I know there was a panel and a team that was going through different tools. I was not a part of that process, but I know there were quite a bit of tools that they were looking at. Splunk must have worked out better than everything else.

There are different companies or customers that we support within the company. Whichever product they have that's what we go with. For example, we might use AlgoSec, Cisco Prime, or LiveAction as the customer that was using it. We don't evaluate other solutions, we use what is already there.

I did not handle the choice of Splunk. I got into the stage where the system or the application was already implemented. I did not participate in the stage where we had to choose which solution to pick or how to implement it.

I did compare a few other tools, however, we are using Splunk because that is what the customer preferred. They made the decision after I described this solution and a few other tools to them.

I need a tool that can deal with all the security solutions, that will find security monitoring compliance requirements. So, I'll stick to BigFix over Splunk, because I'm not that big a fan of Splunk, to be honest. Apart from monitoring, in BigFix you can mitigate the issues, mitigate what the vendor is doing, and continue monitoring our clients. If any machine, any hardware in the department is vulnerable to any threat, with BigFix we can go ahead and take action, and mitigate that vulnerability within a couple of minutes.

We work with a few different solutions. As a SIEM, there are many other solutions out there and which is best really depends upon what the company wants to achieve.  As a logging server, there really aren't any other really good solutions that compete as well with Splunk. LogLogic might be the closest.