Splunk Enterprise Security vs. Splunk SOAR

Splunk Enterprise Security

Splunk SOAR

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
Splunk Enterprise Security	Score 9.6 out of 10	N/A	Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.	N/A
Splunk SOAR	Score 9.0 out of 10	N/A	Splunk now offers a security orchestration, automation, and response (SOAR) platform via its acquisition of Phantom. Splunk Security Orchestration and Automation (Splunk SOAR) provides playbook automation and is available as a standalone solution.	N/A

Pricing

Splunk Enterprise Security

Splunk SOAR

Editions & Modules

No answers on this topic

Offerings

Pricing Offerings
Splunk Enterprise Security	Splunk SOAR
Free Trial
No	No
Free/Freemium Version
No	No
Premium Consulting/Integration Services
No	No

Entry-level Setup Fee

No setup fee

Additional Details

—

More Pricing Information

Community Pulse
	Splunk Enterprise Security	Splunk SOAR
Considered Both Products	Splunk Enterprise Security Verified User Anonymous Chose Splunk Enterprise Security LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and … Incentivized Helpful? Sam Babbitt System/Network Administrator Chose Splunk Enterprise Security Imperva Web Application Firewall (WAF), Juniper Mist Edge, Wazuh Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I did not choose this product. Overall although I like ES, I think Sentinel in certain ways is the superior product. The Kusto Query language is a lot easier to use. For instance anything that requires manual parsing in query can be more difficult with this product. Also some … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk Enterprise Security (ES) is much faster and easier to integrate logs and work on alerts to detect suspicious security events. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security AlienVault is much more user and beginner friendly, however Splunk ES very much so provides more capability for mass data manipulation, report and dashboard customization, and trend analytics. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security These two really helps in better way and low cost and high productivity. Automatic detection ML help you to detect many ways and create cases based on risk score GRS UBA helps to protect organization from data ,via sharing through emails and USB s . Gurucu product license once … Incentivized Helpful? JC Joe Contreras Senior Security Specialist Chose Splunk Enterprise Security Splunk is way better. Support is awesome too Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I believe it is definitely a leader in the security space Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security I consider Splunk Enterprise Security to have the strongest deployment methodology and troubleshoot features. Other products also provide good solutions such as Riverbed, Broadcom and Solarwinds but I think Splunk Enterprise Security is a great and trustable option to use for … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Even though Splunk ES is not the cheapest solution on the markt, we found it was still cheaper compared to Secureworks we had before. Also the level of flexibility and "thinking with the customer" is much better now. Incentivized Helpful? Ramu S R Junior Network Administrator Chose Splunk Enterprise Security Traditional hardware logging mechanisms do not provide in-depth research data on the threats and signatures, while Splunk Enterprise Security could easily achieve this feat. Incentivized Helpful? AMJITH LAL S Senior Network Administrator Chose Splunk Enterprise Security FortiAnalzer is a hardware solution, but with Splunk, we could identify as well get the correct solution for the active threats and too with accurate and precise detailing. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Incentivized Helpful? Saibal Banerjee Cyber Security Consultant Chose Splunk Enterprise Security Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor Chose Splunk Enterprise Security Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Ernesto J. Meléndez Sr. Security Engineer Chose Splunk Enterprise Security All Splunk products are easy to integrate, and they collaborate in the security of our organization. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security N/A - Have only used Splunk Enterprise Security since coming to Deloitte Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security LogRhythm is a superior SIEM from a purely security/SOC perspective in my opinion. However, Splunk shines if you have an expert behind the wheel or if the organization is quite large - as my experience with LogRhythm indicated it couldn't handle large-size organizations. Incentivized Helpful? ME Matt Esolen Cyber Security Engineer Chose Splunk Enterprise Security Microsoft Defender for Endpoint Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk does not hide its correlation and analytics logic from users as much as other solutions in the same space. While some features are harder to access the underlying information is all accessible and tunable. This gives Splunk an edge over other solutions that lock the … Incentivized Helpful? Shilpi Jain Intermediate Enterprise Support Analyst Chose Splunk Enterprise Security We have both of these instances in our organization. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk enterprise security works great in Splunk Cloud. Incentivized Helpful? Verified User Anonymous Chose Splunk Enterprise Security Splunk Enterprise Security is superior in the logging aspect and searching. That’s why it was easier to pick switch to Splunk Enterprise Security. Arcsight is however superior in the correlation and stability aspect. It’s very reliable and stable that we sometimes forget that … Incentivized Helpful?	Splunk SOAR Verified User Anonymous Chose Splunk SOAR Splunk SOAR is one of the more easier to use SOAR products because it gives you the ability to basically write a python script directly as a playbook rather than having to have logic steps built for each decision and only run one thing at a time. I have had previous SOAR … Incentivized Helpful? Verified User Anonymous Chose Splunk SOAR Writing custom code is the only other tool I've used and done. Not sure what other tool similar to SOAR is out there. Incentivized Helpful? Verified User Anonymous Chose Splunk SOAR Splunk SOAR is one of the more easier to use SOAR products because it gives you the ability to basically write a python script directly as a playbook rather than having to have logic steps built for each decision and only run one thing at a time. I have had previous SOAR … Incentivized Helpful? Muhammed Ali CETİN senior Security Engineer Chose Splunk SOAR If you use Splunk SIEM, you might wanna use Splunk soar, too. one vendor for SIEM and SOAR, and you do not need to think about integration, etc. Easy to use if we compare to other SOARs, chat and war rooms are great, and almost every action that we need is already created in … Incentivized Helpful? Pavan sreevatsav Akula Cybersecurity Analyst Chose Splunk SOAR Simple to utilize GUI, you'll have with you possess add-ons, Numerous integrations in existing arrangements and tools. It could be an extraordinary organizational tool that can be utilized for any kind of coordination, not as it were security. Incentivized Helpful? Giuseppe Cusello GRC Director Chose Splunk SOAR We are a Splunk Partner and I know Splunk Phantom, for this reason we usually propose it, but I don't deeply know other competitor products. Incentivized Helpful? Verified User Anonymous Chose Splunk SOAR Splunk Phantom integrates well with Splunk ES and has many integrations. One thing that I liked about XSOAR as compared to Phantom is that it has an "app-store" where you can download not only app integrations (similar to Phantom) but Playbooks and dashboards as well. Incentivized Helpful? JP Julie Pierce SOC Engineer Chose Splunk SOAR Splunk SOAR has multi vendor friendly design that suits our MSP model. Qradar on the other hand has deployment complexity and dependency on IBM's Qradar, which is less appealing for us since our clients run everything from Sentinel to elastic Incentivized Helpful?

