G2

Javier B.

Security Architet

Enterprise (> 1000 emp.)

10/24/2026

"RBA in Splunk ES our Game-Changer for Cutting Alert Noise"

4/5

What do you like best about Splunk Enterprise Security?

RBA has been the biggest game-changer for our team. Before using it, our Tier 1 analysts spent hours chasing individual low-fidelity alerts. With RBA, Splunk ES attributes risk scores to users and systems (risk objects) based on cumulative behaviors mapped to MITRE ATT&CK. It only fires a notable event when a high-risk threshold or multi-stage attack pattern is reached. This single shift cut our overall alert noise by over 70%, allowing us to focus on real security threats rather than chasing single-event false positives. Review collected by and hosted on G2.com.

What do you dislike about Splunk Enterprise Security?

While the Common Information Model (CIM) is essential for unifying security data, properly mapping, configuring, and maintaining CIM compliance for custom or non-standard log sources requires significant time and manual effort. Review collected by and hosted on G2.com.

What problems is Splunk Enterprise Security solving and how is that benefiting you?

We struggled with fragmented log data spread across multiple disconnected tools, and our SOC analysts were drowning in thousands of low-fidelity, isolated alerts daily. This led to high analyst burnout, missed early indicators of compromise, and slow investigation times. Now, using Splunk ES with Risk-Based Alerting (RBA) and centralized incident review, we can aggregate multi-vendor telemetry into a single pane, automatically correlate multi-stage attacker behavior against the MITRE ATT&CK framework, and trigger actionable notable events only when risk thresholds are crossed. Review collected by and hosted on G2.com.