Splunk Enterprise

La référence tout simplement

Commentaires : Un des meilleurs outils de journalisations

Avantages :

Nous a permis de faire des dashboards sur le suivi des patching de nos VM sur le Cloud et de l'installation de Crowdstrike. Mais aussi de traquer l'utilisation du NTLM V1 pour le désactiver sur nos serveurs

Inconvénients :

Les query sont un peu long et prennent un peu de temps à etre apprise

Splunk for Log Monitoring

Commentaires : Splunk is best data monitoring and visualization tool. We can set alert for log and monitor log . It provides different modes for searching Fast, Smart and verbose. By using Splunk we are getting all system log in one place .Splunk has capability to handle large and big size data. It has best GUI , one can easily adopt and do customization and based on requirments.

Avantages :

We are using Splunk for log monitoring . It is integrated with Kubernetes and pivot cloud via data bus. By Splunk we get Realtime log application. It provides best visualization of data generated by system. Splunk also provide option to filter data based on data range and time. We can configure email alert for specific issue. Splunk also provide ML model for data. Splunk use simple query to get data ,everyone can easily learn Splunk query.

Inconvénients :

I haven't found any issue yet the only problem with Splunk I have that log in Splunk is scattered . We need to build good query or better logging mechanism at application side.

Splunk Enterprise, not just a SIEM

Commentaires : We have been using Splunk Enterprise, ES, ITSI, and other Splunk parts for 6+ years in production. This has helped us reduce staff in some cases, increase response time in most cases, and allow non-IT teams to get data and metrics in a fast efficient way.

Avantages :

The versatility is amazing. The same data in logs, such as IIS, can be used for Security, Application performance, and even error handling. This allows us to use one log to help multiple teams. This is just one example.

Inconvénients :

Start up takes someone who has had some training. While searching and output is easy, its the onboarding of custom apps that takes the know how.

Alternatives envisagées : Sumo Logic

Pourquoi passer à Splunk Enterprise : Versatility with custom applications we create in house.

Powerful SIEM system that meets our expectations.

Commentaires : We are using Splunk Enterprise for log correlation, the analytics are accurate and it catches errors right away which improves our internal capabilities, it is a special service that collects data from different data sources very accurately to catch future issues, the reports are detailed and understandable. It has features that streamline manual work, improve our security and our protection in our IT infrastructure.

Avantages :

I really like the platform, the data collection is ideal and the reports are detailed, it is the most appropriate SIEM service to monitor our IT infrastructure, it is an ideal software to take preventive measures, it is easy to customize the dashboards, the monitoring is constant and it gives us security in real time, the alerts are accurate and it helps us understand what is happening and fix it before it becomes serious.

Inconvénients :

It is a somewhat expensive service but with more powerful features than other free SIEM systems, and it is a bit complex to set up and use for inexperienced users, so a lot of help should be sought from experienced staff and support team at first.

Spunk Review

Avantages :

It allows me to bring a lot of information into one friendly view. It's a great security audit tool.

Inconvénients :

It has limited functionality. It is a very memory intensive system. It does not integrate with Lennox.