Nikitha C.
NC
Senior Security Engineer
Enterprise (> 1000 emp.)
"Centralized Log Visibility and Powerful Dashboards for Faster Threat Investigation"
5/5
What do you like best about Splunk Enterprise Security?

What I like most about Splunk Enterprise Security is how it centralizes security logs from firewalls, IDS/IPS, endpoints, and other security tools into a single place. This makes it easier to correlate events, spot suspicious traffic patterns, and investigate potential threats more efficiently. For instance, if there are multiple failed connection attempts or unusual traffic patterns, Splunk can help you analyze the related activity, prioritize alerts, and move faster during incident investigation. I also find its dashboards and reporting features helpful for monitoring security trends, cutting down investigation time, and improving coordination between SOC and network security teams. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

Splunk Enterprise Security can be complex to configure and fine-tune, especially when handling a large volume of security alerts. Tuning correlation searches, reducing false positives, and creating effective dashboards can require significant time and expertise. Improving the initial setup experience and simplifying rule customization would make daily SOC and network security operations more efficient. Review collected by and hosted on G2.com.

See what 225 reviewers think of Splunk Enterprise Security

4.3 out of 5 · Verified reviews from real users

Read all reviews