RackFoundry Total Security Management (discontinued) vs. Splunk Enterprise

I would not recommend RackFoundry to any company whatsoever. At first it seems like a viable solution for the cost. Offering SOC monitoring, implementation and deployment all-in-one seems like a great deal. However it all falls apart when push comes to shoves. As it currently stands we are just over a year into our deployment. All we have to show for it is a fancy web app that does not display any information. In the year that this deployment has been ongoing it has taken us a few months just to get the virtual appliance installed. Then it was another few months of back and forth until we finally got credentials. Then when I finally logged in we began the process of deploying agents and began collecting data. Shortly afterward things began to stall to where they are now. We faced major issues with the web app, scans were not running, assets were not reporting in and data and reports were not being generated. After doing some more research and googling I realized that we were not alone with these issues. Countless other reports from companies who have had similar issues to ours. Each time I ask when the issues were going to be resolved, I got the same answer every time: "The next release should fix the issues you have been experiencing", only for the next release to come, and the issues remain.

Pros: Splunk is very well suited if you have multiple log sources of related data. All of them can be correlated and tasks can be automated based on the requirement. Other than alerts, Splunk can also run a specific script of your choice, based on some defined conditions. Cons: If you have a few logs but a large number of log sources, Splunk can be very expensive.

Incentivized

• All-in-one solution that covers all the essentials and basic of security needs
• Unique methodology way for cost effective enterprise security solution
• Help exceed compliance as their interface allows you to tailor your compliance needs
• Simple and friendly customizable user interface dashboard
• Unique function: Ask an Expert
• Premium fully manage automatic updates with access
• Deployable Security Modules that encompass IPS/IDS/SIEM/VA/FW
• Knowledgeable engineers, who helped improve our overall infrastructure by making it more secure

• Real-time + Scheduled alerts - i-e you can set up alerts which are actively monitoring your logs
• Pretty good response time for search results. With our key/value logging, Splunk makes it blazing fast to query the data.
• Dashboards provide insights into historical data
• Love how Splunk indexes all of the data and provides keys to search on

Incentivized

• Product they offer does not work.
• Time to implement is unbelievably long.
• Services they offer are so far, non-existent.

• Even though there is a search tool as a help function, you still have to read through many documentation to find the answers you're looking for and sometimes you don't find it. The help function in Splunk could be improved to be more intuitive or have a built-in help per report, panel or dashboard.
• Creating a Splunk dashboard is rather straightforward however, customization is not. Splunk could be improved to provide more tools or features for customization such as adding colors and font options for text and graphs or graphics.
• My dashboard has a lot of useful information and I want the important panels and reports at the top but there is no easy way to do this. Perhaps Splunk could be improved to allow features such as adding URL links to other dashboards or some other clever way to emphasize the important data in my dashboard without compromising space.

Incentivized

We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.

Splunk Enterprise has plenty of storage space for security logs and can search and correlate suspicious activities up to 30+ days back. Splunk Enterprise can integrate with a ticketing system to track threats and correlate with IoC between security events. Splunk Enterprise can provide reports of account lockouts. Splunk Enterprise can consolidate multiple security alerts into one entry with a number showing how many events occurred.

Incentivized

When properly setup and configured, Splunk is extremely reliable.

Incentivized

Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method.

Incentivized

The online course was simple clear and described the main capabilities of the solution. There is also an initial module that can be done for free so anyone can familiarize themselves with the functionality of this solution. On the other hand, however, there could be more free online courses. Maybe even with a certificate, this would broaden the group of people who are familiar with the platform while increasing familiarity with the solution itself.

Smooth without too many major issues.

Incentivized

Well I have experience with the big names: SecureWorks, IBM and Splunk. Individually their logging tools are much better than RackFoundry's Total Security Management. This is great for large corporations and urban cities, however not so great for municipalities, mid size businesses and companies who fluctuate between 1-7 members on their IT staff. Why? Because it takes too much of their resources and integration with other products gets a little rough as you will need to configure your preferences to theirs. When a company has stability it is great to have a name brand product, however renewals and upgrade costs can be taxing to an organization.

A lot of products have natively inside their own dashboards and or their own logging repositories. And each one is difficult to learn or they're too complex or they're not verbose in the sense that they're not easy to mine the data that you're looking for. So that could be anything from the native logging that you find in other Cisco products. It's easier to use Splunk to draw the data that you're looking for as opposed to going to the individual's products themselves to get the logs that you're looking for.

Incentivized

Splunk can scale in to the petabyte per day range which of course is awesome

• Just knowing that we are protected from attacks is our main objective and so far that sense of security is well worth the cost associated with it.

• Splunk has allowed developers to diagnose production issues when access of control was taken away from them to be allowed to view items in production environments and I believe that is invaluable.
• At times some developers weren't super happy about using it, but it was more of the fact that they were used to having production access and not creating their splunk queries to get information.
• Going one place to view logs was very beneficial to have.

Incentivized