Splunk Enterprise Security (Cisco)

Splunk Enterprise Security, now operating under Cisco following Cisco's acquisition of Splunk in March 2025, is the longest-running dedicated SIEM platform in this review. The Splunk Platform was founded in 2003. Enterprise Security (the security-specific analytics layer) reached general availability in 2013. The platform has been the default enterprise SIEM for over a decade. The Cisco acquisition positions Splunk as the data and analytics layer within Cisco's broader security and networking portfolio, alongside Cisco Secure (the former Splunk-led security operations rebrand), Cisco ThousandEyes, Cisco Secure Firewall, and the Cisco AI security portfolio.

The strategic context: Cisco is a network infrastructure company. Security is a growth vector. The Splunk acquisition gives Cisco the data analytics and SIEM layer that it did not previously have. The long-term strategy is convergence: Cisco network security (firewalls, switches, SD-WAN) + Splunk analytics (SIEM, SOAR, UEBA) + Cisco AI (threat detection, automation) into a unified security operations platform. The same convergence pattern Palo Alto Networks is executing with PAN-OS + Prisma + Cortex, but with Cisco's broader network infrastructure footprint.

For a CISO evaluating Splunk ES, the platform is the most mature SIEM in this review. The AppExchange ecosystem (3,000+ apps), the Common Information Model (CIM™), the Search Processing Language (SPL), and the ES Content Update library are the deepest and most refined in the industry. The SOAR platform (formerly Phantom, now Splunk SOAR) is mature. The ML Toolkit is functional. The detection rule library is the largest.

The offsetting considerations: the Cisco acquisition introduces organizational uncertainty. The Splunk brand, the Splunk culture, and the Splunk product roadmap are now within Cisco's portfolio. A CISO signing a 5-year contract should assess the strategic commitment to the Splunk security vertical within Cisco's broader portfolio. The platform is mature. The question is the trajectory.

The on-prem deployment model is being deprecated for new enterprise contracts. Splunk Cloud and Splunk Platform (consumption-based) are the forward path. Organizations running legacy on-prem Splunk face a migration decision, accelerated by the Cisco acquisition and the industry-wide shift to SaaS.

| UEBA & Behavioral Analytics | ML Toolkit: anomaly detection, clustering, behavioral baselining. Identity threat monitoring. | Functional. The ML Toolkit is a library of pre-built models, not a fully autonomous UEBA engine. Less automated than Securonix or Exabeam. More customizable than most. | | SOAR & Automation | Splunk SOAR (formerly Phantom): visual and code-based playbooks, 1,500+ pre-built playbooks, ITSM integration, automated containment. | Among the deepest SOAR engines in this review. The 1,500+ playbook library is the largest. Code-based (Python) playbook authoring is the most flexible. | | Compliance & Reporting | Pre-built: PCI-DSS, HIPAA, SOC 2, NIST, GDPR, ISO 27001. | Mature. The compliance reporting is among the most refined in this review. | | Cloud & Identity Security | Cloud Observability add-on, identity threat monitoring, SaaS app monitoring. | Functional. Not as deeply integrated as Sentinel (Microsoft-native), Chronicle (GCP-native), or XSIAM (Palo Alto-native). | | Query Language | SPL (Search Processing Language). | The most expressive query language in this review. Steeper learning curve than SQL, KQL, or ESQL. The depth is unmatched for complex forensic queries. | | Ecosystem | 3,000+ AppExchange apps. CIM™. ES Content Update. ML Toolkit. ITSI. | The broadest and deepest ecosystem in this review. |

Top 10 per category. † marks Splunk-specific strengths.

