SolarWinds Security Event Manager (SEM) vs. Splunk Enterprise Security

SolarWinds Security Event Manager (SEM)

Splunk Enterprise Security

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
SolarWinds Security Event Manager (SEM)	Score 8.0 out of 10	N/A	SolarWinds LEM is security information and event management (SIEM) software.	N/A
Splunk Enterprise Security	Score 9.6 out of 10	N/A	Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.	N/A

Pricing

SolarWinds Security Event Manager (SEM)

Splunk Enterprise Security

Editions & Modules

No answers on this topic

Offerings

Pricing Offerings
SolarWinds Security Event Manager (SEM)	Splunk Enterprise Security
Free Trial
Yes	No
Free/Freemium Version
No	No
Premium Consulting/Integration Services
No	No

Entry-level Setup Fee

No setup fee

Additional Details

—

More Pricing Information

Community Pulse
	SolarWinds Security Event Manager (SEM)	Splunk Enterprise Security
Considered Both Products	SolarWinds Security Event Manager (SEM) Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) The compare well against the others - the pricing models for all but Splunk (free version) are based on EPS/TB consumed... the problem they pose is guesstimating the price tag per month. SolarWinds Security Event Manager gets around that. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) It came down to price on this one. SolarWinds gave us a great break on it. For the features that we were looking for, SolarWinds is a great value for our dollar. As far as features go, we were looking for some Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) easier to use than Splunk, light linux core Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Not applicable Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) This was the first product we used in this category and we are very happy with it. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Solarwinds Security Event Manager (SEM) is the best solution for price/performance. The solution has an easily understandable architecture and also the solution can be installed easily. The solution is a very stable and fast solution for our company size. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Ease of deployment Good UI Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Fortianalzyer can only do logs from FortiGate so usefulness is limited. Elasticsearch was a lot slower than Solarwinds and the filters were a lot harder to set up and use. The connectors for SEM were far more stable. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Splunk was a pretty good product but the licensing structure needed a lot of work. They changed the structure three times that I am aware and I still had problems understanding LogRhythm had a lot of issues correlating users to IP addresses, the mappings were frequently wrong … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) We found that SolarWinds performed poorly when the Architecture included many large data centers spread across the globe. When evaluating the SolarWinds Security Event Manager (SEM) solution we quickly realized that we needed a distributed architecture with log aggregation to … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) We chose this product because of its integration to SolarWinds Orion. We were Threat Monitor users previously. This product has been a great substitute. Dollars to dollars this product performs fairly well. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) SEM is much better value proposition due to being priced by node and not by size of the event database. It's also much easier to configure that splunk and needs much less infrastructure to run. Out of the box SEM beats splunk on functionality. We looked at many products and … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) I find Tripwire Log Center to be adequate and stable but it lacks the graphics and the unified UI that you can have with SolarWinds products. It is also not as simple to set up and operate. One more advantage that SolarWinds products have is the THWACK forum, a big user base … Incentivized Helpful? KS Kim Schroeder CTO (Chief Technical Officer) Chose SolarWinds Security Event Manager (SEM) SolarWinds Security Event Manager (SEM) is more of a complete, turn key approach to event management. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) It is a bit hard to compare, since Cortex XDR is kind of a different starship, with endpoint protection and such, and not really great for auditing Windows Event Logs. ELK stack on the other hand is free in some of it's editions but seems much similar then Cortex. SolarWinds SEM … Incentivized Helpful? Tim Short Infrastructure Administrator Chose SolarWinds Security Event Manager (SEM) We picked SolarWinds because of the better price point, integration with other SolarWinds products, and the ease of training. Because we were already familiar with the SolarWinds way of doing alerts and reports, it made this product a nice fit for our company and it has great … Incentivized Helpful? Brandon Demko Systems Administrator Chose SolarWinds Security Event Manager (SEM) We had an older version of SolarWinds SEM, however, it was not being utilized. Incentivized Helpful? AR Adam Radics Production Data Systems Superintendent Chose SolarWinds Security Event Manager (SEM) This was recommended to us by a vendor. As we were using other SolarWinds products, we did not analyze many options. