topic Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC? in Splunk Enterprise Security

What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 09:38:04 GMT

Hi all,

Can anyone let me know the difference between Splunk Enterprise & Splunk Enterprise Security? Are they both the same?

If so both are different in case, what exactly the functions of each & which one shall I implement in my 24/7/365 monitoring SOC?

Thanks,

Ramu.R

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

p_gurav — Wed, 18 Apr 2018 09:41:31 GMT

Splunk enterprise is platform and splunk enterprise security is licensed application sits on top of splunk. For using enterprise security you need to install splunk first and then import the application.

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

deepashri_123 — Wed, 18 Apr 2018 09:43:05 GMT

Hey@mailmetoramu,

Splunk Enterprise Security is a paid app which is installed on Splunk Enterprise.For implementation purpose you need to contact Splunk with your exact requirement for further guidance.
Refer this link:
https://splunkbase.splunk.com/app/263/
https://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security/features.html

Let me know if this helps!!

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 09:43:53 GMT

So you mean to say, first i should install splunk enterprise in my laptop, get the GUI first.

Then install the splunk enterprise security app from the GUI ??

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 09:48:54 GMT

Already i bought a paid app, so the validity & license of my splunk enterprise will be as same as splunk Enterprise security ??

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

p_gurav — Wed, 18 Apr 2018 09:51:33 GMT

Yes. You can install splunk with free license on your laptop. But for Enterprise security application is a paid application which only works with enterprise license . If required you can contact splunk support.

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

deepashri_123 — Wed, 18 Apr 2018 09:53:06 GMT

Splunk Enterprise Security app license has to be purchased seperately along with Splunk Enterprise and the validity and license you can check in your licensing section on Splunk.

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 09:54:07 GMT

Thats ok, the free version is only for 60 days but i bought splunk enterprise security which is licensed one.

So what will happen to my paid app once my trial period of splunk enterprise expires ??

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

p_gurav — Wed, 18 Apr 2018 09:59:48 GMT

If splunk license expires, It will stop searching that means the app UI is not working. Please contact splunk support or splunk sales, they will guide you with implementation.

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 10:11:12 GMT

Deepashri,

1) Splunk Enterprise - No Enforcement (6.5+)

2) Splunk Enterprise

In above, First one is splunk enterprise 6.5 & second is splunk enterprise security, right ??

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

p_gurav — Wed, 18 Apr 2018 10:15:48 GMT

oops!! sorry no, First one is special key comes with splunk (you can read further overhttps://docs.splunk.com/Documentation/Splunk/latest/Admin/TypesofSplunklicenses#No-enforcement_license ) and second is free license.

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 10:17:44 GMT

So i can download the free version of splunk enterprise 6.5+ versions only ??

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

p_gurav — Wed, 18 Apr 2018 10:19:55 GMT

Yes, and if you want to buy license for both contact splunk sales or support

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

mailmetoramu — Wed, 18 Apr 2018 10:21:28 GMT

Great, Thank You ..!!

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

esix_splunk — Fri, 11 May 2018 09:29:04 GMT

I hope youre not running your 24x7 SOC off your laptop.

If you have a enablement license, as in you have purchased Splunk Enterprise and Enterprise Security, you will need to install the provided license files (that your sales representative sends to you) on your License Master Instance.

Your best place to start is at the documentation for Enterpise Security. Read from here : https://docs.splunk.com/Documentation/ES/5.0.0/Install/InstallEnterpriseSecurity

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

Akashnickyz — Tue, 21 Aug 2018 10:24:01 GMT

Splunk enterprise is the is the platfrom which u have to install in order to install the security enterpricse on top of it ......!!!!!! or else we can just say like its an app from Splunk enterprise wch can be installed for the security purposes which is the paid version always ....!!!!!

Re: What is the difference between Splunk Enterprise & Splunk Enterprise Security and which one shall I implement in my 24/7/365 monitoring SOC?

emuganhwa — Tue, 04 Jun 2019 22:05:49 GMT

Hi, can you drop me a download link for the Enterprise security app?
I have the enterprise license.......just wanna try it out.
email is emuganhwa@gmail.com