CISO Tribune

Vendor comparison · 2 companies

Splunk vs UnderDefense

Splunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives. UnderDefense sells UnderDefense MAXI, a security and compliance automation platform, and an MDR service in which security experts monitor, detect and respond to incidents. CISO Tribune files both under SOAR and security automation. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Splunk
  • UnderDefense
Splunk vs UnderDefense: Products, Customers and Funding Compared
SplunkSplunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives.splunk.comUnderDefenseUnderDefense sells UnderDefense MAXI, a security and compliance automation platform, and an MDR service in which security experts monitor, detect and respond to incidents.underdefense.com
What it sells
  • Splunk Cloud Platform[12][22][23][24]A platform to collect, index, and visualize data in the cloud.
  • Splunk Enterprise[1][12][14][17][18][22][24]A platform to collect, index, and visualize data using an on-premises engine.
  • Splunk Enterprise Security[1][14][17][18]A Splunk solution for security operations.
  • Federated Search[15][19]A search layer across the data estate.
  • Splunk AI Assistant[19]A natural-language entry point to the search workflow.
  • Splunk Edge Processor[21]A processor that applies cryptographic functions to data as it flows on-premises.
  • Splunk AI Toolkit[20]Guided workflows to build and deploy models.
  • Splunk Log Observer Connect[22]An integration that links logs to Splunk Observability Cloud.
  • UnderDefense MAXI[1][2][3][5][6]A security and compliance automation platform. UnderDefense MAXI integrates with SIEMs, firewalls and endpoint protection solutions.
  • UnderDefense Agentic AI SOC[4]AI agents investigate each alert. Analysts on shift 24/7 decide what happens next.
  • MDR[1][2][6]Security experts monitor, detect and respond to incidents.
  • Cloud-based SIEM[2]A cloud-based SIEM that collects, analyzes and responds to security events.
  • CIS AWS Benchmark assessment[8]A self-service assessment of AWS security.
Categories
Headquarters
San Jose, United States[4]Not stated on its pages
Founded
2003[3]Not stated on its pages
Ownership and funding
Owned by Cisco[2][15][16][25]Not stated on its pages
Named customers
Not stated on its pages
Recent news
  • September 15, 2026Cisco released Cisco AI POD for Splunk, which brings Splunk AI features to on-premises customers on Cisco infrastructure with NVIDIA computing.[10]
  • May 28, 2026Splunk reported that Cisco has completed its acquisition of Galileo, with plans to integrate Galileo technology into Splunk Observability.[25]
  • April 9, 2026Cisco agreed to buy AI observability startup Galileo Technologies to add its agent monitoring tools to the Splunk observability platform.[11]
  • February 18, 2026Splunk announced that its hosted AI models are generally available for Splunk Cloud Platform customers.[23]
  • January 16, 2026Splunk announced the release of Splunk Enterprise 10.2 and Splunk Cloud Platform 10.2.[24]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[16]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Splunk sells mainly to organisations that want security, observability, and AI data on one platform. Splunk describes SOC teams that index authentication and firewall data for real-time detections. Splunk describes a healthcare organization that monitors logs from medical devices. Splunk offers material for CISOs and boards on priorities, budgeting, compliance, and success metrics. Splunk describes deployments on Splunk Enterprise and Splunk Cloud Platform.UnderDefense MAXI integrates with a customer's security infrastructure, including SIEMs, firewalls and endpoint protection solutions. UnderDefense offers compliance templates to organizations working toward standards such as SOC2 and ISO 27001. UnderDefense MAXI provides executive-level reports for C-level readers.
Last verified
October 10, 2026October 26, 2026

Where they overlap

  • Splunk and UnderDefense are both filed under SOAR and security automation.

Where they differ, field by field

  • Splunk's primary category is SIEM; UnderDefense's is MDR and managed SOC.
  • Splunk is also filed under Security data lakes and pipelines. UnderDefense is also filed under Penetration testing and red team services and Compliance automation.
  • Splunk lists Splunk Cloud Platform, Splunk Enterprise, Splunk Enterprise Security, Federated Search, Splunk AI Assistant and 3 more. UnderDefense lists UnderDefense MAXI, UnderDefense Agentic AI SOC, MDR, Cloud-based SIEM and CIS AWS Benchmark assessment.
  • Splunk is headquartered in San Jose, United States.
  • Splunk was founded in 2003.
  • Splunk is owned by Cisco.
  • Splunk publicly names Carrefour, Intel, FINRA, Alaska Airlines and Honda of Alabama.

