Splunk Enterprise Security is a platform for threat detection, investigation and response, aimed at security teams. According to Splunk, it combines SIEM, SOAR and UEBA (user and entity behaviour analytics) with threat intelligence, automated threat analysis, exposure analytics and AI features. Organisations use it to collect and correlate security data, detect incidents, and run investigations and automated response. It is offered as a premium solution on top of Splunk Cloud Platform, Splunk's managed cloud service.
Splunk is a US company. Cisco completed its acquisition on 18 March 2024, so the product now belongs to another US company. Providers headquartered in the United States are subject to the US CLOUD Act, which can reach data they hold even when it is stored elsewhere. The product is proprietary and not open source. Security logs often contain personal data and details of an organisation's own infrastructure, so a European organisation should settle contractually where the data is processed, which sub-processors are involved and who controls the encryption keys.