LogRhythm vs Splunk (2023): SIEM tool comparison

Logs and event data are becoming too labor intensive to analyze manually due to the growing cyber threat landscape. As a result, organizations now rely on Security Information and Event Management tools to collect and analyze these data types to gain actionable security insights. LogRhythm and Splunk are two prominent players in the SIEM market, and many organizations deploy them to monitor and manage security events, detect threats and ensure a robust security posture. But what distincts one from the other? This article provides a comprehensive comparison between LogRhythm and Splunk, examining their features, pricing, pros, and cons.

Jump to:

SEE: 6 SIEM myths (TechRepublic Premium)

LogRhythm is a software platform offering comprehensive security information and event management solutions to help organizations detect, respond, and  remediate security incidents effectively. The platform combines advanced analytics, artificial intelligence, and machine learning to provide real-time monitoring, analysis, and correlation of security data from various sources. LogRhythm centralizes logs and event data management, enabling security teams to identify suspicious activities, investigate incidents, and mitigate potential risks on time.

Splunk is a unified security and observability platform designed to help organizations improve data accessibility, access to data insights, and remove data silos for better response to operational and security risks. Powered by artificial intelligence and designed with enterprise-level analytics and visualization capabilities, Splunk helps users automate investigations and respond faster to security events across their systems in real-time. Splunk’s applications span across various domains, including IT operations, security, compliance and business analytics.

The following table outlines the key features found in LogRhythm and Splunk.

LogRhythm

Splunk

Yes

Yes

Yes

Yes

Yes

Yes

Easier to deploy

Difficult

Yes

Has more customizable features

Yes

Yes

Yes

Yes

LogRhythm operates a flexible pricing and licensing structure that comes with unlimited log resources and users. Prices are also offered on perpetual, subscription and unlimited data basis.For more details on LogRhythm’s pricing, contact the sales team.

Similar to LogRhythm, Splunk operates a flexible pricing model, which is captured under the following.

Apart from the above pricing options, Splunk users also have the option to get an estimate of what they will be charged if they use Splunk.

Below is a head-to-head comparison between LogRhythm and Splunk.

LogRythm users have flexible deployment options to match varying needs and goals. The deployment choices available to customers include self-hosting, infrastructure as a service (IaaS), or engagement with a managed security service provider. There is also a cloud deployment option with LogRhythm Cloud, which presents a software-as-a-service (SaaS) choice.

On the other hand, Splunk users can deploy the solution in a distributed search or single instance deployment. In addition, the software is also available as cloud, on-premise or multi-cloud.

When it comes to data analysis, LogRhythm’s Machine Data Intelligence (MDI) functionality helps users to make sense of their data. This functionality contextualizes and enriches data at the time of ingestion. It also helps to translate complex data into digestible chunks of information to enhance the accuracy of data analysis.

Splunk also has a data analytic engine designed to gather, index and manage large volumes of data, regardless of its format. Splunk’s data analytics can analyze data in real-time and dynamically generate schemas. This eliminates the need for users to have a deep understanding of the underlying data structure, as they can easily query and explore the data without any prior knowledge.

LogRhythm allows users to customize their dashboards in ways that suit them. For instance, users can decide to customize the report template, create custom log detail reports, restore the default logo to a report, schedule and manage scheduled reports, rename a custom dashboard and decide which dashboard to make public or private.

Figure A: LogRhythm dashboard

Splunk also offers a highly customizable dashboard. Users can choose from a range of charts and other virtualizations to act on their data. For instance, users can integrate reports, charts and re-usable panels to derive more insight from their data. In addition, there is also the option to tailor data for different use cases and users, such as business, security analysts, auditors, developers and operations teams, to facilitate their operations.

Figure B: Splunk data virtualization dashboard

LogRhythm offers centralized log and incident management that helps users to collect, store and analyze logs/events from various sources for auditing, compliance, and forensic purposes. There are also case management and playbooks, which offer incident management functionalities to facilitate log and incident management processes.

Similarly, Splunk also provides a central log management feature that allows users to collect and store logs from various sources in centralized storage. Users can also encrypt the logs collected to prevent unauthorized access.

Both LogRhythm and Splunk provide users with advanced threat detection capabilities. LogRythm does this by combining machine analytics and search analytics. These functionalities offer users a risk-based monitoring strategy that can automatically identify and prioritize attacks and threats.

Splunk also rides on the power of machine learning to detect advanced threats and other 1300+ out-of-the-box detections for frameworks such as MITRE ATT&CK, NIST, CIS 20 and Kill Chain.

