Splunk Enterprise

Avantages

Se cercare un SIEM stabile, affidabile e con cui monitorare costantemente i vostri sistemi Splunk è la soluzione giusta per voi. Nella soluzione cloud SaaS consente di gestire un elevatissimo numero di log. Ha un architettura complessa che consente la ridondanza e la gestione dei carichi di lavoro tramite bilanciamento. Permette una molteplicità di analisi che consentono all’analista di sicurezza di investigare a qualsiasi livello ciò che accade ed è accaduto. Il linguaggio SPL con il quale è possibile analizzare i dati è molto potente e versatile

Inconvénients

A volte l’installazione su determinati sistemi operativi prevede un processo piuttosto complicato soprattutto se si ha intenzione di rispettare il principio del least priviledge e non installare il software con permessi di amministratore. Su determinati sistemi operativi come AIX e determinate versioni di Linux non è disponibile l’agent ma il solo inoltro dei log al cloud Splunk tramite protocollo syslog

Avantages

I really like the platform, the data collection is ideal and the reports are detailed, it is the most appropriate SIEM service to monitor our IT infrastructure, it is an ideal software to take preventive measures, it is easy to customize the dashboards, the monitoring is constant and it gives us security in real time, the alerts are accurate and it helps us understand what is happening and fix it before it becomes serious.

Inconvénients

It is a somewhat expensive service but with more powerful features than other free SIEM systems, and it is a bit complex to set up and use for inexperienced users, so a lot of help should be sought from experienced staff and support team at first.

Avantages

Splunk comes with lot of in-built templates for each and every feature like log visualisation, dashboarding, traces,etc This makes the developers life lot easier. I can't think of any other logging tool that is snappy as well as accurate.
I love the fact how easily I can plug it in my docker-compose to push container logs.

Inconvénients

Even though, it offers numerous features for different needs, each feature has its own learning curve. For instance log visualisation needs querying skills, which may be in natural language but it takes bit of time to get familiar.

Avantages

Splunk is provides a single tool for log aggregation, log analysis, and visualizations. Threat hunting, applying threat intelligence, and incident response are easily repeatable; pushing organizations to proactive security processes.

Inconvénients

Splunk is expensive, especially when an organizations is exploring and building new security or data use cases. It also requires a lot of engineering maintenance, making the quality of the data highly-dependent on the skill(s) of those supporting it. Many organizations do not maximize its benefit because it is poorly managed or supported by low-skilled employees.

Alternatives envisagées 

Elastic Stack

Pourquoi passer à Splunk Enterprise

Splunk scales in all aspects except price. Organizations that are serious about security and SIEM tools will see the value in their investment almost immediately. The insights from the analytics and development capabilities are not available in other tools with this level of ease.

Avantages

The versatility is amazing. The same data in logs, such as IIS, can be used for Security, Application performance, and even error handling. This allows us to use one log to help multiple teams. This is just one example.

Inconvénients

Start up takes someone who has had some training. While searching and output is easy, its the onboarding of custom apps that takes the know how.

Alternatives envisagées 

Sumo Logic

Pourquoi passer à Splunk Enterprise

Versatility with custom applications we create in house.

Avantages

- Free to use for small 500MB or less daily ingress, quite nice for small use cases and learning
- No development work required to deploy and provide value.
- Deployment flexibility: client agents are available to use, or clientless configurations for multiple OS platforms. It's also very easy to deploy, not just flexible. its a very simple affair.
- Segmentation of logs: You can create separate instances of of logs to aggregate, based on organization needs. And those instances can have their own individual storage policies to optimize consumption of storage resources.
- Configuration design: Thoughtful and mature documentation and design of the application regarding enterprise-class scaling on network storage.
-POWERFUL tools: The user interface lends itself to learning more about your organization from the logs you collect, through metrics of trends of the logs being gathered. There are also specific modules/add-ons for popular applications to provide more value and event-based monitoring, all without having to develop in-house dashboards and intelligence of those logs.
- Customization: You can create your own queries of logs, and event-based alerts.
- Web-based GUI that clean is powerful
- Sales/Technical Reps are top notch in fielding questions and evaluating environment for deployment. They were extremely helpful in helping our organization develop procedures and scaling our environment for expansion with our existing infrastructure.

