SnapAttack (Cisco): scored, not profiled
Cisco announced its intent to acquire SnapAttack on 2024-12-16, and Booz Allen announced on 2025-02-05 that Cisco had completed the deal. Cisco says SnapAttack's capabilities move into Splunk products, and no standalone SnapAttack pages could be read, so the product no longer ships under its own name and this site does not profile it. splunk.com read 2026-11-04
SnapAttack (Cisco) is scored in the dataset and has no profile because acquired by Cisco (completed 2025-01-31 per Splunk); no longer ships under its own name. This note records what the public pages show and where it sits on the rubric.
The dataset still scores it 4.61 on the weighted rubric as a legacy product. Booz Allen's announcement of completion is at intelligencecommunitynews.com, read 2026-11-03.
- Rubric total
- 4.61 of 10, tenth of 14 scored
- Matrix score
- 0.0 of 33 (0 documented, 0 partial, 33 not documented)
- Ownership
- Acquired, Cisco. Cisco announced its intent to acquire SnapAttack on 2024-12-16. Cisco's acquisition page gives completion as 2025-01-31; Booz Allen Hamilton announced on 2025-02-05 that Cisco had completed it. Booz Allen had spun out SnapAttack in 2021 and stayed an investor. Terms were not disclosed. intelligencecommunitynews.com read 2026-11-03
Acquired by Cisco, completed 2025-02-05 (ownership fact supplied by the lead agent; not re-verified here). On 2026-11-03 snapattack.com serves a meta refresh to the Splunk Enterprise Security product page.
What the product is described as
Threat detection and hunting company, spun out of Booz Allen in 2021, offering threat intelligence, attack emulation and detection analytics. Acquired by Cisco in 2025 and folded into Splunk. intelligencecommunitynews.com read 2026-11-03
How SnapAttack (Cisco) scores on the rubric
The score reflects what a reader can find on public pages today, which for a product folded into another company is little. A low score here describes discoverability and not product quality.
SnapAttack (Cisco) on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.
| Criterion | Weight | Score | Status | Reason and source |
|---|---|---|---|---|
| Rule languages and conversion paths | 15 | 5.0 | partial | Cisco's post says SnapAttack's translation technology converts existing SIEM content for Splunk Enterprise Security; languages are not named. vendor claim splunk.com read 2026-11-04 |
| Git-native workflow and CI/CD | 18 | 4.0 | not documented | Post says it can author and manage content teams write themselves; no git or CI detail, and snapattack.com returned nothing readable. splunk.com read 2026-11-04 |
| Testing | 15 | 6.0 | partial | Post says it continuously tests deployed detections (2024 vendor statement, no method). vendor claim splunk.com read 2026-11-04 |
| Coverage analytics | 12 | 7.0 | partial | Post says it maps coverage and flags gaps in priority order (vendor statement, 2024). vendor claim splunk.com read 2026-11-04 |
| Rule health | 18 | 4.0 | not documented | Validation of deployed detections is mentioned; no noisy-rule, drift or performance feature. splunk.com read 2026-11-04 |
| Versioning and rollback | 8 | 3.0 | not documented | Not documented. splunk.com read 2026-11-04 |
| Content library size and freshness | 8 | 4.0 | not documented | The 10,000+ rules figure seen in search summaries could not be confirmed on a vendor page. splunk.com read 2026-11-04 |
| Pricing transparency | 6 | 2.0 | not documented | No current public price; the product is folded into Splunk. splunk.com read 2026-11-04 |
| Total, of 10 | 100 | 4.61 | Sum of the eight parts: 0.75 + 0.72 + 0.90 + 0.84 + 0.72 + 0.24 + 0.32 + 0.12 | |
What the public pages do not show
- Whether the standalone SnapAttack product and Community Edition still exist after the acquisition is not confirmed.
- No pricing and no named customers found.
- snapattack.com direct scrape timed out twice on 2026-11-04; its redirect to a Splunk Enterprise Security page rests on a search result title. No SnapAttack product page was read.
- Detection library size not published on any page read; 2,200 analytics (2022) is stale and the 10,000+ figure seen earlier is unsourced.
- Whether the standalone SnapAttack product and Community Edition still exist is not stated; Cisco's page implies the technology moves into Splunk, and no end-of-sale notice was read.
- No 2025 to 2026 follow-up post from Cisco or Splunk on SnapAttack-derived features was found in search; research.splunk.com lists ESCU content recaps (December 2025) without naming SnapAttack.
- No pricing, no named customers, no analyst mentions, no release notes since 2025-11-01.
Pricing as published for SnapAttack (Cisco)
No pricing. snapattack.com now returns a Splunk Enterprise Security page in search results, and Cisco says SnapAttack technology is being folded into Splunk. No standalone SnapAttack price or sales notice was read. cisco.com read 2026-11-04
Named customers of SnapAttack (Cisco)
No customers are named on the public pages read for SnapAttack (Cisco).
Recent releases and news for SnapAttack (Cisco)
- 2025-02-05 Booz Allen announces Cisco has completed its acquisition of SnapAttack. Booz Allen says it remained an investor in SnapAttack after the 2021 spinout. intelligencecommunitynews.com read 2026-11-03
- 2024-12-16 Cisco intends to acquire threat detection and defense company SnapAttack. Cisco's post on the Splunk blog. Says SnapAttack's detection translation technology will help customers migrate SIEM content to Splunk ES, and that Splunk ES includes ESCU as pre-packaged, regularly updated detection content. splunk.com read 2026-11-03 vendor claim
Claims SnapAttack (Cisco) makes about itself
Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.
Vendor claims with the evidence grade and who measured.
| Claim | Grade | Measured by | Source |
|---|---|---|---|
| Over 2,200 proven detection analytics that can be deployed to other security tools in Community users' environments vendor claim | C | vendor | helpnetsecurity.com read 2026-11-03 |
See the full ranking on the rubric page and the grid on the matrix.