Splunk User Behavior Analytics Room for Improvement

Genrlmgr67
Senior Security Engineer at a government with 1,001-5,000 employees
Actually, the most valuable aspect of Splunk is the data. You do not need to use your databases to perform all things from on all the servers we have. Splunk has three big things it can do with data: it can show it hot, warm and cold. The hot of it allows you to see the data as soon as things happen — maybe to the second. We have the warm, the warm will segment the data up to the hot up to three months ago. The cold will store all of the archives of all the data after the six months. After that, you can't make comparisons any further. In the future, we make Splunk in the SOC (Security Operations Center). In the SOC now, we use one feature, it's called the alert system. So in the future, we want to make it so we can send all the data and we can build its security and its management. It will be published in all the places as it is now. We need to do this so we can build more data centers from all the past and existing data crunch. View full review »
Securityps67
Security PS Supervisor at a tech services company with 1,001-5,000 employees
The solution is much more expensive than relative competitors like ArcSight or LogRhythm. It makes it hard to sell to customers sometimes. I would like to see a better tracking intelligence module with lower costs fully integrated with a user behavior analytics module. It would empower this module with the keys and real-time updates in terms of security. View full review »
Informat0a7b
Information Security Manager at a financial services firm with 201-500 employees
The feature set isn't too bad as is. My biggest complaint is the way they do pricing. View full review »
Find out what your peers are saying about Splunk, Darktrace, Cisco and others in Intrusion Detection and Prevention Software. Updated: November 2019.
378,809 professionals have used our research since 2012.
Ali Tamimi
General Manager at Hayyan Horizons
They can improve the licensing scheme. They are moving from perpetual to term licensing, which is not good. That is an area they need to improve. On the network monitoring side, if they can have additional features, similar to other solutions like QRadar. They need to add a feature similar to network behavior analytics. If Splunk is able to add some of those features then the solution will be like perfect. I think they could have a built-in user behavior analytics engine, and more advanced artificial intelligence features as well. One bad feature on the solution is the network and the behavior of anomaly detection. Their machine learning is good, but I think they can improve on that as well. They should work to add more built-in correlation searches and more use cases based on worldwide customer experiences. They need more ready-made use cases. View full review »
Director5e75
Director of Technology at a insurance company with 10,001+ employees
I'm not that close to the actual hands-on usage to suggest improvements. One thing I would say is that they should continue to expand it on more devices. I would say continue to broaden the horizon where there are limitations now. View full review »
Enterprise677
BS Systems Engineer at a tech services company with 501-1,000 employees
Splunk can improve the UBA. There are occasional bugs, but they're not so much of an issue. We can definitely improve the features, but it depends on the customer's needs. We need to modify or create new dashboards that increase the customer's satisfaction and customer's needs. It depends upon the customer. Not all of the pre-defined dashboards are suitable to the customers or the customer needs on the pre-defined dashboard so we can create dashboards that meet the customer needs. View full review »
Infosecspec67
Information Security Specialist at a financial services firm with 201-500 employees
The correlation engine should have persistent and definable rules. Splunk should have more features and options in regards to correlating in real-time. It should have the ability to set more permanent rules. Correlation capabilities in ArcSight are better than in Splunk. View full review »
Securityc88d
Security Operations Center Manager
I would like a bit more flexibility on how to configure it. It is still a little locked down, as compared to some open source offerings. View full review »
ITConsul6a61
IT Consultant at Red Hat
I would love to see more integration with other solutions and the ability to perform some actions straightaway from the dashboard. View full review »
Anton Kudin
CISO at a financial services firm with 201-500 employees
In the future I would like to see simplified statistics and analytical threats, as well as a more user-friendly interface for dashboards. View full review »
Find out what your peers are saying about Splunk, Darktrace, Cisco and others in Intrusion Detection and Prevention Software. Updated: November 2019.
378,809 professionals have used our research since 2012.
Sign Up with Email