Identity & Access Control Events

1. Login success and login failure (Entra ID, Okta, Ping, SAML/OIDC)
2. Account lockout, MFA push rejection, or FIDO2® authentication bypass
3. Password change, reset, and password policy violation
4. Role, permission, or group assignment and revocation
5. Privileged service account activation or JIT access grant without change-management ticket
6. OAuth 2.0 or SAML token creation, refresh, scope expansion, or anomaly
7. Conditional access policy evaluation, enforcement, or bypass
8. MFA registration, re-registration, recovery code reset
9. Privileged session initiation via PAM, jumphost, or bastion
10. † ES Risk-Based Alerting: cumulative risk score elevation across multiple identity events (login failure + MFA bypass + privilege change) within a 5-minute window

File, Application & Cloud Storage Access Events

1. File or folder creation, modification, rename, or deletion
2. API key creation, rotation, scope expansion, or expiration
3. Cloud bucket or container policy change
4. Database query execution on restricted tables; DLP block
5. Privileged session initiation (PAM, jumphost, DBA tool)
6. Object storage access by an identity with no prior access history
7. Mass file download or API bulk-read exceeding baseline
8. Container image pull from non-approved registry; K8s RBAC change
9. Git repository permission elevation or secret key commit
10. † CIM-mapped file event correlation: file creation on endpoint (CIM: File) + network access to that file (CIM: Network) + exfiltration to external domain (CIM: DNS) in a single SPL correlation search, with risk score elevation if all three events reference the same file hash within 10 minutes

Network Flow Records

1. Source/destination IP, port, protocol, duration, bytes transferred
2. DNS query and response: domain, TTL, response time, NXDOMAIN frequency
3. TLS handshake: cipher suite, certificate validity, handshake failure, protocol downgrade
4. HTTP transaction: method, URI path, status code, content-type
5. NetFlow/IPFIX/sFlow from routers, switches, SD-WAN
6. DNS tunneling indicators: high subdomain entropy, long query strings
7. Connection to non-standard TLS ports from internal hosts
8. Multi-connection fan-out (botnet, DDoS staging)
9. Cross-AZ or cross-region data transfer exceeding baseline
10. † SPL correlation: NetFlow session to a C2 domain (CIM: DNS) + subsequent SMB connection from that host to a file share (CIM: Network) + process execution on the target host (CIM: Endpoint), all within a 5-minute window, producing a single lateral movement risk score event

Endpoint, Email & Gateway Threat Events

1. Executable or file hash detection and block by EDR (CrowdStrike, SentinelOne, Defender, ClamAV)
2. Macro-enabled document via email; sandbox detonation
3. Payload download or C2 beacon from known-bad domain (threat intel feed)
4. Fileless or memory-only execution: PowerShell, WMI, .NET injection
5. Sandbox or EML attachment rejection with telemetry capture
6. New or modified scheduled task, cron job, or service on endpoint
7. Unauthorized SUID binary creation, /etc/passwd modification, kernel module load
8. Registry modification: Run/RunOnce, IFEO, WMI persistence
9. Email gateway: SPF/DKIM/DMARC failure, malicious URL, attachment MIME mismatch
10. † Splunk App for Microsoft Sentinel: M365 DLP policy breach + SharePoint external sharing + user sign-in from new geography, correlated in a single ES correlation search with risk score elevation

Exploit & Attack Pattern Events

1. Buffer overflow or stack smash attempt (EDR syscall monitoring)
2. SQL injection or XSS in WAF logs (CRS 4.25 rule hit, rule ID 942100+ or 941100+)
3. Exploit kit landing page hit + payload delivery
4. RCE via known CVE (CVE-to-asset mapping, patch status via vulnerability scanner)
5. Lateral movement via SMB, WMI, PSExec, RDP
6. Cloud metadata service access (169.254.169.254) from container
7. IAM privilege escalation chain
8. Container escape
9. DNS-based data exfiltration
10. † ES Risk-Based Alerting: phishing email (M365) + credential theft (Entra ID) + lateral movement (SMB/WMI) + data staging (S3/SharePoint) + exfiltration (DNS/HTTPS), all correlated in a single RBA risk score event across five data sources

Behavioral & UEBA Anomaly Alerts

1. Impossible travel
2. Egress volume spike exceeding 3σ baseline
3. Off-hours access to PII or privileged infrastructure
4. Privilege escalation without ITSM ticket
5. Service account interactive session
6. New API consumer or OAuth app by a first-time user
7. IAM role assumption by a first-time identity
8. Authentication method change
9. Data access breadth expansion
10. † ML Toolkit: user behavioral baseline deviation across login time, login location, application usage pattern, and data access pattern simultaneously, producing a composite anomaly score higher than any single-factor deviation

Source Collectors. The Universal Forwarder (UF) is the lightweight agent for log forwarding. The Heavy Forwarder performs parsing, transformation, and indexing at the source. The HTTP Event Collector (HEC) accepts structured log events over HTTPS without a forwarder. Third-party sources connect via syslog, Kafka, S3/GCS/Azure Blob, or the 3,000+ AppExchange add-ons. No SNARE® or other third-party central forwarder is required.

