Splunk Enterprise Security (Cisco)

Splunk Enterprise Security scores 6.21 of 10, fifth of the 12 profiled, in band B with Panther. Content is SPL detections shipped as ESCU and built with contentctl, which tests against attack data in a live Splunk instance. The content library is large and rule health is not documented.

Rubric total

6.21 of 10, fifth of 14 scored, fifth of 12 profiled

Matrix score

13.5 of 33 (10 documented, 7 partial, 16 not documented)

Rule health

1 documented, 1 partial of 5 matrix rule-health columns

Ownership

Part of a larger company, Cisco Systems, Inc.. Cisco completed its acquisition of Splunk on Monday 18 March 2024 at 157 dollars per share in cash. No 2026 rename of Enterprise Security found in one search; the product still appears under the Splunk name. securityweek.com read 2026-11-03

Website

splunk.com

What Splunk Enterprise Security (Cisco) is

Splunk Enterprise Security is Splunk's SIEM, owned by Cisco since the acquisition completed on 2024-03-18 (SecurityWeek, read 2026-11-03). Detections are scheduled correlation searches written in SPL. Detection content ships separately through the Enterprise Security Content Update, or ESCU, and is built with the open contentctl tool.

The repo workflow keeps content as YAML in the security_content layout, with contentctl commands init, new, validate, build and test. The contentctl README says development is moving to Detection Studio and the repo no longer takes pull requests (GitHub, read 2026-11-04). Cisco announced its intent to buy SnapAttack on 2024-12-16, and Splunk's post says SnapAttack technology moves into Splunk products, which is why SnapAttack has no profile here.

Vendor description: Splunk Enterprise Security is Splunk's SIEM for security operations, with risk-based alerting, SPL-based detections, the Security Content library and an AI Assistant. Detection content ships separately through the ES Content Update (ESCU), built with the open contentctl tooling. splunk.com read 2026-11-03 vendor claim

How Splunk Enterprise Security (Cisco) scores on the rubric

6.21 of 10 across eight weighted criteria. It sits in band B with Panther: totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.

Splunk Enterprise Security (Cisco) on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

The 33 capabilities for Splunk Enterprise Security (Cisco)

documentedpartialnot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where Splunk Enterprise Security (Cisco) is strong

• contentctl validates content in a live Splunk instance, and research.splunk.com says each detection is tested against real attack data (vendor claim). github.com read 2026-11-04
• research.splunk.com reports 2,207 detections, 367 analytic stories and 86 playbooks, undated. The newest detection entry seen was dated 2026-10-28. research.splunk.com read 2026-11-04
• Detections carry a status of production, experimental or deprecated in contentctl, and ES documents detection versioning and a review step to deprecate a detection. help.splunk.com read 2026-11-03

Where Splunk Enterprise Security (Cisco) is behind

• The contentctl README says future investment is shifting to Detection Studio and the repo no longer takes pull requests, so the open workflow is in transition. github.com read 2026-11-04
• The Detection Studio page names Analyze detection health but describes no mechanics, and no noisy-rule, search-skipped or drift page could be read. splunk.com read 2026-11-03
• No amounts are published. The pricing page names activity-based, workload or ingest models, and every edition routes to a quote. splunk.com read 2026-11-03

What only Splunk Enterprise Security (Cisco) publishes

Splunk's use case library shows status icons for the sourcetypes and data models each detection search uses, which ties a detection to the health of its data. help.splunk.com read 2026-11-03

Pricing as published for Splunk Enterprise Security (Cisco)

Activity-based, workload or ingest pricing, in cloud or self-managed. Two named editions, Essentials and Premier. No amounts are published; every edition routes to a quote. splunk.com read 2026-11-03

Named customers of Splunk Enterprise Security (Cisco)

Names below are as the source page lists them.

Customers named on public pages. Every name is a vendor claim from the page cited in its row.

Recent releases and news for Splunk Enterprise Security (Cisco)

• 2026-09-15 Cisco delivers trusted AI at scale through new Splunk advancements. Press release on AI features across the Splunk line. splunk.com read 2026-11-03 vendor claim
• 2026-09-14 Cisco and NVIDIA milestone for Splunk AI data. Press release on bringing AI to data held in Splunk. splunk.com read 2026-11-03 vendor claim
• 2026-09-10 ESCU 6.6.0 released: 12 new behavioral analytics and 18 updated. Covers Linux, macOS and Windows; new detections for browser-launched shell execution, LOLBAS network activity, Linux crontab enumeration, macOS AppleScript prompts and Socat listeners. help.splunk.com read 2026-11-03 vendor claim
• 2026-08-27 ESCU 6.5.0 released: 13 new behavioral analytics and two analytic stories. New stories on malicious Python package installation and Vidar Stealer; RoguePlanet story expanded. help.splunk.com read 2026-11-03 vendor claim

Claims Splunk Enterprise Security (Cisco) makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

Shortlist Splunk Enterprise Security (Cisco) when

• You run Splunk and your detections are SPL.
• You want a vendor library with a stated count and a content update you can pin by version.
• You will accept a repo workflow that is moving to Detection Studio, and test with attack data in a live instance.

Verdict on Splunk Enterprise Security (Cisco)

Fifth of 12 at 6.21, in band B with Panther (6.31), carried by the library (9.0) and testing (8.0) and held back by rule health at 3.5.

Compare Splunk Enterprise Security (Cisco)

Alternatives to Splunk Enterprise Security (Cisco). Head-to-head diffs: SOC Prime, Anvilogic, Panther, Sigma and pySigma, Detecteam, Elastic Security, Sekoia.io, Hunters, Google Security Operations, Microsoft Sentinel, Mate Security.