Google Chronicle Suite vs Splunk Enterprise Security comparison

Cancel
You must select at least 2 products to compare!
Microsoft Logo
31,886 views|17,713 comparisons
92% willing to recommend
Google Logo
1,608 views|1,197 comparisons
87% willing to recommend
Splunk Logo
24,689 views|20,244 comparisons
92% willing to recommend
Comparison Buyer's Guide
Executive Summary

We performed a comparison between Google Chronicle Suite and Splunk Enterprise Security based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed Google Chronicle Suite vs. Splunk Enterprise Security Report (Updated: May 2024).
770,458 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"We didn't have anything similar. So, it really provides value from the incidents and automation point of view. The overview of the security fabric is most valuable.""Sentinel is a Microsoft product, so they provide very robust use cases and analytic groups, which are very beneficial for the security team. I also like the ability to integrate data sources into the software for on-premise and cloud-based solutions.""Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture.""The UI of Sentinel is very good and easy to use, even for beginners.""Sentinel's most important feature is the ability to centralize all the logs in one place. There's no need to search multiple systems for information.""If you know how to do KQL (kusto query language) queries, which are how you query the log data inside Sentinel, the information is pretty rich. You can get down to a good level of detail regarding event information or notifications.""We have no complaints about the features or functionality.""One of the most valuable features of Microsoft Sentinel is that it's cloud-based."

More Microsoft Sentinel Pros →

"The tool's most valuable feature is the search option, allowing easy navigation.""The product's most valuable feature is threat hunting. We can detect the threats directly from the console from the past data as well.""The log folder is fairly simple.""The support team is responsive.""What sets Chronicle apart from other solutions is its emphasis on threat hunting rather than solely serving as a monitoring tool.""Google Chronicle Suite is a highly scalable solution with good search capabilities.""The platform's most valuable features are multiple connectors and data output flexibility regarding dashboards and user experience.""Google Chronicle Suite provides useful APIs."

More Google Chronicle Suite Pros →

"We have found all the features useful. However, the dashboarding and logging have been very helpful. Additionally, the log analysis does a great job.""The indexing and data collection are valuable.""The breadth of the data sources that Splunk can ingest data from is broad and deep and it does an exemplary job at handling structured data.""Splunk has significantly helped with aggregation and correlation of critical logs. Not having to grep on each individual server has made everyone more efficient.""Internal tracking is helpful because we do not like to deal with multiple ticketing systems, and I am not a fan of ServiceNow. We are able to keep everything internal and utilize Enterprise Security.""There are lots of free learning materials on their website.""It is a one stop shop as a full monitoring and alerting solution for operations and application analysis for most of our back-end systems.""It helps streamline troubleshooting and log analysis."

More Splunk Enterprise Security Pros →

Cons
"The on-prem log sources still require a lot of development.""The solution should allow for a streamlined CI/CD procedure.""The troubleshooting has room for improvement.""The AI capabilities must be improved.""The dashboards can be improved. Creating dashboards is very easy, but the visualizations are not as good as Microsoft Power BI. People who are using Microsoft Power BI do not like Sentinel's dashboards.""It has been a challenge with Azure Sentinel to onboard the Syslog server from FortiGate. Azure Sentinel can work better on that shift between the Syslog server and a firewall.""Sometimes, it is hard for us to estimate the costs of Microsoft Sentinel.""I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."

More Microsoft Sentinel Cons →

"The tool is a little bit difficult to use compared to Microsoft Sentinel.""In terms of improvement, the UI can be a bit challenging for beginners.""The tool needs to improve tasking packages. Its GUI needs to be improved. The product needs to include time-based filtration. We can only see the alert detection timeline now.""A few areas are difficult to understand for someone who has less experience using the product.""The solution's graphical user interface (GUI) should be more user-friendly.""The product's default dashboard feature has a few limitations regarding availability.""The tool is complicated for a first-time user. It should also include newer APIs.""The configuration is not optimal."

More Google Chronicle Suite Cons →

"It works as intended for us, and we are getting everything that we need out of it. If anything, its initial setup can be improved a bit.""The administration of the cluster and app deployment to indexers or search heads can be done only using ssh access and command line, there is no GUI tools for that.""Delays in responses from the technical team can pose challenges for both vendors and clients, especially considering that Splunk applications and machine solutions are critical assets.""There can be a bit of complexity around some fields during the initial setup.""Splunk has a steeper learning curve, making it feel less user-friendly.""We were inundated with the amount of alerts and alarms that we could get out of it. It is also a resource hog and we didn't have the resources to support it on-prem so we're taking it offline now.""Sometimes the communication with support happens with multiple staff. They should reduce the time to resolution.""I would like some additional AI capabilities to provide additional information about things going wrong and things going well."