Inconvénients

- Price: This product is not free for more than the minimal use. Pricing can be very expensive, relative to open source offerings. That is the trade-off you pay for not having in-house development of open source offerings. As this product is priced based on gigabytes of indexed logs, it is important to understand the scope of licensing necessary for your environment to determine if it is a good fit for your organization.
- Watch your saved queries and hardware resources: Users have the ability to create and save queries. Like in database queries, some are more efficient than others. Large inefficient queries can be very resource-intensive. If you notice slowness in day-to-day queries, or navigation in the UI, or resource use in contention, keep an eye on saved queries and user practices.

Avantages

Provides a single location for collecting and analyzing logs. Provides ease of use for non-technical users, but powerful features for security and IT. There is an add-on/app for anything you could imagine.

Inconvénients

Some documentation is vague, and when certain things don't work, it can be difficult to find out a solution to the problem.

Alternatives envisagées 

Sumo Logic

Pourquoi passer à Splunk Enterprise

We needed a product that we could host ourselves.

Avantages

The simplified user interface which presents logs in a readable format. Also it's ability to quickly identify integration issues

Inconvénients

A mechanism to hide system generated logs that are unimportant would be great

Avantages

The most useful thing about Splunk is the ease of integration with application. With uipath on-premises it was very much helpful as the business users can monitor the actions of robots through spluink without entering into uipath orchestrator

Inconvénients

Expression creation for indexing was bit hard as it is not user-friendly to business users if they wanted to create any new fields, also the forwarder was not able to directly connect with uipath cloud so that the logs has to be shifted to intermediate file before uploading into splunk, but that seems not an issue with splunk but more related to uipath cloud

Alternatives envisagées 

Microsoft Power BI

Pourquoi passer à Splunk Enterprise

Splunk was much cheaper than power bi and only little effort needed for implantation and the resources cost is also higher for power bi

Avantages

Real Time monitoring is the best feature which we like most about this software. It helps to send the notification or alerts if they are something wrong is going on in the server. So, team member can quickly resolve the issue.

Inconvénients

As of now, i don't have anything which i don't like about this software.

Avantages

Aggregare più log è fondamentale quando c’è un flusso elevato di log. Lo trovo eccellente e rapido. Riesce a scalare senza problemi effettuando le ricerche in maniera intelligente per trovare prima i risultati. La sezione delle Dashboard è la cosa più interessante perché può mettere insieme diversi grafici consentendo di personalizzare l’interfaccia grafica con input e bottoni.

Inconvénients

Con una grossa mole di dati e effettuando ricerche nel tempo (es 30 gg) può metterci veramente tanto ma trovo che nel complesso si comporta egregiamente e ovviamente dipende da server su cui viene installato.

Avantages

Splunk offers various features whether you need to setup monitoring on your server, application logs based on logs ingestion set alerts so that teams got notified on real time and take actions accordingly. In this way, it helps to monitor application which are mission critical. You can make dashboards in Splunk where you can configure various components such indexes, data inputs and schedule reports as well. To achieve additional functionalities we can install third party apps as well such as AWS Add on for cloud watch log ingestion.

Inconvénients

From Admin perspective, I found user access management a little difficult. The roles of access management becomes complicated because some time the config files for that didn't came very handy. Other then that I think all in all Splunk provides fulfill all of the requirements.

Avantages

Its been a while since I started using Splunk Enterprise. I love its ability to cumulate data and logs from multiple sources and correlate them to help find incidents and their root cause. It consolidates logs and manages them form a central place. It is a great tool for log analysis as it segregates data and provides in depth profiling. Splunk enterprise also automates alerts and indexes on logs received.

Inconvénients

It has a complex architecture making the learning curve quite steep

Avantages

If you need real-time grokking into your infrastructure, look no further than Splunk. I love love love the dashboards. It’s easy to tell a story with your data, and the live search is so FAST!

Inconvénients

SPL is a little hard to get used to, but once you get the hang of it, it’s not so bad. I recommend downloading their community edition for some great examples of queries and dashboards.

