Alphabet’s announcement concerning the inclusion of big-data security into Chronicle led to a 5% drop in the value of Spunk’s shares and sparked a debate on which security information and event management (SIEM) tool supplies better options.

As with many comparisons, a definite answer on which SIEM tool is best is one that comes with many grey areas as each security tool comes with features that excel in diverse ways. To ease your decision-making process while ensuring the comparative analysis used is fair to both industry giants, the following criteria will be used:

Collaboration and Social Business Intelligence: This criterion refers to the capacity of a SIEM tool to collaboratively generate user data across social networks and platforms to receive business insight.

• Cloud Business Intelligence: As more enterprises rely on the cloud, virtual networks, and application to run specific operations, access to cloud BI is an important feature for SIEM tools.
• Mobile Exploration and Authoring: This criterion focuses on the ability to generate and deliver content to mobile devices while taking advantage of the features of mobile devices.
• Analytics, Dashboard and Interactive Visualization: Ease of use for both technical and non-technical individuals is an important consideration for enterprises. This criterion focuses on the interactive support each tool provides.
• Platform Administration: This criterion focuses on the tools both options offer for administration, monitoring, and reporting security incidents.
• Customer Experience: Feedback from security teams that have used both options play a key role as it has hands-on information about the performance of the specified SIEM tool.

Collaboration and Social Business Intelligence

Splunk supports log collection from all types of assets which include devices, networks, supporting security tools, and social media platforms to generate accurate security data and reports. Thus, if you have multiple log sources consisting of related data, Splunk automates the correlation and triangulation needed to make sense out of a multitude of security-related data.

Chronicle offers extensive features for extracting security data from enterprise security telemetry regardless of the data size the enterprise generates. This simplifies the threat hunting and discovery process across collaborative networks for security teams.

Cloud Business Intelligence

Splunk enables security teams to turn operational-wide security intelligence into enterprise activities. The operational-wide security takes into consideration private, public, and hybrid cloud architecture. Splunk’s approach to cloud BI is vendor-neutral and it can be deployed as a SIEM tool across a variety of cloud platforms. Splunk offers an Enterprise Security Product which ensures continuous monitoring while supporting near real-time incident responses for discovered threats. Splunk Enterprise Security solution also provides investigation capabilities and threat intelligence through advanced data analytics and machine learning.

Alphabet’s interest in Chronicle means it’s traditionally a part of Google Cloud and it acts as the SIEM tool for most Google Cloud applications. Chronicle is built on core Google infrastructure which means it offers infinitely scalable storage features for capturing cloud data and evaluating them to receive threat intelligence. The threat detection features Chronicle offers is backed by Google Cloud Security expert teams and their in-house threat intelligence platform VirusTotal. Chronicle is also vendor-neutral and can be deployed within varying cloud architecture.

Mobile Exploration and Authoring

Splunk Mobile is one of the captivating suites of features the SIEM tools offer security teams and enterprises for monitoring and managing security incidents. With Splunk Mobile, both technical and non-technical users have access to a simplified mobile dashboard which eases the process of decision making. Authorized decision makers can take specific actions right from the Splunk Mobile application based on received alerts and reports.

Chronicle offers mobile exploration features and extensive authoring capabilities to security teams. Although there’s no dedicated mobile app, Chronicle supports authoring for individual devices and leverages the cloud to ensure reports can be accessed and actions taken using authorized devices from any location. Splunk has been in the SIEM game decades before Chronicle’s entrance but the recent release of Chronicle’s Back Story shows that consumers should expect more mobile exploration features soon.

Analytics, Dashboard, and Interactive Visualization

Like most Google-backed initiatives, Chronicle attempts to ease the process analytics and threat intelligence through automation. The automated analytics incentives Chronicle offers include automatic threat detection and analysis using its VirusTotal tool and an analytical engine to discover both known and unknown threats. The SIEM tool also relies on Uppercase, a threat signal solution that provides built-in threat signals with every discovery. Chronicle offers an interactive dashboard which can be customized to showcase the results of its automated analytics and provide insight into security incidents.

Splunk also provides a customizable dashboard and makes use of features such as asset investigator, statistical analysis powered by Splunk Enterprise Security, visual anomaly detection, and protocol intelligence for its analytics. Where visualization and interaction are concerned, Splunk offers a Natural Language Platform which allows security teams to analyze collected data through voice searches. Splunk also offers visualization options such as the Splunk Mobile and Splunk TV to provide security teams with diverse ways of accessing security data.

Chronicle’s automated analytics is a feature that many enterprises with non-technical experience consider as an important criterion when choosing a SIEM tool. Splunk’s multiple visualization options and customizable dashboards are selling points for its SIEM offerings. Thus, both SIEM options do excellent jobs with analytics and visualization.

Platform Administration

Chronicle is basically a plug and play SIEM solution for enterprises looking to get started with securing endpoints without the need for any technical knowledge. Chronicle helps security teams connect the dots to a security incident and discover related activities without having to take any actions. The entire solution is turnkey, and its functions require no management from you.

Splunk requires some configuration and setup to determine administrative responsibilities and security actions. Many security teams believe the configuration flexibility Splunk offers helps with customizing threat detection and response strategies. The process of creating a dashboard is quite user-friendly but a learning curve exists for customizing dashboards.

Customer Experience

Feedback from end-users of both SIEM tools highlight their impact on discovering threats in enterprise IT infrastructure. The positive feedback for Chronicle generally focuses on the ease of use it offers and its ability to automate threat detection and incident response. The affordable subscription rates associated with chronicle is also a plus for many end-users. In terms of negative feedback, the limited visualization options Chronicle offers have proven to be a challenge for security teams.

Positive feedback on Splunk is centered around its extensible features and threat detection and incident response capabilities. The negative feedback concerning Splunk focuses on the difficulties with configuration and the cost of using the services it offers. In conclusion, Splunk still offers more SIEM features and capabilities compared to Chronicle while Chronicle is easier to use and more affordable for enterprises looking for a best-in-class SIEM tool to enhance security strategies.

Which is best for your organization?

Decisions on which cloud SIEM works for your organization is rarely made in a vacuum. If you are looking for experienced engineers, make sure to contact Lumifi for a no-cost consultation.

Our MDR offerings go hand-in-hand with SIEM offerings and are compatible with both Splunk and Chronicle.

Contact us today