Splunk Enterprise

Opinión Splunk Enterprise

Comentarios: Splunk se ha alineado con nuestras expectativas. Recomendado.

Puntos a favor:

Splunk nos ha permitido fortalecer nuestras capacidades de visibilidad sobre una amplia variedad de eventos (de ciberseguridad y funcionales), dada su flexibilidad nativa para consumir, correlacionar y alertar a partir de distintas fuentes. Con ello, hemos podido detectar y reaccionar oportunamente ante aquellos eventos que representan posibles amenazas para nuestros objetivos.

Contras:

Algunas funcionalidades requieren componentes adicionales.

es buena herramienta

Puntos a favor:

es una herramienta de facin configuracion e implementacion, aparte de ser intuitiva.

Contras:

hay veces que se traba la interfas cuando se sastura el equipo.

Básica para el Big Data

Comentarios: Muy buena, lo recomendamos aunque es conveniente analizar bien el mercado y los productos parecidos que hay.

Puntos a favor:

Capas de procesar gran volumen de datos a partir de múltiples fuentes, rápido y eficaz en el análisis . Nos ha permitido mejorar y fortalecer todos nuestros procesos internos de la empresa y optimizar nuestros objetivos

Contras:

Es un software bastante caro y no para pequeñas empresas, a no ser que te dediques a ello. Puede requetir implementar algunos complementos adicionales.

Big data is no problem for Splunk Enterprise

Comentarios: Splunk is a powerful and useful monitoring tool. Splunk's efficiency is enhanced by the ability to integrate third-party apps developed in-house. It's also interesting that we can incorporate a customs alert and dashboard. In most situations, it resolves the need to normalize data, allowing for the use of any and all data in business forecasting. It is analyzed for data that can be utilized to optimize spending plans and asset tracking.

Puntos a favor:

Without worrying too much about data type or normalization, Splunk Enterprise can efficiently manage massive amounts of data from numerous sources. Data may be accessed in a flash, and there are a number of options for tailoring and integrating data analysis workflows to create bespoke dashboards or utilizing apps from our other product partners.

Contras:

There isn't much I dislike about splunk, however if we have to be picky, it would be that it's more difficult to maintain as an administrator when splunk is installed on outdated architecture.

Best SIEM in the market

Comentarios: My overall experience has been awsome so far. I would rate it 8.5/10.Splunk has been as effective soluntion when it comes to triaging and monitoring of day to alerts.

Puntos a favor:

- Easy to triage and monitor alert (Very fast and gives effective results as compared to other produts)Arcsight,Devo etc- Customer Support is excellent- Threat Hunting can be done effectively with the help of Splunk(IOC based,Corellation based etc)- Log parising is very effective & intelligent.

Contras:

- The only think i liked least about splunk is the cost involved/pricing model in case of high data volumes.