Features

Splunk Enterprise Security

Splunk SOAR

Security Information and Event Management (SIEM)

Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
	Splunk Enterprise Security 8.4 Ratings 8% above category average	Splunk SOAR - Ratings
Centralized event and log data collection	9.30 Ratings	00 Ratings
Correlation	8.60 Ratings	00 Ratings
Event and log normalization/management	8.50 Ratings	00 Ratings
Deployment flexibility	8.30 Ratings	00 Ratings
Integration with Identity and Access Management Tools	7.80 Ratings	00 Ratings
Custom dashboards and workspaces	9.20 Ratings	00 Ratings
Host and network-based intrusion detection	7.90 Ratings	00 Ratings
Data integration/API management	8.40 Ratings	00 Ratings
Behavioral analytics and baselining	7.70 Ratings	00 Ratings
Rules-based and algorithmic detection thresholds	8.50 Ratings	00 Ratings
Response orchestration and automation	7.00 Ratings	00 Ratings
Reporting and compliance management	8.60 Ratings	00 Ratings
Incident indexing/searching	9.20 Ratings	00 Ratings

Best Alternatives
	Splunk Enterprise Security	Splunk SOAR
Small Businesses	LevelBlue USM Anywhere Score 3.7 out of 10	No answers on this topic
Medium-sized Companies	Sumo Logic Score 9.4 out of 10	LogRhythm NextGen SIEM Platform Score 7.6 out of 10
Enterprises	Sumo Logic Score 9.4 out of 10	Palo Alto Networks Cortex XSOAR Score 7.1 out of 10
All Alternatives	View all alternatives	View all alternatives