Avantages

Security Information and Event management, log analytics, custom dashboards and workspaces

Inconvénients

Auto upgrade management and notifications for Add-ons. Leaning more towards config file based implementation instead of UI based implementation

Avantages

As Dashboards são incríveis e precisas. Podemos criar utilizando a interface do programa ou por Comandos muito parecidos com Pl SQL.

Inconvénients

Nada a declarar, o software atende a todas as necessidades.

Avantages

Best tracking and data analysis tool which help to monitor and manage the server and system component in very effective way. Real time Visualization helps to take the quick decision so that desired action can be taken to avoid failure.Best data collection in the forms of log and which helps to define the best set of automation jobs to fix the issue.

Inconvénients

There are few components or observation like,1. most of the time observes the slowness in the performance.2. Sometime observe the delay in the issue or updated log reflection on the portal. 3. Need more storage to manage and maintain the lo g which impact organizational costing and budget.

Avantages

The tool can collect all sorts of data from diffuse sources and preform advanced analytics on it. It has powerful monitoring capabilities useful in threat identification and maintaining the health of our IT infrastructure. Splunk enterprise helps us to foresee, trends through machine learning which has been a crucial to making informed business decisions.

Inconvénients

Training new users is tough, the learning curve is very steep and it gets overwhelming for them. The installation and configuration process is very long and needs a lot of time.

Avantages

With Splunk Enterprise, it is easy to investigate, detect and remediate threats on devices and endpoints on our network.

Inconvénients

It was full of technical overheads when we were customizing Splunk Enterprise features.

Avantages

Splunk Light is ideal for independent on-premise organization.
Augment endpoint logging.
Can find and store logs from a wide range of resources.
Customization of dashboards.
Making applications dependent on your requirements.

Inconvénients

Complex generally design.
Long execution time.
The instrument needs to incorporate AI to comprehend the framework logs and alarming ought to be founded on the auto learning.

Avantages

The system is highly intuitive to use. It is faster than other solutions I've used on the market and has a huge library of 3rd party plugins to get more from the system. It is easy to create scheduled searches, dashboards, reports etc. but there are a number of additional plugins (at an extra cost) to help with security, single pane of glass and metric collection.

Inconvénients

It offers challenges for a decentralized working model. Where Splunk is centrally managed, it is easy to ensure that best practices are maintained. Where the system is opened up for an entire department to utilize and on-board their logs, it becomes more difficult. However, with some creative thinking and good process, this issue can be overcome.

Avantages

We use this as our SIEM. The ability to have the data ingest, visualization, alerting and correlation all in one product is very important to me from a security standpoint. We're cloud-first so having that ability with large cloud providers is important to me (AWS, Okta, GCP, etc)

Inconvénients

The cost can be a little concerning and htere is a bit of a learning curve when you first get into Splunk. User groups, their forum and pro serv all help with that.

Alternatives envisagées 

Datadog et Elastic Stack

Pourquoi passer à Splunk Enterprise

Better product.

Avantages

They have a robust platform that I have used for monitoring and analytics. There are a lot of options and customization available when using it.

Inconvénients

Because there is so much customization and options available, it can be complicated to learn.

Avantages

I think Splunk is first and best software in the field, easy to use, does what it had promised,

Inconvénients

pricing could be better, they could be more flexible, support is a bit slow

Avantages

Dashboards feature is amazing, I use it much. Alerts and queries are easy to set up. Mostly it works fast so it's kind of Dev friendly so it's easy to onboard the new guys

Inconvénients

Alerts should have a better way to manage it. There should be a way to promote alerts to different environments - so we will be able to set the Dev/Stg/Prod
Sometimes some things that we want to do take a while searching on the internet for a solution - they might think how to do it better - maybe some examples or better documentation

Avantages

Splunk allows us to see exactly what is going on in production! I work on commerce for a fortune 100 company, and we use Splunk to monitor our apps in real time. Splunk gives you the ability to perform queries like you would with SQL against your log statements in real time. You will learn that you can place strategic log statements in your code that allows you to identify situations in production and be proactive at solving them. For example, you can log your customer's session cookie ID, and track any given customer's activity on your website via your app logs. It gives you dials and charting capabilities to monitor even the slightest drops in customer activities due to flaws in code or slowing network calls.

Inconvénients

PRICE. The software is so powerful, and they seem to leverage this in the pricing of the licenses.

