Splunk Enterprise Security

We use it to monitor and correlate data across more than 20 client environments, each with different infrastructures and compliance needs. The main challenge it addresses is visibility. Previously, our SOC relied on separate SIEM tools for certain customers, which meant fragmented investigations and duplicated alerts. Now Splunk ES centralizes all that.

• By consolidating 3 legacy SIEM tools into Splunk ES, we reduced licensing and infrastructure costs by about 30 percent annually.
• We are able to have retention rates much higher than the industry average, since Splunk is ridiculously reliable

Microsoft Sentinel

F5 BIG-IP Advanced Firewall Manager (AFM)

Our analysts use ES to gain a broad perspective on all the security events coming in from our customer devices. We have multiple internal customers with different environments, so it’s useful having a central place in each SIEM to find events. ES is vital to our business as it allows us to use risk based alerting, which decreases the amount of alerts our analysts have to review each day. We’re able to easily tune these rules to filter out false positives and noisy notables to ensure our analysts have an easy time identifying real threats in a timely manner.

• Mean time to detection
• Mean time to response
• Communication with higher management
• Alert fatigue reduction

Splunk User Behavior Analytics (UBA)

IBM Security QRadar SIEM, ExtraHop Reveal(x)

I was evaluating Splunk for a potential client. Splunk is a great tool for anyone that needs a SIEM to monitor data, networks, users, etc. The customization of the Dashboard is ideal for anyone to setup and use for an easy display of information. The alerts are incredibly helpful for notification of any problems

• Faster MTTR
• Training ended up being costly, but over projected to be high ROI over time
• Dashboards provide better context for our executives

It's easy to build queries & integrate with other systems and applications. There are a lot of add ons you can integrate to Splunk that can save you a lot of time. Correlation and investigation are easy due to Splunk's effective data parsing capability. There are endless options to customize searching. It provides a very accurate Data Analytics platform that can be adopted by users of all levels. E.x. From tools like Data Tables for Novices to Splunk's Web Framework for Experts.

• It saves a lot of time searching through millions of records.
• Our API response becomes faster due to the fast searching of the data.

GitKraken, GitHub, WotNot

I am a security analyst and so I use it on a day to day basis to triage and troubleshoot alerts and security incidents in my organization. We have several dozen data sources going to our Splunk environment and then we build correlation alerts for them

• Faster incident response time
• Compliance
• Audits
• Executive dashboards

Active Roles from One Identity and Amazon S3 (Simple Storage Service)

Microsoft Defender for Cloud, Qualys Cloud Platform, Digital Guardian