Splunk

SIEM systems such as Splunk, Microsoft Sentinel, and IBM QRadar are responsible for aggregating security events from multiple sources, performing correlation analysis, and generating alerts.

ServiceNow's AI Agent and Splunk's intelligent operations capabilities are concrete implementations at the AI orchestration layer, attempting to take over more decision-making authority.

Platforms such as Splunk and Datadog are also exploring similar natural language security query capabilities, letting operations and security personnel complete queries and analysis in a conversational manner.

Third-party log aggregation services such as Datadog, Splunk, and Elastic Stack store log data in the cloud.

Established players such as Splunk, Dynatrace, and PagerDuty have all integrated AIOps capabilities into their products.

Early representative SOAR products include Phantom (later acquired by Splunk), Demisto (later acquired by Palo Alto Networks and renamed XSOAR), and Swimlane.

The traditional machine data processing path typically involves using self-hosted solutions such as Elasticsearch/Splunk (requiring management of index sharding and scaling), or sampling and discarding some data to reduce costs.

Splunk is known for its steep data-volume-based pricing, with annual licensing costs for large enterprises reaching millions of dollars.

osquery typically writes results to local log files, which are then forwarded by log collection agents such as Filebeat and Fluentd to SIEM/data lakes such as Elasticsearch, Splunk, or AWS S3.

The observability toolstack for hyperscale platforms typically includes OpenTelemetry for distributed tracing, Prometheus for time-series metrics storage, and ELK Stack or Splunk for log aggregation

Splunk was acquired by Cisco for $28 billion in 2023.