Splunk Enterprise

Best application for monitoring of SAP system, server and database health

Comentarios: Overall Splunk Enterprise is excellent and one of the best business application for early analysis of system performance. Also, tool is really fast and provides analytical report of every system, which is really useful for detailed analysis.

Puntos a favor:

Sofware is really excellent and best suited for small and large scale business who would like their systems, interfaces, server space and database health check to be performed.

Contras:

Sometimes the Splunk alerts creates multiple tickets in ITSM tool during issue. Hence it may result in spending sometime for closure of open incidents.

Complete Security operations with Splunk

Comentarios: Splunk data visualization and its analytics handling chunks of data is exceptional.

Puntos a favor:

Data visualization, Analytics skills with AI-powered and can handle data in TB/per day without any interruptions in services. Live dashboards, developing use-cases and their capabilities (correlation).

Contras:

complex architecture and efficient skills are required, financial is also not feasible for small and medium customers. no inbuilt query builders for beginners to understand the platform.

Master of multiple event log data collection with excellent intrusion detection capability

Comentarios: Flexible product with extensive data collection capability for complete visibility to ensure effective threat investigation.

Puntos a favor:

Advanced security analytics to quickly detect malicious threats within our networks and devices with rapid response and effective alert prioritization to accelerate investigation.

Contras:

Great integration to collect multiple data easily and in built-threat intelligence that helps to accelerate our investigations. Full of incredible features, there is nothing to dislike.

Spunk Review

Puntos a favor:

It allows me to bring a lot of information into one friendly view. It's a great security audit tool.

Contras:

It has limited functionality. It is a very memory intensive system. It does not integrate with Lennox.

Splunk Enterprise, not just a SIEM

Comentarios: We have been using Splunk Enterprise, ES, ITSI, and other Splunk parts for 6+ years in production. This has helped us reduce staff in some cases, increase response time in most cases, and allow non-IT teams to get data and metrics in a fast efficient way.

Puntos a favor:

The versatility is amazing. The same data in logs, such as IIS, can be used for Security, Application performance, and even error handling. This allows us to use one log to help multiple teams. This is just one example.

Contras:

Start up takes someone who has had some training. While searching and output is easy, its the onboarding of custom apps that takes the know how.