Splunk User Behavior Analytics Room for Improvement

NS
Senior Security Engineer at a government with 1,001-5,000 employees

Actually, the most valuable aspect of Splunk is the data. You do not need to use your databases to perform all things from on all the servers we have. Splunk has three big things it can do with data: it can show it hot, warm and cold. The hot of it allows you to see the data as soon as things happen — maybe to the second. We have the warm, the warm will segment the data up to the hot up to three months ago. The cold will store all of the archives of all the data after the six months. After that, you can't make comparisons any further. 

In the future, we make Splunk in the SOC (Security Operations Center). In the SOC now, we use one feature, it's called the alert system. So in the future, we want to make it so we can send all the data and we can build its security and its management. It will be published in all the places as it is now. We need to do this so we can build more data centers from all the past and existing data crunch.

View full review »
AE
Security PS Supervisor at a tech services company with 1,001-5,000 employees

The solution is much more expensive than relative competitors like ArcSight or LogRhythm. It makes it hard to sell to customers sometimes.

I would like to see a better tracking intelligence module with lower costs fully integrated with a user behavior analytics module. It would empower this module with the keys and real-time updates in terms of security.

View full review »
CC
Global Engineer at a financial services firm with 10,001+ employees

Currently, a lot of network operations need improvement. We still need people to handle incidents. Our vision is to leverage status and convert it directly from the network devices. It would be ideal if we could take action using APIs and API code and remove manual processes.  

View full review »
Learn what your peers think about Splunk User Behavior Analytics. Get advice and tips from experienced pros sharing their opinions. Updated: May 2021.
511,607 professionals have used our research since 2012.
General Manager at Hayyan Horizons

They can improve the licensing scheme. They are moving from perpetual to term licensing, which is not good. That is an area they need to improve.

On the network monitoring side, if they can have additional features, similar to other solutions like QRadar. They need to add a feature similar to network behavior analytics.

If Splunk is able to add some of those features then the solution will be like perfect.

I think they could have a built-in user behavior analytics engine, and more advanced artificial intelligence features as well. One bad feature on the solution is the network and the behavior of anomaly detection. Their machine learning is good, but I think they can improve on that as well. 

They should work to add more built-in correlation searches and more use cases based on worldwide customer experiences. They need more ready-made use cases.

View full review »
MH
Information Security Specialist at a financial services firm with 201-500 employees

The correlation engine should have persistent and definable rules. Splunk should have more features and options in regards to correlating in real-time. It should have the ability to set more permanent rules.  

Correlation capabilities in ArcSight are better than in Splunk. 

View full review »
WL
Sr. CyberSecurity Solutions Architect at a security firm with 11-50 employees

The price of Splunk UBA is too high.

View full review »
AK
CISO at a financial services firm with 201-500 employees

In the future I would like to see simplified statistics and analytical threats, as well as a more user-friendly interface for dashboards.

View full review »
Learn what your peers think about Splunk User Behavior Analytics. Get advice and tips from experienced pros sharing their opinions. Updated: May 2021.
511,607 professionals have used our research since 2012.