Avantages

-Easy to use tool
-Simple graphical interface which makes it easy for a new user to understand the features easily
-Real time data analysis can be carried out

Inconvénients

When we try to search for data which is more than 30 days old, then sometimes we see slowness

Avantages

The ability to set up queries and get data back quickly is invaluable

Inconvénients

Learning to structure queries is a bit of a challenge in the beginning

Avantages

Sofware is really excellent and best suited for small and large scale business who would like their systems, interfaces, server space and database health check to be performed.

Inconvénients

Sometimes the Splunk alerts creates multiple tickets in ITSM tool during issue. Hence it may result in spending sometime for closure of open incidents.

Avantages

It is an easy to use solution, the implementation is a bit more difficult.

Inconvénients

So far, this is a good solution that I use every day.

Avantages

Splunk appsStrength and capabilitiesIntegration with most solutions

Inconvénients

Resource utilizationLimited local partner support

Alternatives envisagées 

AlienVault OSSIM

Pourquoi passer à Splunk Enterprise

Overall functionalities

Avantages

The ability to use this software for security operations, data analysis, creating dashboards, generating tickets and everything else

Inconvénients

Splunk uses its own SPL, which is not very easy to learn. However, there are lots of documentation that Splunk provides to its customers. There is paid training available which is useful for beginners to learn.

Avantages

I'm not sure from where to start in this case.

We use splunk for many things but mostly to analyze the traffic on the network / firewalls. It provides us with a nice overview of what's going on. It makes it very easy to spot spikes on the network and it will provide you also with deep analyzes.

For us it's an indispensable tool, probably the best tool we have.

Inconvénients

To search for something is not always easy, however there are a lot of forums online, so finding help is not that difficult.

Avantages

Splunk nos ha permitido fortalecer nuestras capacidades de visibilidad sobre una amplia variedad de eventos (de ciberseguridad y funcionales), dada su flexibilidad nativa para consumir, correlacionar y alertar a partir de distintas fuentes. Con ello, hemos podido detectar y reaccionar oportunamente ante aquellos eventos que representan posibles amenazas para nuestros objetivos.

Inconvénients

Algunas funcionalidades requieren componentes adicionales.

Avantages

Real time use. The ingestion of data and more.

Inconvénients

Nothing yet.. maybe performance at times.

Avantages

Splunk is great for monitoring, logging, and analyzing the large volume of data on the servers. Our support teams use Splunk to collect data/logs from the servers and troubleshoot product related issues. We introduced Splunk few years ago in our organization and it helped improve our defect/issue analysis and problem solving abilities

Inconvénients

While Splunk is not too complex, it also requires a certain level of skillset to decipher the information. It may take a while to figure things out if you are a new user, or someone with limited technical knowledge

Avantages

Splunk can give you extreme insights into how your systems and software are functioning. Not only is the search very flexible and powerful, the customizable dashboards give a status report at a glance into trends, problems and performance. You can also set up email alerts when errors occur limiting the need to have Splunk opened on your machine all the time.

Inconvénients

Splunk has a learning curve. They have extensive documentation but it isn't intuitive and some features are buried pretty deep. We have an onsite expert who holds bimonthly meetings to answer questions in a group forum.

Avantages

The ablitity to configure and tweak the use cases. Building Intelligence into forensics. The AI feature is gud but needs more enhancements.

Inconvénients

The log management needs to be efficient , If the auditing logs is enabled then a huge influx of logs are pumed into splunk but no meaningful meaning can be derived.

Alternatives envisagées 

Trellix Endpoint Security

Pourquoi passer à Splunk Enterprise

Splunk is a one whole package with features like AI & Forensics and also keeps you updated with the latest and newest threats..

Avantages

Splunk Visually represents the logs mainly from production servers in the web UI .

People who Usually has no access to logs in production servers, will access the logs through splunk UI with very simplified and friendly search query.

It has lot of features like you can query for particular date and time range with specific characters. The search engine is very fast which will bring the query response effectively.

we can access all types of logs including XML and JSON.

we can create a custom dashboard with custom query for each projects and can relatively trigger the email to the support team in case of any issues.

This tool is boon for production support team in any enterprise company.

Inconvénients

Licensing cost is quite higher for enterprise usage.

