This is a review from a consultant not from a final user
Rating: 10 out of 10
November 26, 2022
GC
Vetted Review
1 year of experience
I'm a consultant in Splunk and SOAR implementing for our customers and I'm not a final user. The scope of my Use cases is intervened after an alert from SIEM. I tried to use Phantom, but it was difficult so I did the training about Phantom and now it's more clear.
- Ingestion and analysis of data for security issues
- possibility to perform automaticincident response actions
- itpermits to SOC analysts to investigate and intervene on systems
Cons
- The interface isn't immediate in comprehension, I had to follow a training to understand how it works
- it's expensive: not all the customers can buy it!
- It needs PostgreSQL as DB, I'd like to have all inside Splunk also data.
- Satisfy customers
- Have an integrated solution for our proposal
- Avoid the presence (as much as possible) of external products in security management
We are a Splunk Partner and I know Splunk Phantom, for this reason we usually propose it, but I don't deeply know other competitor products.
1
I'm the only one involved in Phantom Consultancies activities
1
I'm a Splunk Architect, an expert in Enterprise Security and a CISA
- Support SIEM in data analysis
- intervenes on systems after a security incident
- Automate as many as possibile activities
- Complete Splunk ES offering
- Complete Splunk ES offerings
No
- Product Features
- Product Reputation
We're a Splunk Partners and we have a large knowledge about it in our organization, so we preferred to use a fully integrated SOAR product in out projects, the only limitation we encountered in the integrated offer is the high cost of it.
I don't change it!
Im satisfied by this product, We'd propose much more it with a lower price.
Im satisfied by this product, We'd propose much more it with a lower price.
- Implemented in-house
Yes
Analysis and requirements definition
Design,
Installation,
Configuration
Tuning
Design,
Installation,
Configuration
Tuning
Change management was a minor issue with the implementation
It need a well done role definition to maintain a complete control on all the activities (manual and automated).
- No relevant issues
- Online training
Always have a development environment to use for testing.
No - we have not done any customization to the interface
No - we have not done any custom code
No additional configurations or customizations
No never, it's expensive!
No
No they didn't
- Playbooks at first
- External Systems access
- Atomated activies configuration
- All without training, non with training
- Maybe installation