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) The first reason is the ease of installation. Unlike competitor, SEM was running and partially deployed within a day. With the defaults already in the SEM, it's super easy to get result quickly, without a consultant. Also, it's not too resource-intensive, and does not … Incentivized Helpful? AG Alex Giralias System Support Engineer Chose SolarWinds Security Event Manager (SEM) SolarWinds SEM was selected because it integrates with VMAN on the Orion platform and allows all monitoring information and alerts to be aggregated in one place. Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) Several clients have moved away from LogRhythm because of cost. SEM offers the best ROI for the function. Its interface is much cleaner then LogRhythm. However, there is a steeper learning curve with SEM. The ease of search and data integrity offered by SEM is definitely a … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) I know the Qradar is not the right SIEM tool to compete with Solarwinds SEM but when we looked from a cost, audit & compliance perspective (which are major for many customers), we knew the log management and compliance with regulation would be achieved with SEM. But no machine … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) SolarWinds provides support so when you have problems you don't need to turn to information bases as you can just get a hold of SolarWinds support. I would say another reason for getting SEM is that it is generally easier to configure and easier to learn than the other … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) I have additionally used Netwrix Auditor, which has some similarity with SolarWinds SEM. I use both hand in hand, but typically use the SEM first since it is easier to manage. With Netwrix custom searches are more complex than customer searches in the SEM. The SEM makes it easy … Incentivized Helpful? Verified User Anonymous Chose SolarWinds Security Event Manager (SEM) We implemented SolarWinds Security Event Manager to replace our Cisco MARS appliance. We found the Cisco MARS appliance cumbersome and difficult to connect to and use, as well as very costly from a support and maintenance perspective. SolarWinds Security Event Manager has more … Incentivized Helpful?	Splunk Enterprise Security Verified User Anonymous Chose Splunk Enterprise Security LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and … Incentivized Helpful? Sam Babbitt System/Network Administrator Chose Splunk Enterprise Security Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once … Incentivized Helpful? JC Joe Contreras Senior Security Specialist Chose Splunk Enterprise Security Splunk is way better. Support is awesome too Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I believe it is definitely a leader in the security space Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now. Incentivized Helpful? Ramu S R Junior Network Administrator Chose Splunk Enterprise Security Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat. Incentivized Helpful? AMJITH LAL S Senior Network Administrator Chose Splunk Enterprise Security FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Incentivized Helpful? Saibal Banerjee Cyber Security Consultant Chose Splunk Enterprise Security Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor Chose Splunk Enterprise Security Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Ernesto J. Meléndez Sr. Security Engineer Chose Splunk Enterprise Security All Splunk products are easy to integrate, and they collaborate in the security of our organization. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security N/A - Have only used Splunk Enterprise Security since coming to Deloitte Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security LogRhythm is a superior SIEM from a purely security/SOC perspective in my opinion. However, Splunk shines if you have an expert behind the wheel or if the organization is quite large - as my experience with LogRhythm indicated it couldn't handle large-size organizations. Incentivized Helpful? ME Matt Esolen Cyber Security Engineer Chose Splunk Enterprise Security Microsoft Defender for Endpoint Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk does not hide its correlation and analytics logic from users as much as other solutions in the same space. While some features are harder to access the underlying information is all accessible and tunable. This gives Splunk an edge over other solutions that lock the … Incentivized Helpful? Shilpi Jain Intermediate Enterprise Support Analyst Chose Splunk Enterprise Security We have both of these instances in our organization. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk enterprise security works great in Splunk Cloud. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk Enterprise Security is superior in the logging aspect and searching. That’s why it was easier to pick switch to Splunk Enterprise Security. Arcsight is however superior in the correlation and stability aspect. It’s very reliable and stable that we sometimes forget that … Incentivized Helpful?

Features

SolarWinds Security Event Manager (SEM)

Splunk Enterprise Security

Security Information and Event Management (SIEM)

Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
	SolarWinds Security Event Manager (SEM) 8.9 Ratings 14% above category average	Splunk Enterprise Security 8.4 Ratings 8% above category average
Centralized event and log data collection	9.00 Ratings	9.30 Ratings
Correlation	8.00 Ratings	8.60 Ratings
Event and log normalization/management	8.00 Ratings	8.50 Ratings
Deployment flexibility	10.00 Ratings	8.30 Ratings
Integration with Identity and Access Management Tools	8.00 Ratings	7.80 Ratings
Custom dashboards and workspaces	9.00 Ratings	9.20 Ratings
Host and network-based intrusion detection	10.00 Ratings	7.90 Ratings
Data integration/API management	00 Ratings	8.40 Ratings
Behavioral analytics and baselining	00 Ratings	7.70 Ratings
Rules-based and algorithmic detection thresholds	00 Ratings	8.50 Ratings
Response orchestration and automation	00 Ratings	7.00 Ratings
Reporting and compliance management	00 Ratings	8.60 Ratings
Incident indexing/searching	00 Ratings	9.20 Ratings

Best Alternatives
	SolarWinds Security Event Manager (SEM)	Splunk Enterprise Security
Small Businesses	LevelBlue USM Anywhere Score 3.8 out of 10	LevelBlue USM Anywhere Score 3.8 out of 10
Medium-sized Companies	Sumo Logic Score 9.4 out of 10	Sumo Logic Score 9.4 out of 10
Enterprises	Sumo Logic Score 9.4 out of 10	Sumo Logic Score 9.4 out of 10
All Alternatives	View all alternatives	View all alternatives

User Ratings
	SolarWinds Security Event Manager (SEM)	Splunk Enterprise Security
Likelihood to Recommend	8.0 (0 ratings)	8.8 (0 ratings)
Likelihood to Renew	7.3 (0 ratings)	9.0 (0 ratings)
Usability	8.0 (0 ratings)	7.5 (0 ratings)
Availability	- (0 ratings)	9.1 (0 ratings)
Performance	- (0 ratings)	8.2 (0 ratings)
Support Rating	7.5 (0 ratings)	6.6 (0 ratings)
In-Person Training	- (0 ratings)	9.1 (0 ratings)
Online Training	- (0 ratings)	8.2 (0 ratings)
Implementation Rating	- (0 ratings)	9.1 (0 ratings)
Configurability	- (0 ratings)	7.3 (0 ratings)
Ease of integration	- (0 ratings)	6.4 (0 ratings)
Product Scalability	- (0 ratings)	9.3 (0 ratings)
Vendor post-sale	- (0 ratings)	8.2 (0 ratings)
Vendor pre-sale	- (0 ratings)	8.2 (0 ratings)

