Splunk Enterprise Security Reviews & Product Details

RBA has been the biggest game-changer for our team. Before using it, our Tier 1 analysts spent hours chasing individual low-fidelity alerts. With RBA, Splunk ES attributes risk scores to users and systems (risk objects) based on cumulative behaviors mapped to MITRE ATT&CK. It only fires a notable event when a high-risk threshold or multi-stage attack pattern is reached. This single shift cut our overall alert noise by over 70%, allowing us to focus on real security threats rather than chasing single-event false positives. Review collected by and hosted on G2.com.

While the Common Information Model (CIM) is essential for unifying security data, properly mapping, configuring, and maintaining CIM compliance for custom or non-standard log sources requires significant time and manual effort. Review collected by and hosted on G2.com.

Splunk provides a very simple user interface, and it’s easy to use for daily BAU activities. I used a different solution before where we had to log in to ESM and the logger separately, but Splunk brings everything together in one place. Review collected by and hosted on G2.com.

The main thing I dislike about Splunk Enterprise Security is how complex it can be to configure and manage, especially for new users. Creating and tuning correlation searches often requires a solid understanding of SPL and the underlying data. It also takes ongoing effort to reduce false positives and to keep dashboards and detections properly maintained as the environment changes. Review collected by and hosted on G2.com.

What I like most about Splunk Enterprise Security is how it centralizes security logs from firewalls, IDS/IPS, endpoints, and other security tools into a single place. This makes it easier to correlate events, spot suspicious traffic patterns, and investigate potential threats more efficiently. For instance, if there are multiple failed connection attempts or unusual traffic patterns, Splunk can help you analyze the related activity, prioritize alerts, and move faster during incident investigation. I also find its dashboards and reporting features helpful for monitoring security trends, cutting down investigation time, and improving coordination between SOC and network security teams. Review collected by and hosted on G2.com.

Splunk Enterprise Security can be complex to configure and fine-tune, especially when handling a large volume of security alerts. Tuning correlation searches, reducing false positives, and creating effective dashboards can require significant time and expertise. Improving the initial setup experience and simplifying rule customization would make daily SOC and network security operations more efficient. Review collected by and hosted on G2.com.

What I like best about Splunk Enterprise Security is its powerful threat detection and investigation capabilities. It provides a centralized view of security events from multiple sources, making it easier to monitor and analyze security incidents. The correlation searches, customizable dashboards, and threat intelligence integrations help reduce investigation time and improve overall security visibility. I also appreciate its scalability and flexibility, which allow it to adapt to different organizational requirements and large volumes of security data. Review collected by and hosted on G2.com.

One aspect I dislike about Splunk Enterprise Security is that it can have a steep learning curve, especially for new users who are not familiar with Splunk's search language and advanced configurations. The platform is highly capable, but setting up and tuning correlation rules can take time and expertise. Additionally, managing large data volumes can become expensive, and some dashboards or searches may require optimization to maintain performance in larger environments. However, once properly configured, the platform delivers strong security monitoring and investigation capabilities. Review collected by and hosted on G2.com.

What I liked most is the visibility it gives once everything is set up. It becomes a solid central place for monitoring and investigations, and correlating logs across systems actually helps catch things faster.

The built-in detection rules and dashboards are a good starting point, and integrations are flexible enough to bring in data from pretty much anywhere. Performance is reliable too, as long as your queries are optimized.

It does take some effort to tune alerts and get real value, but once that’s done, it makes day-to-day security workflows a lot more structured and efficient. Review collected by and hosted on G2.com.

The biggest issue is the complexity. Setup and onboarding take time, and you really need someone experienced to get it running properly. It is not beginner friendly at all.

Pricing can also get expensive fast since it is based on data ingestion, so you have to constantly manage what logs you are sending in.

The UI feels a bit clunky in places, and navigating during investigations is not always smooth. On top of that, alerts need a lot of tuning. Without it, you end up with too much noise, which affects response time.

Overall, its Ai is powerful, but it takes effort, expertise, and budget to actually make it work well. Review collected by and hosted on G2.com.

The best thing about Splunk is the deep visibility it provides across the environment, along with its strong ability to correlate large volumes of security data into true positive, actionable alerts. This really helps make investigations/incident response faster and more efficient. Review collected by and hosted on G2.com.

The initial implementation is complicated and requires significant expertise, time, and resources. In our case, we had to extend the contract to a third party to onboard Splunk ES in our environment. Review collected by and hosted on G2.com.

What I like most about Splunk Enterprise Security is its ability to give clear and comprehensive visibility across the entire environment. The correlation searches, use cases, and dashboards make it easier to identify patterns and prioritize threats. As someone who works in SOC operations and consulting, the flexibility to customize detections and build my own dashboards is a huge advantage and everything feels scalable, structured, and analyst-friendly. Review collected by and hosted on G2.com.

What I dislike about Splunk Enterprise Security is that some of its features can be quite resource intensive. The platform is powerful, but it sometimes requires significant tuning and infrastructure capacity to keep everything running smoothly. Additionally, certain configurations or customizations can take more time than expected. It’s not a major drawback, but it does require proper planning and optimization. Review collected by and hosted on G2.com.

Strong correlation searches and analytics help spot threats quickly, not hours later. Review collected by and hosted on G2.com.

It’s expensive, especially since pricing is based on data ingestion. Costs can climb quickly as your environment grows. Review collected by and hosted on G2.com.

Easy-to-use platform that integrates with different devices Review collected by and hosted on G2.com.

The licensing model based on event consumption and the new owner Review collected by and hosted on G2.com.

✅ Powerful Search and Correlation Capabilities

Splunk Enterprise Security excels at log aggregation, correlation, and threat detection. The Search Processing Language (SPL) allows advanced querying that lets our team pinpoint suspicious activity across multiple systems.

✅ Strong Integration with Multiple Systems

One of the key strengths is its ability to integrate with a wide range of third-party systems - firewalls, endpoint detection tools, identity providers, and cloud environments like AWS, Azure, and GCP. It pulls everything into a central platform, which is critical for visibility.

✅ Splunkbase Ecosystem

The Splunkbase app ecosystem is extensive. We’ve used certified add-ons and community-built integrations for tools like Palo Alto Networks, CrowdStrike, Okta, and Microsoft 365. This dramatically reduces the time required to normalize and enrich logs.

✅ Flexible Dashboards and Alerts

Splunk ES provides customizable dashboards and correlation rules, making it easier to tailor detection mechanisms to our organization's needs. The MITRE ATT&CK integration is also a big plus for mapping threats and to evaluate how our detection coverage maps against possible threats.

✅ Scalability

We’ve scaled Splunk ES from ingesting a few hundred GBs a day to multiple TBs without much performance degradation, though it requires careful planning and tuning. Review collected by and hosted on G2.com.

❌ Learning Curve

The flexibility of SPL is a double-edged sword. New analysts often struggle with query writing and alert customization unless they have a strong background in Splunk or scripting. However, there is now an AI solution which will convert natural language to complex SPL syntax.

❌ Expensive at Scale

Pricing is based on ingest volume, which might be expensive as data grows. Without smart data hygiene practices and archiving, costs can grow easily.

❌ Heavy Resource Requirements

On-premise deployments require significant compute and storage resources. High availability and disaster recovery setups can become complex and costly. However, Splunk Cloud takes care of much of this work if purchased.

❌ Limited Out-of-the-Box Content for Certain Use Cases

Although it comes with prebuilt dashboards and correlation rules, some use cases (like insider threat or advanced cloud threat detection) require additional tuning, enterprise specific knowledge or external tools to be truly effective. Review collected by and hosted on G2.com.