Splunk vs Elastic Security for SIEM detections and investigations
Splunk Enterprise Security when the hire is enterprise SIEM/TDIR with Risk-Based Alerting and Essentials/Premier packaging on ingest or SVC capacity. Elastic Security when the hire is SIEM/XDR on the Elastic Stack with public Serverless ingest and retention meters.
A mid-stage SIEM shortlist rarely fails on a missing logo. It fails when the week breaks into four different stages: how much data you can afford to keep searchable, which detections actually fire with owners, how an analyst opens an investigation, and whether response automation is on the same invoice or a second product fight. That is the workflow this page follows.
Splunk Enterprise Security (still sold as Splunk; Cisco completed the Splunk acquisition in March 2024) packages that week as SIEM / TDIR with Risk-Based Alerting, Detection Studio, and ES Essentials vs Premier (SOAR and UEBA land on Premier per Splunk’s purchasing matrix), licensed against Daily Indexing Volume and/or SVC or vCPU capacity with quote-required dollars. Elastic Security packages SIEM and security analytics on the Elastic Stack, with public Serverless Security Analytics Essentials and Complete meters (ingest per GB and retention per GB per month) and optional endpoint protection without a separate per-endpoint tax as of March 23, 2026. Broader SIEM category context sits on SIEM alternatives. This is not a SOAR-only bake-off; automation only changes the decision where Essentials vs Premier or Complete / Workflows packaging moves the invoice.
| Primary use case | Enterprise SIEM / threat detection, investigation, and response (TDIR) on Splunk Cloud Platform or Splunk Enterprise, with Risk-Based Alerting and Detection Studio as the weekly detection desk | SIEM / security analytics (and XDR-shaped endpoint via Elastic Defend) on the Elastic Stack, with prebuilt detections, triage, and hunting in one security project |
|---|---|---|
| How a bad day closes | Notable Event / finding triage under RBA, investigation workspace, Adaptive Response; tickets often land on ingest license headroom, SPL ownership, and whether SOAR playbooks sit on ES Premier | Alert triage in Elastic Security, timeline / case workflows, response actions on Defend where licensed; tickets often land on ingest/retention GB burn, rule exceptions, and Hosted vs Serverless capacity |
| Day-to-day workflow | Onboard sourcetypes, tune RBA risk objects, ship Detection Studio content mapped to MITRE ATT&CK, escalate into Premier SOAR/UEBA when automation and behavior analytics are in scope | Ingest via Elastic Agent / integrations, enable detection rules, investigate in Kibana security workflows, expand to Complete for UEBA / AI Assistant / advanced endpoint response and Workflows |
| Deploy | Splunk Cloud Platform or self-managed Splunk Enterprise; ES as premium security app matching the core license type (ingest volume or infrastructure) | Elastic Cloud Serverless security projects, Elastic Cloud Hosted, or self-managed Elastic Stack; same security product story across those deployment paths |
| License/pricing | Quote-required. Meters: Daily Indexing Volume (GB/day) and/or SVCs (Cloud) / vCPUs (Enterprise) per Splunk Licensed Capacity and ES licensing docs. Editions: ES Essentials vs ES Premier | Serverless public anchors (effective 1 Nov 2025): Essentials ingest as low as $0.09/GB and retention as low as $0.017/GB/month; Complete as low as $0.11/GB ingest and $0.019/GB/month retention. Hosted is resource-based. Per-endpoint fees removed as of 23 Mar 2026 |
| Who operates it | SOC / detection engineering teams already staffed for Splunk SPL, ES content, and capacity forecasting | SOC / platform teams comfortable running Elastic Stack security content (KQL/ES|QL, detection rules) and watching Serverless GB or Hosted resources |
We reviewed Splunk Enterprise Security product and licensing pages, Splunk Licensed Capacity terms, Elastic Security and Serverless Security pricing pages (live 2 Oct 2026), and community threads the same day. We did not run either product in a paid tenant, so this is not a hands-on benchmark.
Splunk
Elastic Security
The audit line in that August 2025 comment is one operator’s opinion about a homegrown stack, not a measured audit result for Splunk or Elastic Security.
Splunk’s recent security packaging signal is Enterprise Security Editions (Essentials vs Premier) with Detection Studio and integrated SOAR/UEBA on Premier, plus Cisco Talos enrichment paths for cloud ES customers. Elastic’s commercial signal for this shortlist is Serverless Security Analytics Essentials/Complete with published ingest and retention GB rates and the March 2026 removal of per-endpoint fees. Neither change turns this page into a SOAR catalog; it still answers who owns SIEM analytics and the investigation desk.