More Splunk Enterprise Security Cons →

Pricing and Cost Advice
  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

  • "The solution's pricing is dependent on the data amount."
  • "We have to pay extra charges for the amount of data transfer and technical support services."
  • "The tool is cheaper than Microsoft Sentinel."
  • "Compared to other solutions, Google Chronicle Suite's pricing is fine."
  • More Google Chronicle Suite Pricing and Cost Advice →

  • "Pricing and licensing is quite expensive. But for the value the product provides, it seems at par in the market."
  • "Although Splunk is an expensive product, it is designed to be utilized across your organization in order to maximize your ROI and lower your TCO."
  • "It is not cheap."
  • "Splunk Enterprise becomes extremely expensive after the 20GB/month license."
  • "You will eat up whatever you purchase quickly. The level of insights that Splunk empowers is addictive."
  • "Splunk licensing model might seem expensive but with all the gain in functionalities you will have compared to traditional SIEM solutions I think it’s worth the price."
  • "Pricing is pretty fair."
  • "While licensing can be a concern, there are ways to reduce the licensing costs including filtering some events."
  • More Splunk Enterprise Security Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    770,458 professionals have used our research since 2012.
    Comparison Review
    Vinod Shankar
    Questions from the Community
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Top Answer:Google Chronicle Suite is a highly scalable solution with good search capabilities.
    Top Answer:Compared to other solutions, Google Chronicle Suite's pricing is fine.
    Top Answer:The solution's graphical user interface (GUI) should be more user-friendly.
    Top Answer:For tools I’d recommend:  -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is… more »
    Top Answer:Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring… more »
    Top Answer:Splunk helps us be more proactive. We can take predictive action to identify and block threats so that nothing harmful… more »
    Comparisons
    Also Known As
    Azure Sentinel
    Learn More
    Overview

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    The Security Operations suite for the modern SOC - detect, investigate, and respond to cyber threats with speed, scale, and precision.

    How Chronicle works:
    1. Collection - Chronicle ingests your own data into a private container at petabyte scale with 1-year retention.
    2. Detection - all of that data is aggregated, normalized, and linked with OOTB detections and threat intelligence.
    3. Investigation - that data is then exposed via case management, sub-second search, collaboration, and contextual mapping.
    4. Response - rapid response times occur via automated playbooks, incident management, and closed-loop feedback.

    Splunk Enterprise Security is a SIEM, log management, and IT operations analytics tool. The solution provides users with the ability to secure their information and manage their data in the cloud, data centers, or other applications. Splunk Enterprise Security also offers visibility from different areas, levels, and devices, rather than from a single system, thus, providing its users with flexibility. Splunk Enterprise Security can monitor data and analyze, detect, and prevent intrusions. This benefits users as it provides alerts to possible intrusions, helps users to be proactive, and reduces risk factors. 

    Full visibility across your environment

    Break down data silos and gain actionable intelligence by ingesting data from multicloud and on-premises deployments. Get full visibility to quickly detect malicious threats in your environment.

    Fast threat detection

    Defend against threats with advanced security analytics, machine learning and threat intelligence that focus detection and provide high-fidelity alerts to shorten triage times and raise true positive rates.

    Efficient investigations

    Gather all the context you need and initiate flexible investigations with security analytics at your fingertips. The built-in open and extensible data platform boosts productivity and drives down fatigue.

    Open and scalable

    Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Splunk meets you where you are on your cloud journey, and integrates across your data, tools and content.

    Sample Customers
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Information Not Available
    Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
    Top Industries
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Comms Service Provider8%
    Manufacturing Company8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    VISITORS READING REVIEWS
    Computer Software Company14%
    Retailer12%
    Financial Services Firm11%
    University7%
    REVIEWERS
    Computer Software Company20%
    Financial Services Firm15%
    Government9%
    Energy/Utilities Company8%
    VISITORS READING REVIEWS
    Financial Services Firm15%
    Computer Software Company14%
    Government9%
    Manufacturing Company7%
    Company Size
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise59%
    REVIEWERS
    Small Business63%
    Midsize Enterprise13%
    Large Enterprise25%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise13%
    Large Enterprise64%
    REVIEWERS
    Small Business32%
    Midsize Enterprise12%
    Large Enterprise57%
    VISITORS READING REVIEWS
    Small Business19%
    Midsize Enterprise13%
    Large Enterprise68%
    Buyer's Guide
    Google Chronicle Suite vs. Splunk Enterprise Security
    May 2024
    Find out what your peers are saying about Google Chronicle Suite vs. Splunk Enterprise Security and other solutions. Updated: May 2024.
    770,458 professionals have used our research since 2012.

    Google Chronicle Suite is ranked 28th in Security Information and Event Management (SIEM) with 8 reviews while Splunk Enterprise Security is ranked 1st in Security Information and Event Management (SIEM) with 240 reviews. Google Chronicle Suite is rated 7.8, while Splunk Enterprise Security is rated 8.4. The top reviewer of Google Chronicle Suite writes "Swiftly navigates and analyzes extensive datasets without significant delays ". On the other hand, the top reviewer of Splunk Enterprise Security writes "It has a drag-and-drop interface, so you don't need to know SQL or Java to construct a query ". Google Chronicle Suite is most compared with AWS Security Hub, Sentinel, IBM Security QRadar, Elastic Security and Rapid7 InsightIDR, whereas Splunk Enterprise Security is most compared with Wazuh, Dynatrace, IBM Security QRadar, Elastic Security and Sentinel. See our Google Chronicle Suite vs. Splunk Enterprise Security report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.