Please share with the community what you think needs improvement with Splunk User Behavior Analytics.
What are its weaknesses? What would you like to see changed in a future version?
The correlation engine should have persistent and definable rules. Splunk should have more features and options in regards to correlating in real-time. It should have the ability to set more permanent rules. Correlation capabilities in ArcSight are better than in Splunk.
They can improve the licensing scheme. They are moving from perpetual to term licensing, which is not good. That is an area they need to improve. On the network monitoring side, if they can have additional features, similar to other solutions like QRadar. They need to add a feature similar to network behavior analytics. If Splunk is able to add some of those features then the solution will be like perfect. I think they could have a built-in user behavior analytics engine, and more advanced artificial intelligence features as well. One bad feature on the solution is the network and the behavior of anomaly detection. Their machine learning is good, but I think they can improve on that as well. They should work to add more built-in correlation searches and more use cases based on worldwide customer experiences. They need more ready-made use cases.
In the future I would like to see simplified statistics and analytical threats, as well as a more user-friendly interface for dashboards.
Actually, the most valuable aspect of Splunk is the data. You do not need to use your databases to perform all things from on all the servers we have. Splunk has three big things it can do with data: it can show it hot, warm and cold. The hot of it allows you to see the data as soon as things happen — maybe to the second. We have the warm, the warm will segment the data up to the hot up to three months ago. The cold will store all of the archives of all the data after the six months. After that, you can't make comparisons any further. In the future, we make Splunk in the SOC (Security Operations Center). In the SOC now, we use one feature, it's called the alert system. So in the future, we want to make it so we can send all the data and we can build its security and its management. It will be published in all the places as it is now. We need to do this so we can build more data centers from all the past and existing data crunch.
The solution is much more expensive than relative competitors like ArcSight or LogRhythm. It makes it hard to sell to customers sometimes. I would like to see a better tracking intelligence module with lower costs fully integrated with a user behavior analytics module. It would empower this module with the keys and real-time updates in terms of security.
I'm not that close to the actual hands-on usage to suggest improvements. One thing I would say is that they should continue to expand it on more devices. I would say continue to broaden the horizon where there are limitations now.
The feature set isn't too bad as is. My biggest complaint is the way they do pricing.
I would love to see more integration with other solutions and the ability to perform some actions straightaway from the dashboard.
I would like a bit more flexibility on how to configure it. It is still a little locked down, as compared to some open source offerings.
Splunk can improve the UBA. There are occasional bugs, but they're not so much of an issue. We can definitely improve the features, but it depends on the customer's needs. We need to modify or create new dashboards that increase the customer's satisfaction and customer's needs. It depends upon the customer. Not all of the pre-defined dashboards are suitable to the customers or the customer needs on the pre-defined dashboard so we can create dashboards that meet the customer needs.