User Ratings
	Splunk Enterprise Security	Splunk SOAR
Likelihood to Recommend	8.9 (0 ratings)	8.1 (0 ratings)
Likelihood to Renew	9.0 (0 ratings)	7.5 (0 ratings)
Usability	7.5 (0 ratings)	8.2 (0 ratings)
Availability	9.1 (0 ratings)	- (0 ratings)
Performance	8.2 (0 ratings)	8.2 (0 ratings)
Support Rating	6.6 (0 ratings)	8.2 (0 ratings)
In-Person Training	9.1 (0 ratings)	- (0 ratings)
Online Training	8.2 (0 ratings)	8.2 (0 ratings)
Implementation Rating	9.1 (0 ratings)	8.2 (0 ratings)
Configurability	7.3 (0 ratings)	8.2 (0 ratings)
Ease of integration	6.4 (0 ratings)	- (0 ratings)
Product Scalability	9.3 (0 ratings)	8.2 (0 ratings)
Vendor post-sale	8.2 (0 ratings)	- (0 ratings)
Vendor pre-sale	8.2 (0 ratings)	- (0 ratings)

User Testimonials
	Splunk Enterprise Security	Splunk SOAR
Likelihood to Recommend	Well-Suited Scenarios: Real-Time Threat Response: ES excels in swiftly detecting and responding to security threats through data correlation. Compliance Management: ES streamlines compliance with detailed logs and reports, ideal for regulated industries. User Behavior Analytics: Effective in monitoring user and entity behavior, particularly for insider threat detection. Large-Scale Environments: Valuable for organizations with diverse data sources and high volumes of data. Incident Investigation: ES aids in post-incident analysis, reconstructing events to understand root causes. Less Appropriate Scenarios: Smaller Organizations: For simpler setups, ES may be complex and costly. Static Environments: In low-risk settings, ES's advanced features may be unnecessary. Limited Resources: Tight budgets or sparse IT resources may hinder effective ES use. Lack of In-House Expertise: Without security experts, optimizing ES can be challenging. Budget Constraints: ES may be cost-prohibitive for budget-conscious organizations, prompting consideration of more affordable alternatives. Incentivized Verified User Anonymous Read full review	Our company has very complex and dynamic security operations because of the large number of security tools and systems that we need to manage and coordinate. Moreover, it helps us to meet many regulatory and compliance requirements because it helps us to automate and document our security operations. We also use it to streamline our security operations and improve our response to potential threats. Incentivized PK Priya Kumar Security Engineer Read full review
Pros	Its best feature is its user interface, which is easy to navigate and understand. All you need is a little tutorial on how to use the Splunk query language and you're done. Logs can be easily uploaded or shared across multiple platforms and display a highly insightful graphical representations of data using graphs, tables, and many other formats. Incentivized Verified User Anonymous Read full review	Its security orchestration and integration capability that supports multiple tools. Easy coding that automates our security actions. Enables us to easily collaborate and respond to security issues faster. Splunk SOAR is a flexible product that is easy to deploy. Efficient tracking and monitoring capability. Excellent real-time reporting functionality. Incentivized Angelica Cavalli Senior Software Engineer Read full review
Cons	To identify User Behaviour analysis is lacking component which we get in Splunk UBA. The documentation part is hard to work on because if the new user tries to learn ES then the documentation is not user-friendly. ES must ass more Knowledge objects by default to make security-related aspects more reliable and enhance the details. Incentivized Verified User Anonymous Read full review	A lack of instruction It can be difficult to contact the support staff. Limited experience from current users. It takes some effort to set up and learn new technology at first. More assistance is required from the support staff. The product's price needs to go down. Cost of the larger version. Incentivized Pavan sreevatsav Akula Cybersecurity Analyst Read full review
Likelihood to Renew	We are very happy with Splunk and would advise anyone to take a serious look at it. It might look pricey but the rewards Splunk offers seem endless. Incentivized Verified User Anonymous Read full review	As we already have a lot of clients being catered with Splunk SOAR and because Splunk SOAR is robust and efficient, we are already using it, and we have understood the product to a certain extent, I feel we are personally more enticed to use and scale it to a lot of business. Incentivized Gaurav S Senior Security Specialist Read full review
Usability	You definitely need to learn how to use Splunk to get the most of the tool. There are many courses available for free to get up to speed on the usability of the tool but it's not that simple. It will take time to digest all the data and to understand how to query for what you are looking for. Incentivized Verified User Anonymous Read full review	Building playbooks through the visual editor is fine for basic tasks, but once you start chaining complex logic or integrating 3rd party APIs you hit a wall that requires deep scripting knowledge. Incentivized JP Julie Pierce SOC Engineer Read full review
