Palo Alto Networks WildFire vs. Splunk User Behavior Analytics

Depending on the environment being implemented in I'd recommend it for compliance purposes as well as managing it from a Network Engineer perspective. From my experience, firmware updates, patching and hardware integration have generally been smooth. Truth be told, cloud based firewall and networking compliance are becoming more and more mainstream and WildFire has a solid foundation.

Incentivized

Splunk is well suited for applications with large amounts of data, and large enterprise applications. Especially if the application has interconnected modules, it helps us to analyze and monitor the application greatly.

Incentivized

• Quick definition downloads and updates. Version 7.1 can do one every 5 minutes. Zero day protection within 5 minutes is a huge plus.
• Quick manual or automatic examination of files. Palo Alto's wildfire site supports API uploads or manual uploads that provide more detailed information than a Virustotal, for example.

Incentivized

• Monitor and troubleshoot for any system errors.
• Get the insights on application data sets and do some predictive analysis.

Incentivized

• The main pain is that we have to purchase the WildFire Licence separately. I think it should be by default available in Palo Alto Firewall.
• Sometimes it takes much time to analyse the file.
• It provides result after attack is happened.

• Performance-wise, it can be improved. Queries take a long time.
• Dataset exploration - More data visualization charts can be added.

Incentivized

It works very well and takes care of protecting us from threats new and well-known. It's been a game changer in terms of threat detection & prevention.

Incentivized

It is a great product that has definitely improved our security posture, however it does require quite a bit of training and time spent customizing for the environment. We had several difficulties in deployment but Palo Alto support was able to help us work through the problems that we were not able to figure out on our own.

Incentivized

PAN support is very good. You can get the reasonable and timely support on any conditions. When the product is already integrated with the PAN firewalls, you can choose the severity levels based on the effect. The customer service/TAC is very helpful, they even have additional recommendations of advises for product usability. Local partners are also assisting the cases and give their expertise.

Incentivized

We tested Fortinet's products before settling on Palo Alto Networks WildFire. Most of our sites were already deployed with Palo Alto Firewalls, which made the decision easy, however we also based that on Palo Alto's superior ratings by other security firms. Fortinet also has a solid product portfolio but Palo Alto Networks WildFire turned out to be the best choice for our organization.

Incentivized

Easier we were using Splunk Enterprise on heavy forwarder on which all the add-on were installed and were using Splunk Cloud with respect to search head and indexers stack. And with Splunk Enterprise Security premium app, we were relying on correlation rules which were throwing more number of false positive but after implementing Splunk UBA, we are now getting real-time true positive threat or incidents.

Incentivized

• Our ability to report third-party combat infiltration testing is enhanced by other customers' threat signatures.
• The additional high-end security equipment demonstrates strong attention to sensitive data we handle and address IT security vulnerabilities.
• Enhanced network visibility and unknown file analysis assist detect malware that lacks a current signature.

Incentivized

• Fewer team members to work on real threats.
• Less time required to deal with real incidents.
• Easy to implement across the network.

Incentivized