there are a few clients with around four to five terabytes a day on cloud.

I would say the deployment planning and architecting is medium to hard, but once that is planned, the deployment itself is easy.

In terms of Total Cost of Ownership (TCO), I would say it is consistently net-net positive because Splunk Enterprise Platform is one of the platforms where all the logs of the entire organization are ingested.

Regarding pricing, I find that Splunk is quite expensive, and I have seen customers getting migrated since the last two years.

In comparison with major vendors on the market, I see Splunk Enterprise Platform as still being the market leader, at least in terms of SIEM.

I have a team reporting to me, as I work for a company, serving a bunch of Splunk customers and other SIEM customers.

In my organization, there are around four to five specialists who work with Splunk.

My clients are enterprise and medium to large businesses.

Splunk Enterprise Platform requires regular maintenance, and I find it easy to maintain.

My impression of Splunk's approach to managing governance within private network environments is that it is straightforward.

I suggest conducting a POC first and having one real customer who uses Splunk, because it will not work if you are just installing it locally.

I would rate this solution a nine overall.