Editions and pricing
Between these two, Splunk keeps ES dollars on a sales quote against capacity meters. Elastic publishes Serverless GB floors you can model before a call, while Hosted and self-managed still need resource or license math.
| Current purchasable packaging (2 Oct 2026) | Splunk Enterprise Security Essentials or Premier on Splunk Cloud Platform or Splunk Enterprise. Cisco owns Splunk; buyers still purchase Splunk-branded ES, not a renamed bare-Cisco SIEM SKU | Elastic Security on Serverless (Security Analytics Essentials / Complete), Elastic Cloud Hosted, or self-managed Elastic Stack subscriptions |
|---|---|---|
| Public dollar anchors | No public list $/GB-day or $/SVC on the ES marketing pages. Security Pricing FAQ confirms ingest (Index Volume/Day), workload (SVC), and predictive options as quote paths | Serverless Essentials: ingest as low as $0.09 per GB; retention as low as $0.017 per GB retained per month. Complete: as low as $0.11 per GB ingest; $0.019 per GB retained per month (rates effective 1 Nov 2025). Egress: 50 GB free, then $0.05 per GB |
| Scoped ingest example | A scoped public dollar example for Splunk Enterprise Security (a named daily GB volume or retention window, with currency, unit, period, and commitment) was not found in this research. Meters stay Daily Indexing Volume and/or SVC or vCPU on a term license, and the security pricing FAQ treats the dollar rate as a quote. | Elastic’s 1 Nov 2025 Serverless packaging note gives a Security Analytics Complete ingest example in USD, per GB, for that month, with no required commitment (monthly pay-as-you-go, or prepaid Elastic Consumption Units). A project ingesting over 10 TB in the month pays $0.60 per GB for the first 50 GB and $0.33 per GB for the next 50 GB, with the published floor as low as $0.11 per GB. The same note does not price the rest of that 10 TB or a retention total for it. Complete retention is published only as low as $0.019 per GB retained per month. Included product is Elastic Security Serverless, Security Analytics Complete, not Observability and not Hosted. |
| What the invoice covers | Core Splunk capacity plus ES premium app. Premier adds SOAR, UEBA, and Automated Threat Analysis per the ES purchasing table. Essentials keeps SIEM / Detection Studio / AI Assistant path without that Premier automation/UEBA bundle | Ingest + retention (and egress) for Serverless security analytics; Complete unlocks entity analytics/UEBA, AI Assistant, advanced endpoint response, and workflow automation options. Optional Cloud Protection and Workflows/Agent Builder have separate meters on the pricing page |
| Billing honesty | Match ES license type to the core platform (volume vs vCPU/SVC). Do not assume Premier SOAR is included on Essentials. Confirm Cisco Enterprise Agreement line items if Splunk rides a broader Cisco security commitment | Serverless bills enriched normalized GB before compression. Hosted bills resources, not the same GB table. Do not compare a Serverless $0.09 floor to a Hosted quote without matching units |
If the team needs a published per-GB model for SIEM analytics on day one, Elastic Serverless is the transparent meter. If the team is already forecasting Splunk daily volume or SVCs and wants ES content and RBA on that platform, Splunk ES is the capacity-aligned hire. Treat every Splunk dollar figure you hear in a deck as quote-required until the order lists GB/day or SVC counts.
How investigations start
| Alert shape | Risk-Based Alerting aggregates risk on objects to cut raw notable volume; analysts open findings in the ES investigation experience | Detection-engine alerts with triage and hunting workflows; Complete adds entity analytics and AI Assistant guided investigation paths |
|---|---|---|
| Query / content language | SPL and ES content (including Detection Studio lifecycle) owned by detection engineers on the Splunk platform | Elastic detection rules (public rules repo lineage), KQL / ES|QL and Kibana security workflows on the shared Elastic data model |
| Context depth | Federated search / data federation options for security use cases; full-fidelity indexed data within licensed volume or workload | Search AI Lake retention model on Serverless; query historical data in place without a separate rehydration product story on Elastic’s security positioning |
| Main buying consideration | Will next quarter’s hard hours be SPL/RBA content and Splunk capacity forecasting? | Will next quarter’s hard hours be Elastic rule tuning and Serverless GB (or Hosted resource) burn? |
Both products hire an investigation desk on top of centralized security telemetry. Between these two, Splunk productizes that desk inside Enterprise Security on the Splunk platform. Elastic productizes it as Elastic Security on the same stack teams already use for search and observability data.