Figure C: Splunk executed playbook & actions

Below are the key takeaways from the LogRythm SIEM solution.

Figure D: LogRhythm UEBA

Visit LogRhythm

Highlighted below are the pros and cons of Splunk.

Visit Splunk

SEE: Using Splunk in the financial services industry (TechRepublic Premium)

This comparison is based on a comprehensive analysis of the features, capabilities, and pricing information provided by LogRhythm and Splunk, as well as insights from user reviews. It is important to note that the suitability of each SIEM tool may vary depending on your organization’s specific needs and requirements. Therefore, you should evaluate both solutions to determine their compatibility with your organization’s security strategy.

The choice between LogRhythm and Splunk depends on various factors, such as the organization’s size, budget, specific security needs, and expertise. LogRhythm’s comprehensive platform, UEBA capabilities, user-friendly interface and easy deployment makes it a suitable choice for organizations looking for an all-in-one SIEM solution with advanced threat detection capabilities.

On the other hand, Splunk’s powerful log management and analysis features, scalability, and customization options make it attractive for organizations seeking highly customizable and scalable log analytics capabilities. In addition, Splunk is more suitable for advanced technical users.

FEATURED PARTNERS:

Visit website

Protect your company computers, laptops and mobile devices with security products all managed via a cloud-based management console. The solution includes cloud sandboxing technology, preventing zero-day threats, and full disk encryption capability for enhanced data protection. ESET Protect Advanced complies with data regulation thanks to full disk encryption capabilities on Windows and macOS. Get started today!

Learn more about ESET PROTECT Advanced

Visit website

Dashlane secures your data with a patented security architecture and AES256-bit encryption, the strongest method available. Employees can securely share encrypted passwords with individuals or groups- instead of sending them unsecurely over email or Slack. Try Dashlane Business for free

Learn more about Dashlane

Visit website

Endpoint Central is one super app to manage your enterprise IT, from endpoint management to end-user security. Streamline and scale every IT operation from device enrolling/onboarding to retiring for multiple device types across different platforms. Perform patching, distribute software, manage mobile devices, deploy OS, keep track of hardware/software inventory, and remotely troubleshoot end-user issues while shielding them from cyberattacks. Get a free 30-day trial on unlimited endpoints.

Learn more about ManageEngine Desktop Central

SEE: Checklist: Network and systems security (TechRepublic Premium)

Architecture’s Labor Problem

The field tolerates misogyny, racism, and worker exploitation. No wonder it produced David Adjaye.

Facebook

Twitter

Email

Flipboard

Pocket

Earlier this month, the Financial Times released a damning exposé revealing a long history of abuse committed by one of architecture’s biggest stars, Ghana-born British architect David Adjaye. The news came as a shock, as Adjaye, who is Black, has long been seen as a beacon of progress in the overwhelmingly white profession of architecture. Best known in the United States for designing the National Museum of African American History and Culture in Washington, D.C., he has been accused by three women of sexual exploitation, harassment, and creating an unbearably hostile working environment at his firm, Adjaye Associates. Through a lawyer, he has denied all allegations.

The details of the report are horrifying, painting a picture of a man who, after accruing power and success, abused that power for his own gratification for many years and bought his victims’ silence. His pattern of abuse continued unabated for so long because, as their employer, he had disproportionate power over these women—all three of them Black, a not-incidental element of how he viewed and treated them (that is, as disposable). One woman said he called Black women “low-hanging fruit,” and said, “If I was white he would have had respect for my body.” He also had a hold over the immigration status of his workers in Accra, Ghana; an FT follow-up revealed that he gave the names of his victims to the Ghanaian government.

The report contained some especially lurid, violent details, which immediately prompted outrage. The financial fallout was immense. Adjaye’s role in many of his projects under development was terminated, including some blockbuster works such as Westminster’s Holocaust Memorial and Harlem’s Studio City. Of course, no amount of scuttled commissions will ever be enough to give those three brave women years of their lives back.

Many were relieved to see any allegations against a powerful male architect see the light of day. In some circles, admittedly unsubstantiated rumors about Adjaye were circulating as early as 2017, at the height of the #MeToo movement. Many women in architecture will remember the now-deleted “Shitty Men in Architecture” list, which featured many big names in the field. Such whisper networks among women in practice and students in the academy are often the only form of information-gathering on gender-based violence in the field.

