Splunk Enterprise

First of all, I have to log in to Splunk Enterprise Platform  with my login credentials provided by the company. Our company is RamnaSoft. Then I monitor the alerts coming in or analyze the logs coming in. I do the initial triage to the alerts. If I get some true positives, then I investigate further, examining IOCs and IOAs. I document it and forward it to my IR team or senior team, which is SOC 2 or SOC Level 3. Also, if I get some false positive alerts while initial triaging, then I update that in documents and also inform the IR team to monitor these false positive alerts to make changes according to their rules and procedures.

Federated Search is helpful, but it needs some basic knowledge of the log codes and query languages. I should know the queries to search on them.

What I like the most about Splunk Enterprise Platform  is that it generates alerts with true positives only. There are fewer false positives, which is good for me. The alerts are good.

I use the Federated Search feature of Splunk Enterprise Platform for particular queries. I enter some queries there, and it responds accordingly.

What I dislike about Splunk Enterprise Platform is that there are so many logs coming in. Sometimes, unwanted logs are present, such as file creations. I do not prefer those logs.

To clarify, if some legitimate users create unnecessary files, it generates a log. Those logs are created, so I find that frustrating. Those logs are not useful to us.

I have been using Splunk Enterprise Platform since last year, January 25th.

Regarding stability, I do not face any lagging, crashing, or downtime with Splunk Enterprise Platform. That is a very good thing.

Splunk Enterprise Platform is scalable. I think it should also scale in the pen testing side and the vulnerability assessment side because right now, I am only focused on monitoring logs and alerts. It can scale in fields such as pen tests and vulnerability assessments by doing reports and documentation.

I have not yet contacted the technical support or customer support of Splunk Enterprise Platform, but I only get in touch with my seniors, such as SOC 2s.

I have used something similar to Splunk Enterprise Platform, but I cannot remember its name. It is something similar to ELK.

The initial deployment of Splunk Enterprise Platform is somewhat time-consuming, but it is very easy. If I do it once, then it is not that hard, but it is a time-consuming process.

For the first time, I took around one hour to deploy Splunk Enterprise Platform. One hour was enough for me at that time.

I have a team with my seniors who helped me deploy Splunk Enterprise Platform.

I do not have any idea about the prices of Splunk Enterprise Platform. I think it is free.

I have used something similar to Splunk Enterprise Platform, but I cannot remember its name. It is something similar to ELK.

To maintain granular control over data using the trusted control plane, I deploy Splunk Enterprise Platform on multiple machines and connect through it.

I am just a user of Splunk Enterprise Platform; my company provided it for me. I would rate my overall experience with this product a 9.

Splunk Enterprise Platform  serves as our SIEM  tool where we receive alerts and we primarily depend on it. As a centralized logging and monitoring system, we use Splunk based upon different data types. We receive data from our EDR solutions, our email, and cloud sources, so Splunk acts as a centralized point where we receive alerts from multiple sources. Day-to-day operations include Windows event loggings, such as when we get brute force alerts and similar kinds of alerts. Another example is with respect to Office 365 , which is our messaging logs where if there is a need and any email forwarding rules are detected, we set a set of alerts. We also receive alerts from the cloud, GuardDuty logs, and CloudTrail  logs.

Splunk Enterprise Platform  is a platform I truly love, whether it's the use cases, how we fine-tune them, how we parse them, or how we create dashboards exclusively in Splunk Enterprise Platform, and even the admin part. The dashboarding functionality provides a single-pane-of-glass view for us where whenever an alert comes or any part of threat hunting that we do, it stands exclusively, and we are able to monitor them at one place. Other features such as RBAC and risk-based alerting mechanisms provide a one-page view for us. With respect to the UI, we get all the details in; it is very user-friendly; we do not need to search here and there; we get it immediately.

Splunk Enterprise Platform has had a significant positive impact on our organization. We had a previous SIEM  tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon  threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

In my current field, I have been working for about six years.

Splunk Enterprise Platform is stable with no doubt about that.

I rate the scalability of Splunk Enterprise Platform an eight on ten.

I rate the customer support of Splunk Enterprise Platform a nine on ten.

We had a previous SIEM tool and migrated to Splunk Enterprise Platform. The storage logs and the storage bucketing system in Splunk Enterprise Platform is extensively large, and the amount of data that is getting parsed is substantial. Splunk Enterprise Platform is the one platform where we use it on a day-to-day basis, not only with respect to the cyber team but all the other data reporting team and data team use it as well.

Pricing for Splunk Enterprise Platform is actually very high, but at the same time, the value that it gives is highly beneficial.

With respect to the use cases, we were able to create many use cases as well as fine-tune them, so thirty percent of the alerts were fine-tuned, and we have improved our detection logic and also the outcomes. In specific to the metrics, our detection rate was high. The mean time to detect was incredibly lower than when compared to the previous SIEM.

With respect to Splunk Enterprise Platform, we can have a bunch of use cases though we already have a database where we get a list of use cases. Given the trend, we can improve them. Just with threat intelligence, if Splunk Enterprise Platform gets a new feature such as IOCs integration directly, that would be very helpful, just as the Falcon  threat intelligence. It would be helpful if we get Splunk threat intelligence as well.

