Splunk

What it is

Splunk is a commercial data analytics platform best known in cybersecurity for SIEM and security operations use cases. Security teams ingest machine data and logs, then search, correlate and investigate events. Splunk Enterprise Security extends the platform into a threat detection, investigation and response (TDIR) experience that can combine SIEM with related automation and analytics capabilities depending on edition and licence.

What it helps with

- Collecting and searching large volumes of security and IT telemetry in one place.
- Building detections, dashboards and investigations for security operations centres.
- Supporting SIEM workflows such as correlation, notable events and case handling in Enterprise Security.
- Integrating automation and response patterns where SOAR and related modules are licensed.
- Enabling threat hunting and forensics-style searches across historical machine data.
- Scaling commercial deployments on-premises or in cloud offerings marketed by Splunk / Cisco Splunk.

Who it's for

SOC analysts, detection engineers and security leaders in organisations that need a commercial SIEM or security analytics platform for authorised monitoring of their own estates.

Worth knowing

Splunk products are commercial and priced by platform edition, data volume and add-ons. Capabilities differ between core Splunk and Splunk Enterprise Security editions. Official product information is published at splunk.com. This listing frames Splunk primarily as a SIEM and security analytics platform. Attribution: framing from Splunk Enterprise Security product pages.