To say that architecture is a profoundly misogynistic discipline is an understatement. As a woman in the field, I have experienced it firsthand. In many instances I have been treated with less respect than my male counterparts and belittled by men, even at public events. And misogyny in the workplace isn’t just limited to sexual harassment. In the United States alone, despite their receiving 48 percent of all architecture degrees, women make up only 17 percent of the architects registered with the American Institute of Architects, and of those, fewer than .05 percent are Black women. Women in architecture only make 86 cents to every dollar earned by men. In Adjaye’s case, institutional misogyny is compounded with racial contempt. His alleged predations may best be described as what Black feminist scholar Moyra Bailey calls “misogynoir,” the form misogyny takes when directed at Black women in particular.

It’s no mystery how Adjaye was able to fly under the radar for so long. Architects like him achieve nigh-mythical status as solo geniuses whose groundbreaking work changes the very shape of art, if not the world. It does not matter to the public that he is merely a synecdoche for his entire firm, Adjaye Associates, a company made up of hundreds of subordinate employees. Adjaye himself is the only one who receives public recognition for the work done by the army of laborers responsible for making architecture actually happen. When public focus rests on one man and erases architecture’s collective project, that man gets elevated to a level of power and influence that makes it harder and harder for victims to speak out.

To make things more complicated, the field’s exclusion of minorities—coupled with its predilection for patronizing tokenism toward them—has also given Adjaye, a Black man, an extra layer of protection and insulation from criticism. He is not just a famous architect; he is a trailblazer. No one wants to be the employee who ruins the career of one of the few famous architects of color. It’s reasonable to anticipate that their allegations will be weaponized by bigots to reinforce their stereotypes and prejudices. The fact that all three women were Black should remind us that the role race plays in architecture is more nuanced and intersectional than Adjaye’s photo ops with Barack Obama would have us believe. His fall should put to bed the idea that one man’s success in a world that views him as an other is in any way tantamount to a real reckoning with race in architecture.

It bears repeating: Adjaye is an employer. His abuse is workplace abuse—it cannot take place without the infrastructure of the workplace to provide him power and access to victims. While his case is particularly spectacular in its violence, it is of a kind with abuse that happens in architecture firms around the world. All workplace abuse is irrevocably linked with worker precarity. The environment of architectural workers is particularly conducive to exploitation, since it encourages self-abuse: long hours, unpaid internships, unnatural devotion to “the project,” and identification of the self with the workplace.

Adjaye’s cult of personality and status as an employer had far-reaching consequences for his workers’ financial and personal autonomy. The FT report details how many of his workers were tied up in the vulnerabilities of immigration-based contracts. Many were not getting paid or were getting paid late. Then he heaped loads of hush money on workers he had made financially fragile—one woman described having to choose between diapers and food.

These allegations should not be viewed as the ignoble and unfortunate end of what was once a fairy-tale story. They should not be viewed as an isolated instance of brutality. They should be viewed as a wake-up call. All of the elements that allowed Adjaye’s harm to go unpunished for so long are present in one way or another in all firms. They are inherent in the very culture of the discipline, which has become increasingly stratified, with entry-level workers seen as especially disposable and exploitable. Young architects, after being told all through school that they will be embarking on a journey to change the world and shape the built environment, instead find themselves working 10-hour days using mind-numbing software to catalog how much insulation is needed in a given wall. Receiving any scrap of acknowledgement from the great masters who run their firms more like despots than artists feels especially rewarding in such an uninspiring environment. Combine this dynamic with a culture of virulent racism and misogyny, lack of financial security or upward mobility, and precarious employment visas, and you have an environment that is primed for exploitation. The fact that this exploitation takes on a sexual dimension is no surprise when domination—over the workplace, perhaps over the built environment itself—is the order of the day.

A solution to these problems requires a world in which architectural workers see themselves as workers and where starchitects like Adjaye are no longer seen as gods. It also requires labor organization in the workplace; as in all corporate settings, institutions like HR (if firms even have it) are designed to protect the company, not its workers. Whether through activist organizations such as the Architecture Lobby or through unionization, architectural workers need accountability and support from outside their firms. Unionism in architecture is in its infancy, but solidarity among the field’s workers is rising year by year.

The only way to keep such awful acts from happening again is to change the very structure of architecture. We owe Adjaye’s survivors a reckoning beyond punishing their abuser for his misdeeds. We owe it to them to create an architecture that is supportive and safe. We owe it to them to reform the workplace into one where opportunities for exploitation and race- and gender-based violence are eliminated. We owe it to them to change the field for the better, to make sure that what has happened here can never happen again.

Kate Wagner is an architecture critic and journalist based in Chicago, Ill., and Ljubljana, Slovenia.