What SIEM features does Splunk provide?

Splunk can import data from any device or system if it is converted into text, and can be searched and analyzed.

There are two ways to use Splunk as a SIEM: create detection rules only with Splunk and use it as a SIEM, or implement a paid add-on called Enterprise Security with correlation rules and use it as a SIEM.

Dedicated Apps Developed for Security

By combining Enterprise Security, which is a paid App developed for SIEM, and free Apps for individual devices, it is possible to utilize Splunk according to the customer's environment and usage.

What is your track record as a SIEM function?

Why Splunk is rated as a "SIEM" feature so much even though it's not a security product

SIEMs

• Security-specific correlation analysis and alert rules
• Supports logs from many security devices
• Rich report templates
• Prioritize the importance of alerts from security devices
• A ticketing system that allocates responsibility for investigations and shares investigation status

Task

• Unsupported data source, schema definition
• Search function for problem identification, analysis speed, scalability

Splunk's solution

• Realize data collection, storage, search, and alerts in one product
• 高いスケーラビリティ (200TB/日)
• Runs on common hardware
• The same data can be used for purposes other than security, high ROI results
• Any data can be imported as long as it is text
• Strengths in high-speed search and data extraction
• Statistical analysis using past data

	Common SIEM products	Splunk ES
Correlation analysis	Rule base (known/predefined patterns)	Rule-based Statistics-based (unknown, suspect)
Correlation analysis processing	real time	Real-time query (ad-hoc on-the-fly)
Correlation based	rule base	statistics base
Use scene	SOC operation (escalation workflow)	SOC Analyst, Postmortem device/application administrator
implementation and cost advantage of scale	Compatible with various devices and rules Limited by software/appliance model (event volume/hardware specs) Large-scale, regular maintenance costs	Data format and device independent No software restrictions (commodity hardware expansion) Build quickly Supports on-demand maintenance (customization)
architecture	Traditional SIEM architecture	Splunk architecture

045-476-2010
月～金 8：45～17：30

inquiry
Please feel free to contact us

Free seminar
Click here for various seminars

Document download
Click here for various materials