Detection coverage and response
| Migration | A Splunk-published importer for Elastic Security rules was not found in this research. Day-to-day onboarding stays source types and add-ons. Enterprise Security 8 converts existing correlation searches into event-based detections that still emit findings. | Automatic Migration takes a Splunk rules export, translates SPL to ES|QL, and can map a rule to an Elastic prebuilt rule. Rules that still need macros or lookups stay partially translated until those files are uploaded. Installed rules still have to be enabled. The same flow recommends integrations for the data those rules need. |
|---|---|---|
| Parsers | Source types. props.conf (or Splunk Web on Cloud) sets event breaking, timestamps, and field extraction. Indexers need that source-type definition before the stream parses cleanly. | Integrations ship ingest pipelines that parse and map events before indexing. Automatic Import for a custom integration is on Security Analytics Complete, not Essentials. |
| Detection engineering | Detection Studio for test, deploy, and MITRE-aligned coverage on Enterprise Security. Detections are SPL, and Risk-Based Alerting rolls them into findings. | Prebuilt and custom detection rules on Security Analytics Essentials and Complete. Complete adds extended security content. The EASE tier does not include detection rules. |
| Investigations | Findings open in the Enterprise Security investigation workspace. An ES 8 upgrade keeps a legacy investigations view for work started in ES 7. | Cases, triage, investigation, and hunting are on Essentials and Complete. AI Assistant and Attack Discovery are on Complete (and EASE), not on Essentials. |
| Response tiers | Adaptive response on a detection can create a finding, change a risk score, send mail, or run included actions. SOAR playbooks are ES Premier, not Essentials. | Endpoint response actions and cloud response actions are on the Complete add-on column, not Essentials. Downgrading Complete to Essentials removes external rule action connectors, case connectors, and endpoint response-action history. |
| Endpoint / XDR adjacency | ES correlates multi-domain telemetry; endpoint response often pairs with Cisco/other controls or SOAR actions rather than a single Splunk agent as the default mid-stage path | Elastic Defend endpoint protection is packaged with Security Analytics tiers; advanced response actions deepen on Complete. Per-endpoint fees removed as of 23 Mar 2026 |
| Automation / SOAR boundary | SOAR is on ES Premier (not Essentials) per the purchasing matrix. Treat playbook depth as an edition decision, not free with every ES capacity purchase | Native automation / Workflows and Agent Builder path on Complete packaging (execution meters on add-ons). Elastic positions this as avoiding a separate SOAR license tax |
| Who writes the next step | Detection engineers and SOC leads who own SPL content, RBA tuning, and Premier automation if purchased | Detection engineers and platform owners who own Elastic rules, Agent policies, and Serverless/Hosted spend alerts |
If Premier SOAR and UEBA are mandatory on day one, budget Splunk ES Premier explicitly. If the team wants SIEM analytics plus endpoint on one Elastic security project with published GB meters, Elastic Complete is the edition to model. Category-wide SIEM shortlists remain on SIEM alternatives.
Where they overlap
Both compete as commercial SIEM / security analytics platforms with prebuilt detections, investigation workflows, threat-intel enrichment, UEBA options on higher editions, and automation paths. An RFP that only says “replace the SIEM” will get adjacent demos. The remaining split is Splunk Enterprise Security on Splunk capacity meters (Cisco-owned, Splunk-branded) versus Elastic Security on Elastic Stack deployment and Serverless/Hosted commercial models.
When to use both
Running Splunk ES and Elastic Security as parallel SIEMs for the same sourcetypes usually doubles ingest cost and detection ownership without clarifying who closes the alert. The narrow split that sometimes appears is Elastic retained for search/observability-adjacent security telemetry while Splunk ES remains the SOC system of record, or a migration window with dual-write. If one SOC owns both platforms, pick the stack you will staff: Splunk SPL/RBA capacity or Elastic rules and GB/resource meters.
Choose Splunk Enterprise Security when the hire is enterprise SIEM/TDIR with Risk-Based Alerting and Detection Studio on Splunk Cloud or Enterprise capacity (Daily Indexing Volume and/or SVC/vCPU), and you will quote Essentials vs Premier honestly for SOAR/UEBA. Choose Elastic Security when the hire is SIEM/XDR-shaped analytics on the Elastic Stack with public Serverless Essentials/Complete ingest and retention meters (or a Hosted resource plan you can staff), including endpoint without per-endpoint fees as of March 23, 2026.
FAQs
Is Splunk still the right product name after the Cisco acquisition?
Yes for this SIEM shortlist. Cisco completed the Splunk acquisition in March 2024. First-party marketing still sells Splunk Enterprise Security on splunk.com (“Supercharged by Cisco” / part of Cisco). Do not treat the primary purchasable label as a bare Cisco SIEM rename unless Splunk retires that brand on first-party pages.
Does Splunk publish list prices for Enterprise Security?
Not as a public $/GB-day table on the ES product pages. Licensing uses Daily Indexing Volume and/or SVC/vCPU capacity matching the core Splunk platform, with Essentials vs Premier feature gates. Treat dollars as quote-required and confirm meters on the order.
What are Elastic Security Serverless public meters?
As listed on Elastic’s Serverless Security pricing page (rates effective 1 Nov 2025): Security Analytics Essentials ingest as low as $0.09 per GB and retention as low as $0.017 per GB retained per month; Complete as low as $0.11 per GB ingest and $0.019 per GB retained per month. Egress is 50 GB free then $0.05 per GB. Per-endpoint fees no longer apply as of 23 Mar 2026.
Is this a SOAR comparison?
No. The job is SIEM / security analytics / detection and response. SOAR and native automation appear only where they change edition choice (Splunk ES Premier vs Essentials; Elastic Complete / Workflows packaging).
Is this a hands-on bake-off?
No. The comparison uses first-party product and pricing pages, licensing docs, and community cross-check only. We did not install either product in a paid lab tenant.
