Splunk Enterprise

Avantages

J’ai pu me servir de Splunk lors d’une mission chez un client. Nous étions face a un problème : beaucoup de datas sur nos serveurs de productions et des difficultés pour les récupérer quotidiennement et les analyser. Après une formation sur Splunk et quelques heures de travail nous avions notre premier Dashboard remontant beaucoup de données de nos serveurs de productions. Le plus intéressant était de voir en réel nos pannes serveurs. Grâce à Splunk la mission était plus facile.

Inconvénients

Dès qu’il fallait aller vers un cas complexe de récupération de données croisées avec d’autres états de serveur, il fallait alors être plus compétent en programmation. Ça a bloqué certains membres de l’équipe car il leur fallait d’autres formations pour suivre.

Avantages

Capable de bâtir des tableau de bord très personnalisé et devient un outil d'analyse très puissant. On peut monitorer facilement nos équipements

Inconvénients

Pour bien profiter de Splunk, on doit connaitre beaucoup de fonction.
Peu efficace pour un débutant

Avantages

Le logiciel splunk entreprise est très bon pour la gestion de l'intelligence aux entreprises.

Inconvénients

Ce logiciel splunk entreprise a un rapport prix accessibles que j'ai pas grand chose à souligner

Avantages

Afin d'analyser les données personnalisables permettant d'enquêter, dd surveiller et d'agir en temps réel, ce logiciel est très important. Il répond également aux éventuels problèmes informatiques.

Inconvénients

C'est un outil gestionnaire qui est sans inconvénient.

Avantages

Le splunk enterprise est tres bon pour les analyses des produits.

Inconvénients

Il a un rapport prix acceptable que j'ai pas imaginé

Avantages

C'est un très bon logiciel en matière de sécurité , ses gens là ne rigole pas du tout. Grâce à ce logiciel , je peux maintenant mettre en ligne facilement mes données, même celles qui sont sensibles

Inconvénients

Je n'ai retenu que du positif avec ce logiciel. Il est juste Wow

Avantages

Logiciel de qualité acceptée et recommandé à l'utilisateur pour la visualisation des données et assure la sécurité informatique.

Inconvénients

Je n'ai pas d'inconvénients à soulever à ce logiciel. Je recommande ça à l'utilisateur.

Avantages

C'est un bon logiciel de formation très facile

Inconvénients

Je n'ai pas grand chose à reprocher. C'est très bon.

Avantages

C'est un logiciel très fiable et très pratique pour l'utilisation

Inconvénients

Pour moi, il est sans faille, je le recommande

Avantages

Nous a permis de faire des dashboards sur le suivi des patching de nos VM sur le Cloud et de l'installation de Crowdstrike. Mais aussi de traquer l'utilisation du NTLM V1 pour le désactiver sur nos serveurs

Inconvénients

Les query sont un peu long et prennent un peu de temps à etre apprise

Avantages

- Easy to triage and monitor alert (Very fast and gives effective results as compared to other produts)Arcsight,Devo etc- Customer Support is excellent- Threat Hunting can be done effectively with the help of Splunk(IOC based,Corellation based etc)- Log parising is very effective & intelligent.

Inconvénients

- The only think i liked least about splunk is the cost involved/pricing model in case of high data volumes.

Avantages

Splunk is a great platform widely used for log collecting and management but also for implementing some security tools necessary for hardening the cyber security of your company.The main feature I liked is the log collecting that can collect from virtually any IT device and can correlate events for rendering easy the investigating during some security event.

Inconvénients

Splunk is a great log management and security platform the ony think I did'nt like is the price compared to others. However it has so many features that the price is right.

Alternatives envisagées 

Dynatrace

Pourquoi passer à Splunk Enterprise

Splunk is a complete product and was great for ud.

Avantages

I love how detailed you can have the dasboards and charts go. It supports tons of chart types, and custom reporting elements. But above all, with the automaetd monitoring, you can have access to continuous insights from large data you wouldn't have been able to make sense of otherwise.

Inconvénients

It's quite difficult to set up in the beginning. It took us a lot longer than expected to map our production data onto the system. But once you have it up and running, it works like clockwork

Alternatives envisagées 

AppDynamics et Mezmo

Pourquoi passer à Splunk Enterprise

We had a bit of prior experience with Splunk Enterprise which made everything much easier. It also seemed like the superior option for manufacturing on technical documentation.

