The Negative Effect of Canada Wildfires on Chicago Office Environments

Does Your Network And Security Team Really Need A SIEM?

        Imagine if your organization had the exponential resources to provide every single device on your network its own personal administrator to monitor it.  Your new army of employees would work 24/7 to track anomalies, quickly escalate priority events to your Security Operations Center (SOC) and stop ransomware in its tracks.  This is exactly the purpose of a Security information and event management (SIEM) tool.  It’s an automated collection point of telemetry data from devices like firewalls, switches, servers and more.  A good SIEM allows your company to minimize investigation time by correlating threat intelligence in one place without requesting a budget for new staff or adding tasks to the limited security resources you have now.  There are over 50 players in this crowded market but let’s examine the honest benefits and drawbacks of one of the most famous SIEM providers in the security industry.

Love It or Leave It

        Splunk Technology is a known leader in the artificial intelligence, big data and cybersecurity markets. With headquarters in Silicon Valley, their client list includes 92 of Fortune 100 companies.  Just this month (Oct 2023), network giant Cisco Systems announced an intention to acquire Splunk for $28B in cash.  This will be the largest acquisition in the history of Cisco and will create synergies between the company that “owns the network” and the company that's the king of monitoring it.  One of the biggest benefits of the acquisition is that Splunk will be better positioned to compete on price against large competitors like Microsoft while also controlling the telemetry of one of the largest network and security portfolios in the world.

        Splunk’s primary SIEM tool, Enterprise Security (EM) is offered on-premise and in the cloud for companies with a “cloud first” strategy.  It is able to provide intelligent log management and network

analysis in one package.  Enterprise Security has been ranked as an industry leader for many years by all three major analysis reports (Gartner Magic Quadrant, Forrester Wave and IDC Marketscape).  One of its strengths is the powerful query functionality, data-science analytics and customized dashboards it brings out of the box.  In addition, Splunk is known to have a strong support base, a large user community and most customers report a positive experience compared to competitors.

Conclusion

        As with any product, there are some notable drawbacks that customers would love to see resolved.  The biggest concern is the high cost of doing business with Splunk.  While they don’t list pricing on the website for Enterprise Security, the estimate listed among existing users is $150 per ingested GB of data

per month.  Gartner states that the demand to log everything sometimes forces customers to look at alternatives to paying thousands per year for every new device added.  Next, the intelligence and modularity of Enterprise Security also make it one of the more complex products to learn.  While Splunk has a robust training and certification program for cybersecurity professionals, the demand for these resources is very competitive.  Finally, most of Splunk’s salesforce is in North America with limited understanding of markets outside of the region they operate in.

Written by Cisco Chris