Reliability and Availability	I'm not an ES user, but, in my implementation I usually try to prevent all service stops to guarantee High availability to the final customers. Incentivized Giuseppe Cusello GRC Director Read full review	No answers on this topic
Performance	ES requires a very performant infrastructure: if it has it's performant, otherwise not. I had situation with a very performant infrastructure and I didn't notized that it was a distributed architecture, it seemed that there ware few data on my PC, othewise I experienced less performant infrastructures with less performaces. Incentivized Giuseppe Cusello GRC Director Read full review	It has APIs that are useful for integration with third party solutions as well as for absorbing large volumes of data from our servers, networks and apps. Splunk SOAR offers a variety of playbooks that we use in automating workflows for migrating data and for analyzing the data to ensure its security. Incentivized Verified User Anonymous Read full review
Support Rating	It's good when it's responsive, but I've had times where I had to wait quite a while for a response. But these are typically the exceptions rather than the rule. When you do get a response it is always well-informed and appropriate. I would say they've been trending better over time with this. Incentivized AE Allan Crittenden Edwards Security Analyst Read full review	Splunk Support is always great! In addition the Community is very efficient and active. Incentivized Giuseppe Cusello GRC Director Read full review
In-Person Training	I experienced only on-line training, but the trainers were very professional and competent. Maybe it could be more useful if they also have an experience in projects because sometimes they didn't have a real project experience to communicate to the students. Anyway, it was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself, aven if I have more than 10 years of Splunk activity experience. Incentivized Giuseppe Cusello GRC Director Read full review	I never followed an in-person training, I gave my evaluation based on the online training Incentivized Giuseppe Cusello GRC Director Read full review
Online Training	It was very interesting and I learned many thing that's very difficoult (or maybe impossible!) to have by myself. The only problem was that, when I worked with the Splunk Professional Services, I found some difference between the training contents and the information from PS. In addition is required a long experience on Splunk Enterprise for the data ingestion part, in other words I'm able to work with ES because I'm worling on Splunk since 11 years, otherwise I'd some problem. Incentivized Giuseppe Cusello GRC Director Read full review	I followed training for Phantom admins and it opened a world for me Incentivized Giuseppe Cusello GRC Director Read full review
Implementation Rating	It's a fantatic product and it was very useful the presence of Splunk Professional Services for the Design Phase and the final Health Check. Incentivized Giuseppe Cusello GRC Director Read full review	I already said that the main key insight is the knowledge of Phantom, so a detailed training for all the people involeved. Incentivized Giuseppe Cusello GRC Director Read full review
Alternatives Considered	LogRhythm is good for a team comprising mostly non-technical IT users. Unlike Splunk, it has a GUI log search and a good ticketing system. Splunk is better than Logrhythm for me as it provides me with the ultimate flexibility to write custom queries. Scalyr is a good tool and quite frankly lot faster than Splunk. However, I prefer Splunk because of its better Dashboards and panel customization abilities. Elastic is another amazing tool. It is hard to choose between the two especially because both have different sets of logs on them. I use both. Elastic for internal server logs, Splunk for everything else. Incentivized Verified User Anonymous Read full review	If you use Splunk SIEM, you might wanna use Splunk soar, too. one vendor for SIEM and SOAR, and you do not need to think about integration, etc. Easy to use if we compare to other SOARs, chat and war rooms are great, and almost every action that we need is already created in Splunk SOAR. Incentivized Muhammed Ali CETİN senior Security Engineer Read full review
Scalability	We have on prem splunk and it’s mostly east to setup, but we have issues keeping data separated between customer splunk deployments while at the same time only having to look at one SIEM to address events in every environment Incentivized Verified User Anonymous Read full review	me and the customers I encountered found it flexible and scalable Incentivized Giuseppe Cusello GRC Director Read full review
Return on Investment	We have a 100% success rate on all our ES implementations due to the amazing documentation and Splunk enablement on the subject. Our Splunk ES business has grown 100% YoY for the last 3 years. In terms of long term management and maintenance, ES has been highly stable and predictable, reducing our overhead on costly services team for ad hoc maintenance work. Verified User Anonymous Read full review	The playbooks are valuable. They are the core component. Being able to implement and build a code process to work through and scale out what we want to do is valuable Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task Incentivized Verified User Anonymous Read full review
ScreenShots