Splunk for SIEM

[acisac]

I've been reading through some documents and its a bit confusing with the way Splunk brands their products:

I am looking to test Splunk as a SIEM, how can I do this? Is there a difference between Splunk Security Essentials and Splunk Enterprise Security?

[livehybrid]

Hi @acisac 

Yes, Splunk Security Essentials (SSE) and Splunk Enterprise Security (ES) are very different products:

Splunk Enterprise Security (ES) is a licensed premium app with two-tiers of functionality (and cost), its Splunk's full SIEM solution and operates on top of Splunk Enterprise or Splunk Cloud. it provides notable events, risk-based alerting, incident review, threat intelligence framework and assets & identity frameworks.

You can start a trial of it at https://www.splunk.com/en_us/form/enterprise-security-tour.html

On the otherhand, Splunk Security Essentials (SSE) is a free app available on Splunkbase which provides a library of security use cases, detection searches, and guidance mapped to frameworks like MITRE ATT&CK. Its pretty good at helping you understand what detections you could build and what data sources you need however it is not a SIEM itself.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[acisac]

Thanks for the response.

Can Splunk Enterprise be manually setup to mimic what is offered in the premium app (Enterprise Security)? Is the Enterprise Security app basically preconfigured for SIEM functionality or does it offer functionality that is not available under regular Splunk Enterprise?

[PickleRick]

As @isoutamo said - strictly theoretically, you could take bare Splunk Enterprise and with some clever scripting add the missing functionalities (like risk management, asset/user tracking, keeping track of notables and so on). But you'd probably end up using more resources to build such solution (not to mention having to maintain it on your own) than the price of the ES.

[isoutamo]

In theory one can do it, but in reality it’s so big work that it’s much easier to buy ES and use it.

One option between these two is use InfoSec app. Even it’s not real SIEM, you can still use it for monitoring. But if you really need to run SOC with SIEM, the ES is for you.

[isoutamo]

Hi

this totally depends what kind of experience and knowledge you have about SIEM and SOC and of course splunk too. If you know throws enough well then you can request PoC / sales trial license from Splunk directly or via your local partner. Another option is find local partner to help you to put this up for testing.

ES is Splunk’s full scale SIEM, of top SIEM currently available in market.

Security Essential is not a SIEM, but you could use it helping to build your own SIEM.

I propose that you contact to your local Splunk partner which can present those to you and see what you are needing. You found those via partner locator in splunk.com