Product(s): Splunk Asset and Risk Intelligence
Overall Comment:"Overall, my experience with Splunk ARI has been positive. It provides strong visibility into my attack surface across multiple cloud environments and the IOT devices in my physical offices. Overall, it has drastically helped my organization understand our actual risk when prioritizing patching and vulnerability remediation."
1. I love the ability of the platform to easily correlate all of my disparate assets across the cloud and on-prem into a single pane of glass. 2. Risk scoring and prioritization helps my team triage faster to determine the actual risk to the organization without losing sight of the smaller issues that often can be chained into a real attack. 3. Native integration with Splunk SOAR helped improve our workflows and made using the tool an easy sell to the rest of the security team.
1. With having so many locations feeding data in, there can be issues with data normalization across multiple cloud connectors and IOT devices. 2. There can be a decent amount of tuning required to get the most out of ARI, which causes so additional administrative overhead during onboarding. 3. The reporting and dashboards within the platform could use a facelift.