Splunk Enterprise

Opmerkingen: We've used the software to detect layer 7 attacks, unearth issues we didn't realize were happening and gives us end to end insight into our stack.

Pluspunten: The system is highly intuitive to use. It is faster than other solutions I've used on the market and has a huge library of 3rd party plugins to get more from the system. It is easy to create scheduled searches, dashboards, reports etc. but there are a number of additional plugins (at an extra cost) to help with security, single pane of glass and metric collection.

Minpunten: It offers challenges for a decentralized working model. Where Splunk is centrally managed, it is easy to ensure that best practices are maintained. Where the system is opened up for an entire department to utilize and on-board their logs, it becomes more difficult. However, with some creative thinking and good process, this issue can be overcome.

Opmerkingen: I've used Splunk for over 8 years and it is my go-to SIEM. There are tons of apps and integrations. Good for correlation and leveraging the Common Information Model will make your life much happier.

Pluspunten: The power of it. It's a very good tool that does amazing things. Nothing comes close to it. We used it for full view of data, full transaction. Security appliance consolidation.

Minpunten: There is a learning curve and a new language you have to learn, but it's intuitive and you can pick it up pretty quickly.

Opmerkingen: We use Splunk to collect logs information for our application which deployed in AWS, it collects the application logs directly from Application EC2 and also integrates with CloudWatch, Load Balance and other AWS component to collect AWS logs relate to our Application, we also get the log from AWS billing report to track our spent in AWS.

Pluspunten: Splunk has very strong query language event complex commands like Join, subquery or aggregate which much the same with SQL query with good report UI to display result. Set Splunk system is easy with install Splunk server and its agent in every node then configure logs location to collect. It provides many built-in Apps to collect logs from other popular tools such as AWS, Salesforce, Kafka...

Minpunten: Splunk query language is quite hard to learn for new user and its query error is too generic for troubleshooting.

Opmerkingen: Splunk Enterpise is the best security information and event management tool ever. It allows you to see far most end point of your system, everything stays under control.

Pluspunten: The fature of scrpint/coding your own app inside the Splunk is very useful. I developed a lot of dashboards for our infrastructure, customized alarms, email notfications helps you to see what is happening in the system. It definetely deserves the money our company have had paid.

Minpunten: When you have a real big infrastructure, Splunk user interface gets a bit slow. Waiting for search results a bit annoying.

Pluspunten: It allows me to bring a lot of information into one friendly view. It's a great security audit tool.

Minpunten: It has limited functionality. It is a very memory intensive system. It does not integrate with Lennox.