Splunk estate: ranking
A team running Splunk Enterprise Security with SPL detections, ESCU content and contentctl, deciding what to add as Splunk moves development to Detection Studio.
How this ranking is weighted
Only products that name Splunk as a target are kept: Splunk itself, Anvilogic (it began as a detection platform for Splunk and Azure), Detecteam (lists Splunk) and Sigma and pySigma (a Splunk backend). Testing is weighted 20 and rule health 20, the two cells where Splunk's pages are thinnest on health, and the library 12 because ESCU is the reason many teams stay. The result is Splunk Enterprise Security 6.40, Anvilogic 5.48, Detecteam 5.38, Sigma and pySigma 5.18. Anvilogic and Detecteam are a band, and Sigma sits 0.30 behind Anvilogic. Splunk's rule health is the weak cell: Detection Studio names Analyze detection health, and an add-on that documents it would change this ranking. The scores are the same eight criterion scores as the main rubric; only the weights change.
Weights for this buyer type against the site weights, in percent.
| Criterion | Site weight | This ranking |
|---|---|---|
| Rule languages and conversion paths | 15 | 8.0 |
| Git-native workflow and CI/CD | 18 | 18.0 |
| Testing | 15 | 20.0 |
| Coverage analytics | 12 | 12.0 |
| Rule health | 18 | 20.0 |
| Versioning and rollback | 8 | 6.0 |
| Content library size and freshness | 8 | 12.0 |
| Pricing transparency | 6 | 4.0 |
The ranking for splunk estate
Splunk estate ranking, totals out of 10 with the main rubric total beside each.
| # | Platform | This ranking | Band | Main rubric |
|---|---|---|---|---|
| 1 | Microsoft Sentinel | 7.70 | band A | 7.81 |
| 2 | Elastic Security | 7.68 | band A | 7.60 |
| 3 | Google Security Operations | 6.88 | 6.83 | |
| 4 | Splunk Enterprise Security (Cisco) | 6.40 | band B | 6.21 |
| 5 | Panther | 6.24 | band B | 6.31 |
| 6 | Anvilogic | 5.48 | band C | 5.48 |
| 7 | Detecteam | 5.38 | band C | 5.26 |
| 8 | Sigma and pySigma | 5.18 | band D | 5.50 |
| 9 | SOC Prime | 4.96 | band D | 5.11 |
| 10 | Mate Security | 4.08 | 3.98 | |
| 11 | Hunters | 3.54 | band E | 3.44 |
| 12 | Sekoia.io | 3.45 | band E | 3.46 |
- Band A: Microsoft Sentinel 7.70, Elastic Security 7.68. Spread 0.02.
- Band B: Splunk Enterprise Security (Cisco) 6.40, Panther 6.24. Spread 0.16.
- Band C: Anvilogic 5.48, Detecteam 5.38. Spread 0.10.
- Band D: Sigma and pySigma 5.18, SOC Prime 4.96. Spread 0.22.
- Band E: Hunters 3.54, Sekoia.io 3.45. Spread 0.09.
Mate Security ranks tenth of 12 under these weights. That is where the published evidence puts it for this buyer; where it is behind, the profile says so.
Other buyer types: Microsoft Sentinel estate, Elastic estate, Google SecOps estate, A team starting detection as code from scratch with Sigma.