Agent-Level Filtering. The UF and HEC support source-side filtering via props.conf (sourcetype-level configuration), transforms.conf (field extraction and routing rules), and HEC payload include/exclude filters. Administrators can exclude specific Event IDs, log levels, source paths, and application names before data leaves the host. In practice, Windows Event Log channels are scoped to Security, System, and Application. Linux syslog is scoped to auth, authpriv, kernel, and daemon. Debug noise is dropped.

Deduplication Strategy. No pre-ingest semantic or string-based deduplication. The SPL dedup command and stats by aggregations manage high-frequency events during search, not during ingest. ES correlation searches use threshold-based rules that track rapid successive events without dropping raw telemetry. A brute-force attack (500 login failures in 90 seconds) is not deduplicated. It is correlated, risk-scored, and alerted. The ML Toolkit baselines benign high-frequency patterns (batch jobs, health checks, sync processes) and deprioritizes them without altering stored data.

Storage and Compute. Historically, the Splunk Platform ran on indexer clusters, search head clusters, and KV stores. The modern architecture (Splunk Cloud, Splunk Platform consumption model) uses cloud object storage (S3, Azure Blob, GCS) with independent search compute scaling. In managed deployments, there is no manual shard tuning or indexer licensing. The search head cluster auto-scales. Retention is governed by index lifecycle policies (hot, warm, cold, frozen) that are auto-managed in Splunk Cloud.

Scale: >10K EPS. The UF and HEC handle high-velocity ingestion with async batching, TLS multiplexing, and compression. The Splunk Cloud backend auto-scales search compute independently of ingest velocity. At enterprise scale (10K–1M+ EPS), the ingestion pipeline is not the bottleneck. The bottleneck is the $/GB invoice and the search head cluster sizing for concurrent analyst queries.

Failure Modes. The primary operational risk at scale is not throughput. It is the AppExchange ecosystem governance. 3,000+ add-ons, each with its own parser, its own field naming, its own props.conf and transforms.conf configuration, create a combinatorial configuration space that is difficult to govern. A misconfigured add-on (a parser that swallows fields, a transform that routes to the wrong index) can produce silent detection gaps that are difficult to diagnose. The secondary risk is the SPL learning curve: the query language is the most expressive in this review, but it is also the most verbose and the most error-prone for analysts without dedicated training. A single misplaced pipe or a missing | produces a query that runs but returns wrong results, and the analyst does not know the results are wrong until the investigation is complete.

Parser Framework. Dynamic field extraction via regex, DELIMS (delimiter-based), XML/JSON parsing, KV (key-value) extraction, and REPORT (conditional field mapping). The ES Content Update library provides automated parser upgrades for supported log sources. The 3,000+ AppExchange add-ons provide vendor-specific parsers. In practice, the parser is configured per sourcetype in props.conf. The log source determines the format. The parser adapts to it.

Normalization Engine. Translates vendor-specific fields into the Common Information Model (CIM™) standard fields: host, src, dest, user, eventtype, severity, action, status. CIM is the industry-standard mapping framework that Splunk defined and that is now widely adopted. Network flows normalize to connection metadata. Device events retain security outcomes. Identity and cloud logs preserve session and context attributes. The CIM mapping is the deepest and most refined in this review because it is the standard that the other platforms map to, not the other way around.

Schema Model. CIM is the primary schema. OCSF mapping is supported via AppExchange transforms. Custom field mappings via props.conf, transforms.conf, and lookup files. In a multi-tool SOC, CIM is the common denominator. Datadog, Sentinel, and Securonix all support CIM mapping to varying degrees. Splunk is the origin. This is a genuine standardization advantage for organizations that have invested in CIM compliance.