As of integrations, we are good. Splunk Enterprise Platform can be integrated with multiple SOAR  solutions, so I would prefer to focus on the threat intelligence side.

Accuracy regarding Splunk Enterprise Platform's AI capabilities should be termed as a normal figure between sixty to seventy-five percent because sometimes it is not just AI capabilities; human intelligence is needed as well. So I would keep it around that range.

With respect to cybersecurity, you have the best solution available. I rate this review a nine overall.

My main use case for Splunk Enterprise Platform  is for dashboard and alerting.

I have many dashboards depending on the scenarios and specific asks. For example, I have a CPU or memory related dashboard where I can check for any CPU related timeouts or any slowness.

I find myself checking those CPU or memory dashboards for troubleshooting.

Splunk Enterprise Platform  offers real-time monitoring and logs, and it can be used for alerting. It is used to debug issues, and I can use Splunk logs for this purpose.

Out of real-time monitoring, alerting, and debugging, I find myself using debugging and alerting the most because they are essential for my work.

Splunk Enterprise Platform has positively impacted my organization with privacy. It is offering privacy, and when it comes to log management, it is very easy to see what is causing the issue.

While I am writing a Splunk query, I wish it would provide suggestions, such as integrating AI with Splunk logs. Whenever I am using any SPL, I would appreciate if an AI agent could tell me whether this is a valid Splunk query or suggest alternative valid options.

I think Splunk Enterprise Platform can be improved by integrating an AI feature while writing a Splunk query so that it suggests valid Splunk queries to find logs. Splunk can be used in many ways to see dashboards and check for any logs, and when AI is integrated, I think we can do much more.

I have been using Splunk Enterprise Platform for the past five years.

Regarding Splunk Enterprise Platform's AI capabilities, I feel it is protected.

Regarding Splunk Enterprise Platform's AI capabilities, it is providing correct information most of the time.

Splunk Enterprise Platform is used for on-premises applications, including Java and .NET applications that are hosted on a few servers in the data centers. It is used on-premises, and I have already mentioned my use of on-premises data and on-premises applications. Everything is strong apart from the apps which are on Kubernetes  that are not integrated with Kubernetes .

I have a positive attitude toward Splunk Enterprise Platform's capability to manage data sovereignty at a petabyte scale within my environment.

In utilizing Splunk's Federated Search, I expect some improvement whenever I am making changes or creating a new profile. I would like to have a document where I could link to.

It is very easy for any kind of permission when maintaining granular control over data using the trusted control plane within Splunk Enterprise Platform, and I rate it ten out of ten.

I rate this review overall as eight out of ten.

I was a partner with Splunk for around six years, and later I moved to customer projects. As part of Splunk, I worked as a professional services consultant, and later I began working with multiple customers through a different company as an independent consultant.

Splunk Enterprise Platform  is exceptional as a SIEM  platform, with the breadth and depth built over the last 20 years. The main benefit is that it serves both core operations and security through Enterprise Security.

My experience maintaining granular control over the trusted control plane within Splunk involves working with numerous log types that can be ingested, whether from custom application events, OS events, access and identity information, or security or EDR events.

Regarding AI usage in RBAC, I have primarily used it for use case management and taking actions once a security notable event is generated.

I have used Splunk Federated Search, which I implemented for one of my customers about a year ago.

In my experience with Federated Search, I will provide some context on why it was introduced. Splunk was pushing more on Splunk Cloud platform, which is one of their SaaS-based offerings.

In terms of scalability, I would rate Splunk Enterprise Platform  between nine and ten because all you have to do is add one indexer to the platform. Splunk architects and consultants are involved in that process, but it is quite fast.

One area that has room for improvement is the log onboarding problem with all the AI aspects, which has not yet been solved.

I have been using this solution for around eight years.

My experience with technical support leads me to rate it between six and seven, leaning toward seven, as they have outsourced most of the support, and support in some regions is not excellent.

The deployment model of my clients is a mix, as I have a few customers who ingest between 40 to 50 terabytes a day who are on enterprise, and there are a few clients with around four to five terabytes a day on cloud.

I would say the deployment planning and architecting is medium to hard, but once that is planned, the deployment itself is easy.

In terms of Total Cost of Ownership (TCO), I would say it is consistently net-net positive because Splunk Enterprise Platform is one of the platforms where all the logs of the entire organization are ingested.

Regarding pricing, I find that Splunk is quite expensive, and I have seen customers getting migrated since the last two years.

In comparison with major vendors on the market, I see Splunk Enterprise Platform as still being the market leader, at least in terms of SIEM .

I have a team reporting to me, as I work for a company, serving a bunch of Splunk customers and other SIEM customers.

In my organization, there are around four to five specialists who work with Splunk.

My clients are enterprise and medium to large businesses.

Splunk Enterprise Platform requires regular maintenance, and I find it easy to maintain.

My impression of Splunk's approach to managing governance within private network environments is that it is straightforward.

I suggest conducting a POC first and having one real customer who uses Splunk, because it will not work if you are just installing it locally.

I would rate this solution a nine overall.