Overview
Splunk Enterprise Security (ES) is the SIEM application built on the Splunk data platform. Cisco completed its acquisition of Splunk on 18 March 2024, saying the deal made it one of the largest software companies in the world[6]. ES is now sold in two editions: Essentials, covering SIEM, threat intelligence, Detection Studio, Exposure Analytics and an AI assistant; and Premier, which adds SOAR, user and entity behaviour analytics (UEBA), automated threat analysis and further AI capabilities[7].
The product’s best-known technique is risk-based alerting, which aggregates low-level observations into risk scores per user or system before raising an alert; Splunk claims this can cut alert volumes by up to 90%[7]. Detection Studio manages the lifecycle of detection rules, and federated search lets analysts query data that has not been ingested into Splunk[7]. Newer agentic AI features handle triage, malware reverse engineering and natural-language rule writing[7].
Cisco reported revenue of US$63.3 billion for its fiscal year ended July 2026[25]. Splunk does not publish ES prices on the product page; each edition is sold by quote[7].
Splunk Enterprise Security features
- Risk-based alerting to reduce alert volume
- Detection Studio for detection lifecycle management
- SOAR and UEBA in the Premier edition
- Federated search across data outside Splunk
- Agentic AI for triage and rule building
- Exposure Analytics for asset and identity context
- Business transaction tracing
- On-premises and SaaS deployment
Splunk Enterprise Security pricing
Quote-based. Two editions, Essentials and Premier; SOAR, UEBA and automated threat analysis require Premier. No list prices are published.
Splunk Enterprise Security strengths and limitations
Strengths
- Very flexible search and correlation through SPL
- Risk-based alerting is a mature approach to alert fatigue
- SOAR and UEBA available in one edition
- Large ecosystem of apps and trained staff
- Strong on-premises option
- Business-transaction model links performance to revenue
Limitations
- No published pricing; widely regarded as expensive at high data volumes
- Premier edition needed for SOAR and UEBA
- Integration roadmap inside Cisco still evolving
- Steep learning curve for SPL
- Annual billing only on published prices
- Older architecture than OpenTelemetry-native tools
Appears in
Splunk Enterprise Security alternatives and competitors
Alternatives to Splunk Enterprise Security: companies ranked in the same lists.
Datadog
Elastic Security
New Relic
IBM Consulting- Grafana
Dynatrace
Microsoft Azure AI Speech- Honeycomb
Sumo Logic Cloud SIEM
Chronosphere (Palo Alto Networks)
Google Cloud Conversational Agents (Dialogflow CX)
Coralogix
Is this your company?
Update the description, logo, image and link through the submission form. Editors review every change.