Field Aliasing. Fully supported via macros (SPL macro definitions), lookup tables (CSV/DB-backed field mapping), and rename/eval commands in SPL. src_ip → src, uid → user, bytes_in/out → data_volume. The aliasing is search-time, not ingest-time. The raw field names are preserved in the index. The alias is applied in the SPL query.

Query Language. SPL (Search Processing Language). The most expressive query language in this review. Supports full-text search, field filtering, | stats, | transaction, | streamstats, | join, | append, subsearches, and recursive patterns. A forensic query that joins five data sources, applies conditional logic, computes a rolling anomaly score, and outputs a structured event is a single SPL pipeline. The same query in KQL is longer. In Datadog's log search syntax, it requires multiple saved searches and manual joining. In Securonix's SQL-like syntax, it is possible but less natural.

The learning curve is the steepest in this review. An analyst with SQL experience needs 4–6 weeks to become productive in SPL. An analyst with no data query experience needs 8–12 weeks. The depth is unmatched. The cost is time. In a SOC that needs analysts productive in week one, SPL is a friction point. In a SOC with senior analysts doing complex forensic investigations, SPL is the tool.

Hunting Workflows. ES correlation searches, ML Toolkit anomaly detection, Timeline visualizer, Entity inspector, risk-based alerting views. The hunting model is analyst-led, with the ES Content Update library providing pre-built correlation searches as starting points. The MITRE ATT&CK® Navigator integration maps detections to TTPs. The Investigation Workbench (introduced in recent ES releases) provides a structured investigation canvas.

Dashboard Builder. Drag-and-drop, role-based templates, real-time streaming, alert-linked auto-refresh. The dashboard ecosystem is mature. The ES dashboard library is the largest out-of-box in this review.

BI and Reporting. REST API export, CSV/JSON payloads, scheduled PDF/email reports, Splunk Dashboard Studio, Power BI and Tableau® connectors via the Splunk REST API or Splunk-to-warehouse pipelines. For a CISO presenting to the board, the compliance reporting is among the most refined in this review.

Where Detection Comes From. The same architectural reality as every other platform. WAF detection is CRS 4.25 or vendor-proprietary (Palo Alto, F5, A10). Endpoint detection is the EDR agent (CrowdStrike, SentinelOne, Defender, Falco, Wazuh FIM). Identity detection is pattern-matching against expected behavior plus ML anomaly scoring. The ES Content Update library provides the correlation logic that ties multi-source events into a single risk score.

The ES Content Update library is the largest out-of-box detection content in this review. It is continuously updated by Splunk's security research team. It covers phishing, credential theft, lateral movement, ransomware precursors, cloud identity abuse, DNS tunneling, C2 communication, and fileless execution. Each correlation search is a SPL pipeline that joins multiple data sources, applies conditional logic, and produces a risk score event. The depth is the advantage. The maintenance burden (updating, tuning, and validating hundreds of correlation searches) is the cost.

SOAR Depth. Splunk SOAR (formerly Phantom) is among the deepest SOAR engines in this review. The 1,500+ pre-built playbook library is the largest. Playbooks can be visual (drag-and-drop) or code-based (Python). The code-based authoring is the most flexible: a playbook can execute arbitrary Python, call any REST API, manipulate data structures, and branch on any condition. For a SOC that needs to build custom automation that no visual playbook editor can express, the code-based authoring is the differentiator.

The SOAR integrates natively with the ES correlation engine: a risk score event triggers a SOAR playbook, which executes containment actions, enriches the event, updates the case, and notifies the ITSM system. The integration is tighter than a SOAR calling a SIEM via REST API.

Pricing Model. The legacy model was per-GB/day indexed licensing with separate forwarder and user licenses. The modern model (Splunk Cloud, Splunk Platform consumption) is consumption-based: log ingestion ($/GB), retention (hot/warm/cold tiers), user seats (Light/Heavy/Flexible), and ES Content Update + SOAR module licensing. The Cisco acquisition may change the pricing structure. Verify the current pricing model with Cisco/Splunk before building a TCO model.

