Splunk Phantom Review

Good security orchestration and when we face challenges with it we can find a solution in the documentation

What is our primary use case?

Our primary use case of the solution is for fine tuning. We provide professional services for our customers to enhance their ability to use the functionalities of Splunk. We're integrators of the solution. 

What is most valuable?

The most valuable feature of Splunk is a very flexible integration with other tools. Compared to other products in the market, Splunk is very user friendly, and not very complicated. It integrates with most of the endpoints and that's a very positive side of the solution. There's no need to remember a lot of things and documentation is great. I really appreciate that aspect. Since it is cloud-based there is a lot of flexibility. And most of the challenges that I have faced with the solution can be found in the documentation itself.

At this point, I'm very happy with the solution. There's nothing there that disturbs me. Security orchestration is a new emerging issue in the market. If I have to compare with other security orchestration tools, Splunk is a good solution. Many vendors have opted for Splunk because of easy usability and connectivity to radius devices.

For how long have I used the solution?

I've been using this solution for about six months. 

What do I think about the stability of the solution?

Stability is good

What do I think about the scalability of the solution?

Scalability is good, allows flexibility. That's what makes life easy. 

How are customer service and technical support?

There's great documentation and most of the challenges I've faced, I've found the solution via the documentation. I've never contacted the technical support which attests to the quality of the documentation. 

Which solution did I use previously and why did I switch?

I know RSA and Splunk are similar solutions even though I've never used RSA. I know that Splunk is user friendly and doesn't require in-depth knowledge. Everything is file based, applications like RSA rely on databases. I have the confidence of being able to use Splunk efficiently and there are a lot of features I can handle myself the way I want to. 

How was the initial setup?

Initial setup is very straightforward and simple. Much easier than other tools, it takes a couple of days depending on the architecture. 

What's my experience with pricing, setup cost, and licensing?

The solution is for our clients so we don't deal with the licensing aspect. 

What other advice do I have?

It's important to know your customer's requirements so you can choose the correct solution. The budget also needs to be taken into account. Most customer's budgets suit a Splunk solution whereas RSA is much more expensive. 

I would rate Splunk Phantom a seven out of 10. 

**Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Add a Comment