Query response time will be slow when you are searching for relatively longer history(Eg. 3 months old data)

Avantages

The ease of initial setup along with the app market for add ons makes this a great product. Couple this with their support and it is so simple and great to use.

Inconvénients

A little overwhelming how much is out there for this product and can get to be a large task to get implemented correctly.

Avantages

When you need to store, correlate, and search large amounts of data, especially System Log data, there is no tool that even comes close to Splunk. It's power and flexibility is amazing.

Inconvénients

Very expensive. Difficult to implement until all moving parts are understood. Steep learning curve for beginners.

Avantages

Splunk integrates with almost all popular enterprise software products including VMware, AWS, Azure, etc. Most customers use it primarily to do log analysis but it can also perform data analytics for business reporting. The UI is very straightforward and enables you to quickly search through large datasets using SPL. We were able to quickly locate the source of the issues by using Splunk to triangulate logs from several different components. There is a Splunk Cloud version with a free trial if you are aiming to do some integration work and testing. Finally, like all monitoring tools, Splunk offers AI and machine learning for even better predictive analytics.

Inconvénients

Splunk is expensive and probably not for smaller startup companies. The pricing is tiered and is subscription-based so if you start to ingest a lot of data, look out. It can eat into most of your IT budget and Splunk by itself doesn't handle all the Day 2 operations that are needed.

Avantages

Ease of use, you can extract any kind of information using commands provided by the software vendor. The other good thing about this software is the easy implentation on the servers, and the configuration is basic.

Inconvénients

For people that are not used to use command lines, it might be a liitle bit difficult on the beggining.

Avantages

The best thing about this software is i love its UI part and its dashboard where it provides the logs of all the enterprise application every business which has large amount of the transactions being held are required to maintain this tool and its logging and search frequency are very much loved and dash board has very colourful UI and easily understandable

Inconvénients

There is no least about this software but we are looking for some more enhanced featured like optimisation and all

Avantages

Several of our applications are distributed across multiple systems. It is the same software running on each server but doing the same job for different users. Each server would generate its own log files. When things went wrong, we used Splunk to be able to see what was going on on each server. Click a few buttons and you get two logs from two different servers listed together coordinated by time. But that leads you to discover that the issue came from a separate upstream or downstream server, then bring in those logs too . . . all coordinated by time. Don't get me wrong, the IT guys love these tools for their own enterprise reasons, but as a server stack developer, this was a resource I used OFTEN.

Inconvénients

I never fully grokked their SQL like language. I could do basic things daily without issue. However, I often had to hit the documentation to do anything more than a simple "find this" query.

Avantages

We are using this tool for monitoring our services log. It is easy to monitor the data using this. For each service, you can configure which log file should be shown on the UI(web). On UI, it provides lot of features like finding pattern in logs, doing analysis and generating reports and much more.

Inconvénients

Learning is slow. Initially, it takes time to understand the reports and pattern it finds out of the log. But it's worth learning it.

Avantages

INgestion of the huge volume of the data. q

Inconvénients

Reporting commands on volume data and training documentation on the reporting.

Avantages

We use this tool primarily as a repository for syslog messages for infrastructure. It allows us to quickly analyze the logs and patterns to determine issues based on patterns. In addition it alerts very well from text based trigger alerts. These features are very easy to use and dependable.

Inconvénients

I do not have any cons for this software. Mainly as a user it does exactly what I need it to do with no overhead and confusing interfaces.

Avantages

1) Accepts multiple data formats like CSV, JSON, XML
2) Does the hard work for us i.e converting machine data to a human-readable format.
3) Can create customized alerts to serve our business purpose.
4) Searching on the based on queries is pretty simple.
5) We can create dashboards to analyze and visualize our search results.
6) Can export the log content to our Personal computers.
7) Setting up plugins and integrating with any tool that needs monitoring is pretty easy.
8) Technical support for the Splunk is very quick as they have a dedicated staff for that.

Inconvénients

I did not find any flaws with this software.

Avantages

I work at Fintech company and we use Splunk for checking error logs and tracking anything that goes wrong within the system. I like Splunk as it gives exact line number which is breaking the code which makes easier to debug.

Inconvénients

The index should be accurate otherwise viewing logs is not easy.