Estimated Monthly Platform Costs. Projections. Actual pricing requires a Cisco/Splunk quote.

Effective per-GB: ~$3.00–$4.50 at enterprise tiers. Retention adds $0.10–$0.18/GB/month (hot). User licenses: $15–$40/user/month depending on tier. SOAR and ES Content Update are module add-ons.

Search Economics. Unlimited within retained volume. No per-query, per-result-set, or per-GB-scanned fees. Compute auto-scales in Splunk Cloud. In self-managed deployments, search head cluster sizing determines concurrent query capacity.

Storage Tiers

User Seats. Light (viewer, $15–$25/user/month), Heavy (analyst, $30–$40/user/month), Flexible (admin, premium). Billed monthly. Enterprise bundles at ingestion tiers.

Volume Scaling. Multi-year commitments. Volume discounts at enterprise tiers. Cisco bundling (Splunk + Cisco Secure + Cisco networking) may reduce per-component cost.

SaaS (Splunk Cloud) or self-managed. Regional data residency: US, EU, APAC. AWS, Azure, GCP connectors. On-prem via UF/HEC. SOC 2 Type II, ISO 27001, FedRAMP Moderate (via authorized partner — verify), GDPR/CCPA, HIPAA, PCI-DSS.

3,000+ AppExchange apps. CIM™. ES Content Update. ML Toolkit. Splunk SOAR (1,500+ playbooks). ITSI. REST API. Power BI, Tableau®. Azure Marketplace, AWS Marketplace, GCP Marketplace. Professional services: Cisco/Splunk architecture reviews, managed detection, SOC runbook development.

The ecosystem is the broadest and deepest in this review. The AppExchange is the largest SIEM-specific marketplace. The CIM standard is the industry reference. The ES Content Update library is the largest out-of-box detection content. The SOAR playbook library is the largest.

The open-source detection layer (Falco, Wazuh, Lynis, CrowdSec, Coraza/CRS, ClamAV, Chkrootkit) is not natively integrated. Alerts are forwarded via syslog, HEC, or AppExchange add-ons.

Named Enterprise Customers (Splunk-Specific, Primary SIEM):

• Comcast
• Capital One
• Ford Motor Company
• Visa
• The Walt Disney Company
• Warner Bros. Discovery
• Mastercard
• Adobe
• Intuit
• Salesforce
• Atlassian
• Discord
• Shopify
• DoorDash
• Uber

Public customer lists are restricted by NDA. A significant portion of these organizations have used Splunk as their primary SIEM for 5+ years. The Cisco acquisition does not change the existing deployment base, but it changes the vendor, the support structure, and the long-term product roadmap. Order does not indicate deployment scale.

MSSP Note. Excluded per standardized format.

Analyst Positioning. Splunk ES is the incumbent leader in Gartner's SIEM market guide. The Cisco acquisition introduces a new variable: the platform is now within Cisco's portfolio. Analyst coverage is being revised. The platform's technical maturity is unchanged. The strategic trajectory is in question.

Where Splunk Competes Effectively:

• Ecosystem depth. 3,000+ AppExchange apps, the largest SOAR playbook library, the largest ES Content Update detection library, and the CIM standard. No other platform in this review matches the breadth of the ecosystem.
• SPL expressiveness. The most powerful query language in this review. For complex forensic investigations that require multi-source joins, conditional logic, and statistical computation in a single pipeline, SPL is unmatched.
• SOAR depth. Splunk SOAR's code-based (Python) playbook authoring is the most flexible in this review. For a SOC that needs to build custom automation beyond what a visual editor can express, this is the differentiator.
• Track record. 20+ years of continuous development. The platform is the most battle-tested in this review. The detection content, the SOAR playbooks, and the compliance reporting have been refined over two decades of enterprise deployment.
• CIM standardization. For organizations that have standardized on CIM across multiple tools, Splunk is the origin. The mapping is native, not a transform.