Avantages

Powerful search language
Advanced visualisation
Flexibility to accept logs from any source
High availability
Ease of administration

Inconvénients

The cost is too high compared to other log monitoring tools.

Alternatives envisagées 

DatadogOpens in a new tab

Pourquoi passer à Splunk Enterprise

Datadog is lacking features and is bot a specialised log monitoring tool

Avantages

Splunk is really user-friendly and helpful service for SOC operations.
Dashboard is very good and easy to use.
Remediate threats and provides SOAR for it.

Inconvénients

It is quite difficult to set up in the beginning.
It took us a lot longer time to load our data into the system.

Avantages

Search capabilities
Logging and alerting

Inconvénients

User interface
Access issues
Dashboard capabilities

Avantages

It so easy to use and it is very smart and fast.

Inconvénients

They want to take it to the cloud, maybe is good maybe not

Avantages

The visualization based on the metrics is great

Inconvénients

Cant think of any cons that i want to write

Avantages

The easy of setup and integration makes this one of my favorites As well as the real time dashboard

Inconvénients

Not much i don't like yet, but maybe the interface can do with an update

Avantages

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning
- No development work required to deploy and provide value.
- Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair.
- Segmentation of logs: You can create separate instances of of logs to aggregate, based on organization needs. And those instances can have their own individual storage policies to optimize consumption of storage resources.
- Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage.
-POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs.
- Customization: You can create your own queries of logs, and event-based alerts.
- Web-based GUI that clean is powerful
- Sales/Technical Reps are top notch in fielding questions and evaluating environment for deployment. They were extremely helpful in helping our organization develop procedures and scaling our environment for expansion with our existing infrastructure.

Inconvénients

- Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization.
- Watch your saved queries and hardware resources: Users have the ability to create and save queries. Like in database queries, some are more efficient than others. Large inefficient queries can be very resource-intensive. If you notice slowness in day-to-day queries, or navigation in the UI, or resource use in contention, keep an eye on saved queries and user practices.

Avantages

Splunk comes with lot of in-built templates for each and every feature like log visualisation, dashboarding, traces,etc This makes the developers life lot easier. I can't think of any other logging tool that is snappy as well as accurate.
I love the fact how easily I can plug it in my docker-compose to push container logs.

Inconvénients

Even though, it offers numerous features for different needs, each feature has its own learning curve. For instance log visualisation needs querying skills, which may be in natural language but it takes bit of time to get familiar.

Avantages

The simplified user interface which presents logs in a readable format. Also it's ability to quickly identify integration issues

Inconvénients

A mechanism to hide system generated logs that are unimportant would be great

Avantages

Splunk offers various features whether you need to setup monitoring on your server, application logs based on logs ingestion set alerts so that teams got notified on real time and take actions accordingly. In this way, it helps to monitor application which are mission critical. You can make dashboards in Splunk where you can configure various components such indexes, data inputs and schedule reports as well. To achieve additional functionalities we can install third party apps as well such as AWS Add on for cloud watch log ingestion.

Inconvénients

From Admin perspective, I found user access management a little difficult. The roles of access management becomes complicated because some time the config files for that didn't came very handy. Other then that I think all in all Splunk provides fulfill all of the requirements.

Avantages

If you need real-time grokking into your infrastructure, look no further than Splunk. I love love love the dashboards. It’s easy to tell a story with your data, and the live search is so FAST!

Inconvénients

SPL is a little hard to get used to, but once you get the hang of it, it’s not so bad. I recommend downloading their community edition for some great examples of queries and dashboards.

Avantages

The system is highly intuitive to use. It is faster than other solutions I've used on the market and has a huge library of 3rd party plugins to get more from the system. It is easy to create scheduled searches, dashboards, reports etc. but there are a number of additional plugins (at an extra cost) to help with security, single pane of glass and metric collection.

Inconvénients

It offers challenges for a decentralized working model. Where Splunk is centrally managed, it is easy to ensure that best practices are maintained. Where the system is opened up for an entire department to utilize and on-board their logs, it becomes more difficult. However, with some creative thinking and good process, this issue can be overcome.