User Testimonials
	SolarWinds Security Event Manager (SEM)	Splunk Enterprise Security
Likelihood to Recommend	Solarwinds SEM is great for generating reports for investigation purposes. Once you set up the connectors you can walk away and the product runs without needing maintenance. It was however pretty difficult to create the reports and alerts when now starting out and it can be very intimidating for new users. Incentivized Verified User Anonymous Read full review	Well-Suited Scenarios: Real-Time Threat Response: ES excels in swiftly detecting and responding to security threats through data correlation. Compliance Management: ES streamlines compliance with detailed logs and reports, ideal for regulated industries. User Behavior Analytics: Effective in monitoring user and entity behavior, particularly for insider threat detection. Large-Scale Environments: Valuable for organizations with diverse data sources and high volumes of data. Incident Investigation: ES aids in post-incident analysis, reconstructing events to understand root causes. Less Appropriate Scenarios: Smaller Organizations: For simpler setups, ES may be complex and costly. Static Environments: In low-risk settings, ES's advanced features may be unnecessary. Limited Resources: Tight budgets or sparse IT resources may hinder effective ES use. Lack of In-House Expertise: Without security experts, optimizing ES can be challenging. Budget Constraints: ES may be cost-prohibitive for budget-conscious organizations, prompting consideration of more affordable alternatives. Incentivized Verified User Anonymous Read full review
Pros	SolarWinds easily provides the much needed visibily into changes in an Active Directory (AD) environment. Email alerting can be configured to alert a team if an account is locked out, disabled by another users, or if users and/or computers accounts are created. SolarWinds allowed a searchable audit feature. Microsoft Windows can be configured to log many different parts of a system, but search those logs can be difficult. SEM allows you to search for specific users or events. Incentivized Adam Morrison Director of IT Engineering Read full review	Its best feature is its user interface, which is easy to navigate and understand. All you need is a little tutorial on how to use the Splunk query language and you're done. Logs can be easily uploaded or shared across multiple platforms and display a highly insightful graphical representations of data using graphs, tables, and many other formats. Incentivized Verified User Anonymous Read full review
Cons	Compared to other SIEMs, there are features that are missing. Machine learning, automatic event correlation, ability to correlate multiple sources together. The UI is clunky, and the New event log analyzer page felt really disjointed from the rest of the product. In my experience, the dashboards were almost unusable. They persisted across login per device, and even then they sometimes would reset and go back to the ''Getting Started'' look. Incentivized Verified User Anonymous Read full review	To identify User Behaviour analysis is lacking component which we get in Splunk UBA. The documentation part is hard to work on because if the new user tries to learn ES then the documentation is not user-friendly. ES must ass more Knowledge objects by default to make security-related aspects more reliable and enhance the details. Incentivized Verified User Anonymous Read full review
Likelihood to Renew	It is pretty likely that we will renew SEM when the time comes up. It is easy to use and maintain so there isn't much of a need to replace this product. It is also a pretty fair price for the capabilities provided by the SEM Incentivized Verified User Anonymous Read full review	We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless. Incentivized Verified User Anonymous Read full review
Usability	It is very good - but you get what you pay for. The intent is not for a Fortune 500 that needs more "heavy lifting" with SolarWinds Security Event Manager & for whom the price tag is not (much of) a consideration. Incentivized Verified User Anonymous Read full review	You definitely need to learn how to use Splunk to get the most of the tool. There are many courses available for free to get up to speed on the usability of the tool but it's not that simple. It will take time to digest all the data and to understand how to query for what you are looking for. Incentivized Verified User Anonymous Read full review
Reliability and Availability	No answers on this topic	I'm not an ES user, but, in my implementation I usually try to prevent all service stops to guarantee High availability to the final customers. Incentivized Giuseppe Cusello GRC Director Read full review
Performance	No answers on this topic	ES requires a very performant infrastructure: if it has it's performant, otherwise not. I had situation with a very performant infrastructure and I didn't notized that it was a distributed architecture, it seemed that there ware few data on my PC, othewise I experienced less performant infrastructures with less performaces. Incentivized Giuseppe Cusello GRC Director Read full review
Support Rating	The quality of support can vary depending on whom you end up speaking with. I was fortunate enough to work with a support representative who was very familiar with the product. He had even authored some of the support documentation on the website. On the flip side, I had two other experiences where I was simply directed to online training material. Incentivized Brandon Demko Systems Administrator Read full review	It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this. Incentivized AE Allan Crittenden Edwards Security Analyst Read full review
In-Person Training	No answers on this topic	I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience. Incentivized Giuseppe Cusello GRC Director Read full review
Online Training	No answers on this topic	It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem. Incentivized Giuseppe Cusello GRC Director Read full review
Implementation Rating	No answers on this topic	It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check. Incentivized Giuseppe Cusello GRC Director Read full review
Alternatives Considered	The compare well against the others - the pricing models for all but Splunk (free version) are based on EPS/TB consumed... the problem they pose is guesstimating the price tag per month. SolarWinds Security Event Manager gets around that. Incentivized Verified User Anonymous Read full review	LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and quite frankly lot faster than Splunk. However, I prefer Splunk because of its better Dashboards and panel customization abilities. Elastic is another amazing tool. It is hard to choose between the two especially because both have different sets of logs on them. I use both. Elastic for internal server logs, Splunk for everything else. Incentivized Verified User Anonymous Read full review
Scalability	No answers on this topic	We have on prem splunk and it’s mostly east to setup, but we have issues keeping data separated between customer splunk deployments while at the same time only having to look at one SIEM to address events in every environment Incentivized Verified User Anonymous Read full review
Return on Investment	It saves a lot of time when we had issues trying to figure out where the user account lockout was coming from. With it being an affordable SIEM, we are able to have the ability to do the actions associated with a SIEM and the advantages of not “breaking the bank account”. Incentivized Verified User Anonymous Read full review	We have a 100% success rate on all our ES implementations due to the amazing documentation and Splunk enablement on the subject. Our Splunk ES business has grown 100% YoY for the last 3 years. In terms of long term management and maintenance, ES has been highly stable and predictable, reducing our overhead on costly services team for ad hoc maintenance work. Verified User Anonymous Read full review
ScreenShots	SolarWinds Security Event Manager (SEM) Screenshots