Where Splunk Is at a Disadvantage or Requires Diligence:

• Cisco acquisition uncertainty. The Splunk brand, culture, and product roadmap are now within Cisco's portfolio. A CISO signing a 5-year contract should assess the strategic commitment to the Splunk security vertical within Cisco's broader portfolio. The question is not "is the platform good?" The question is "will the platform receive the same R&D investment in year 3 under Cisco as it did in year 3 under independent Splunk?"
• SPL learning curve. The steepest in this review. 4–12 weeks for analyst productivity depending on background. In a SOC that needs analysts productive in week one, this is a friction point.
• Pricing complexity. The consumption model, the module licensing, the retention tiers, and the Cisco bundling create a TCO model that is difficult to predict. A CISO should require a 3-year TCO model with explicit line items for ingestion, retention, seats, SOAR, ES Content Update, and support before signing.
• On-prem deprecation. Legacy on-prem deployments face a migration decision. The migration is not a lift-and-shift. It is an architectural change: from indexer clusters to cloud object storage, from forwarder licensing to consumption-based pricing, from self-managed scaling to SaaS auto-scaling. The operational change is significant.
• AppExchange governance. 3,000+ add-ons create a combinatorial configuration space. A misconfigured add-on can produce silent detection gaps. The governance burden of maintaining, updating, and validating the add-on ecosystem is a real operational cost.
• Cost at scale. At 3 TB/day, the total monthly cost (ingestion + retention + seats + SOAR + ES Content Update) is at the higher end of this review. The Cisco bundling may reduce the cost, but the bundling also increases the total commitment to the Cisco ecosystem.

Splunk Enterprise Security is the most mature and most deeply ecosystem-supported SIEM in this review. The AppExchange, the CIM standard, the ES Content Update library, the SPL query language, and the Splunk SOAR playbook library are the deepest and most refined in the industry. For a SOC with senior analysts doing complex forensic investigations, the platform is the tool.

The Cisco acquisition introduces a strategic variable that did not exist in previous evaluation cycles. The platform is technically unchanged. The vendor, the support structure, and the long-term product roadmap are in transition. A CISO signing a 5-year contract should weight this variable. The question is not the platform's current capability. The question is the platform's trajectory under Cisco.

Ideal buyer profile: Enterprise (5,000–50,000 endpoints), high-threat environment, SOC team of 10–100 analysts with senior analysts doing complex forensic investigations, multi-vendor log environment requiring the broadest connector coverage, seeking the deepest detection content and SOAR capability. Ingestion 1–5 TB/day. Existing Splunk investment or Cisco ecosystem alignment.

Key RFP questions for the Splunk/Cisco evaluation:

1. What is the total 3-year TCO including ingestion, hot/warm/cold retention, per-user seats, SOAR, ES Content Update, and support, at the organization's actual volume? Model the Cisco bundling effect explicitly.
2. What is the Cisco acquisition's impact on the Splunk product roadmap? Provide the 2-year roadmap with specific feature commitments and the named product leader for the security vertical.
3. What is the on-prem to Splunk Cloud migration timeline, effort estimate, and rollback procedure? What is the contractual commitment if the migration is not completed within the agreed window?
4. Provide a detection rule count and MITRE ATT&CK® coverage comparison against your top two competitive alternatives.
5. Execute the organization's top-10 incident response scenarios in Splunk SOAR. Identify which require external orchestration.
6. Confirm FedRAMP authorization scope, region, and level. Obtain the authorization letter.
7. Provide the AppExchange governance model: how are add-ons validated, updated, and supported? What is the SLA for an add-on parser defect that causes a detection gap?
8. What is the SPL training and certification path for the SOC team? Estimated time-to-productivity for an analyst transitioning from KQL, ESQL, or SQL?
9. Provide 3–5 referenceable enterprise customers in the organization's industry vertical at comparable scale, post-Cisco-acquisition, with the deployment context.
10. What is the data export and egress cost for a 7-year compliance retention requirement?

Red flags: A TCO model that omits SOAR or ES Content Update licensing. Reluctance to provide the post-Cisco product roadmap. Bundling pressure into the broader Cisco Secure portfolio. If the answer to "how does this platform detect a SQL injection?" is "our AI," push back. The answer is CRS 4.25 in the WAF. The EDR detects the endpoint impact. ES correlates and risk-scores.