Our Outcomes from Using Splunk ES
Use Cases and Deployment Scope
We use it to monitor and correlate data across more than 20 client environments, each with different infrastructures and compliance needs. The main challenge it addresses is visibility. Previously, our SOC relied on separate SIEM tools for certain customers, which meant fragmented investigations and duplicated alerts. Now Splunk ES centralizes all that.
Pros
- Instead of reviewing thousands of low level alerts, I can prioritize risks based on the entity's risk score on the risk based alerts dashboard
- The adaptive response framework allows me to link alerts directly to our SOAR playbooks in phantom. This way I can automate triage steps that traditionally took hours.
Cons
- Creating complex custom correlation searches sometimes feels more complicated than it should. You need deep SPL experience to build anything beyond basic logic.
Return on Investment
- By consolidating 3 legacy SIEM tools into Splunk ES, we reduced licensing and infrastructure costs by about 30 percent annually.
- We are able to have retention rates much higher than the industry average, since Splunk is ridiculously reliable
Usability
Alternatives Considered
Microsoft Sentinel
Other Software Used
F5 BIG-IP Advanced Firewall Manager (AFM)
