Represented by Carahsoft ↗, GuidePoint Security ↗, Herjavec Group ↗, Kudelski Security ↗
No description recorded yet for Splunk.
Tools & products
Read by an AI model from splunk.com’s own pages. What the vendor says it does, not independently verified.
Drawn from this vendor's own public materials and authored to keep category questionnaires balanced. Gaps reflect capabilities not emphasized in public materials, not rankings.
Strengths: Flexible, powerful SIEM (Enterprise Security) with a vast app ecosystem, the SPL search language, SOAR, and UBA.
Gaps: Data-volume pricing can be costly at scale, and the platform's power comes with operational complexity.
Integrates with: Cisco ↗, Google ↗, Journey ↗, Microsoft ↗, Recorded Future ↗, Threat Intelligence ↗
Integrated by: 1stProtect.ai, ANY.RUN, Abnormal Security, Abstract Security, Acalvio Technologies, AccuKnox, Acuity Risk Management, Adaptive, Adaptive Security, AiStrike, Akeyless Security, Amplifier Security, Amplify Security, Andesite, Anomali, Anvilogic, Aona AI, AppOmni, Aqua Security, AquilaX, Arcanna.ai, Arkose Labs, Assetnote, Axoflow, Axur, Bastille Networks, Beyond Identity, Binalyze, Bitsight, Bitwarden, Blink Ops, BlueCat Networks, Bolster, Brandefense, Bricata, Bridewell, Britive, Broadleaf Group, BullWall, CardinalOps, Censys, CheckRed, Cisco, Claroty, CloudDefense.AI, Coalfire, Code42, Commvault, Complyan, Compyl, Corelight, Corgea, Cotool, Cribl, Critical Start, CrowdSec, CyCognito, Cyber Aware, Cyber Triage, Cyberhaven, Cybervergent, Cyera, Cyjax, Cylera, Cynalytica, Cypago, D3 Security, DERSec, DNSFilter, Darktrace, Dashlane, DataBahn, Dataminr, Datashield, Datavisor, Daylight Security, Detectify, Dispel, DomainTools, Doppel, Dropzone AI, Duo Security, ESET, EasyDMARC, Edge Delta, Edgescan, Elastic, Elastio, Embed Security, Endace, Entro Security, Exaforce, Expel, ExtraHop, Fastly, Fidelis Security, Firezone, First Recon AI, Flare, Flashpoint, Fleet Device Management, Fornetix, FusionAuth, General Dynamics, Gigamon, GitGuardian, GoodAccess, GreyNoise, Group IB, Gurucul, HackNotice, Hadrian, Herd Security, HiddenLayer, Hive Pro, Hook Security, Hunt.io, Huntbase, IONX Solutions, IRONSCALES, Illumio, ImmuniWeb, Imperum, InstaSafe Technologies, Intezer, Jit, KELA, Keepnet Labs, Kela Targeted Cyber Intelligence, Kentik, Kiteworks, Lansweeper, LogCraft, LoginRadius, Loginsoft, Lumu Technologies, Mage Data, MergeBase, Mesh Security, Mimecast, Mindflow, Mitigant, Mitigata, Monad, Moxso, NetClean, NetScaler, Netenrich, Netmaker, Netwrix, NopSec, ORION, Obsidian Security, OctoXLabs, Oleria, Onapsis, Inc., OneLayer, OneTrust, Oomnitza, Operant AI, Optimal IdM, Orca Security, Ordr, Ory Corp, OutThink, Ox Security, P0 Security, Panorays, Panther, Patrowl, PhishingBox, PlexTrac, Plixer, PolySwarm, Portnox, PowerDMARC, Precisely, Promptfoo, Proofpoint, Prophet Security, Qevlar AI, Query.AI, QuilrAI, Rapid7, Realm.Security, Redjack, ReversingLabs, Rhebo, Ridge Security, RiskXchange, Riverbed, Rublon, SAI360 INC., SOC Jedi.AI, SOC Prime, SOCRadar Cyber Intelligence Inc., Saporo, Scytale, Searchlight Cyber, Seceon Inc, SecurityScorecard, SenseOn, SentinelOne, Sentra, Seraphic, Simbian, Smarttech247, Sn1perSecurity LLC, Socket, Sophos, SpyCloud, Stairwell, Stellar Cyber, StrangeBee, Strobes Security, Sumo Logic, Synack, Sysdig, TCPWave, Team Cymru, Teleport, Tenable, Tenzir, Teramind Inc., ThreatAware, ThreatDefence, ThreatDown by Malwarebytes, Token Security, Torq, TriagingX, Truffle Security, Twine Security, UncommonX, Uno, Unosecur, UpGuard, Upwind, Vali Cyber, Vectra AI, Vega, Verosint, Veza, Vijilan, Vorlon, Wallarm, Waterfall Security, Willow, WitFoo, Wiz, XM Cyber, Zero Networks, ZeroFox, Zscaler, Zynap, c/side, iVerify, ilantus, ipqualityscore, isMalicious, mondoo, myra security, netcraft, rebasoft, runZero, specterops, spin.ai, torii, tychon
4 of 5 independent trust signals established
Splunk has 4 dimensions with established evidence. The rest have not been confirmed yet.
Not yet established: Independently verified
Has anyone other than the vendor confirmed this?
Nothing here has been confirmed by an independent third party yet.
Is this a real, durable business?
How long this vendor has been operating, and who stands behind them.
What do they do when something goes wrong?
What their public record shows about handling vulnerabilities and outages.
Do they tell you the awkward things unprompted?
How much this vendor volunteers before you have to ask.
Are they still shipping, or coasting?
Whether this vendor is visibly still building.
Security headers (4/5) — checked 10/18/2026
Infrastructure & transparency signals
18 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role t…
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discoveri…
mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authentica…
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a quer…
Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. (dot dot) in a URI to …
In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the …
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with th…
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assig…
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service…
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HT…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker updat…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘mevent…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a h…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may no…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The…
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘mod…
In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web en…
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. T…
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or…
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection…
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of …
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Datasheets, whitepapers, and case studies found on splunk.com by the enrichment loop. Links open the original documents on the vendor's own site.
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →
