Splunk enterprise is a SIEM software developed by the Splunk cooperation. Splunk has two different versions; Splunk enterprise is a locally installed software, and the other is the Splunk cloud service which is nearly identical to the enterprise version, just cloud-based. Splunk gathers data from a number of different sources including security controls, operation system, and applications. It uses this data and performs analysis to identity activity or operation that violates your security policies or is deemed suspicious. Once Splunk identifies suspicious or unwanted activity, it can send an alert to the operator or try and stop the attack itself before the attack is completed, depending on how it is configured.
Splunk enterprise includes all the basic SIEM capabilities with the added benefit of add-ons and apps. The add-ons and apps fall into six categories, they are, DevOps, IT Operations, Security Fraud...