What it sells: Splunk

What Splunk Cloud Platform does[12][22][23][24]
Splunk Cloud Platform is described as a way to collect, index, and visualize data in the cloud. Splunk says data can be brought in with agents, Splunk-supported integrations, and developer add-ons.
What Splunk Enterprise Security does[1][14][17][18]
Splunk names Splunk Enterprise Security among its solutions that use pre-written macros. Splunk describes AI Assistant in Security as available to cloud customers of Splunk Enterprise Security.
What Federated Search does[15][19]
Federated Search is described as the unifying search layer across the data estate. It covers Splunk-managed locations and supported customer-managed stores such as Amazon S3 and Snowflake.
What Splunk AI Assistant does[19]
Splunk AI Assistant provides a natural-language entry point to the search workflow. With Agent Mode enabled, an analyst can describe the investigation to perform instead of constructing each search.

What it sells: UnderDefense

What UnderDefense MAXI does[1][2][3][5][6]
UnderDefense MAXI natively monitors endpoints, networks, users and decoy beacons. UnderDefense MAXI provides ready-to-use playbooks, AI-powered alert enrichment and notifications through Slack, Jira or a preferred tool. UnderDefense MAXI provides pre-built compliance templates for standards such as SOC2 and ISO 27001.
What UnderDefense Agentic AI SOC does[4]
UnderDefense Agentic AI SOC uses AI agents that investigate each alert. Analysts on shift 24/7 decide what happens next.
What CIS AWS Benchmark assessment does[8]
UnderDefense offers a self-service CIS AWS Benchmark assessment. The assessment covers evaluating the maturity of cloud security controls, identifying misconfigurations, providing detailed mitigation instructions and giving a summary table with a final CVSS v3.0 score.

Questions about Splunk and UnderDefense

What do Splunk and UnderDefense sell?
Splunk sells Splunk Cloud Platform, Splunk Enterprise, Splunk Enterprise Security, Federated Search, Splunk AI Assistant and 3 more. UnderDefense sells UnderDefense MAXI, UnderDefense Agentic AI SOC, MDR, Cloud-based SIEM and CIS AWS Benchmark assessment.
Are Splunk and UnderDefense in the same category?
They share SOAR and security automation. Splunk's primary category is SIEM and UnderDefense's is MDR and managed SOC.
Where are Splunk and UnderDefense headquartered?
Splunk is headquartered in San Jose, United States.
When were Splunk and UnderDefense founded?
Splunk was founded in 2003.
Who owns Splunk and UnderDefense?
Splunk is owned by Cisco.
Which customers do Splunk and UnderDefense name?
Splunk publicly names Carrefour, Intel, FINRA, Alaska Airlines and Honda of Alabama.
Who are Splunk and UnderDefense sold to?
From its own pages, Splunk sells mainly to organisations that want security, observability, and AI data on one platform. UnderDefense MAXI integrates with a customer's security infrastructure, including SIEMs, firewalls and endpoint protection solutions.
What have Splunk and UnderDefense announced recently?
September 15, 2026: Cisco released Cisco AI POD for Splunk, which brings Splunk AI features to on-premises customers on Cisco infrastructure with NVIDIA computing.

About Splunk

Splunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives.

Splunk says its unified platform gives teams cross-domain context for security, observability, and AI and keeps telemetry where it lives. Splunk says teams can search and analyze data where it lives to reduce costs. Splunk says its platform preserves full access and context for AI and analytics without the ingest tax or unnecessary data movement.

On the security side, Splunk says adversaries using AI are shrinking remediation windows from months to minutes. Splunk says its answer combines unified data, advanced TDIR, and AI agents that enable experts to mitigate threats across any attack surface. Splunk says teams can use AI agents and assistants to predict and prevent issues, eliminate toil, and accelerate remediation safely. Splunk describes a SOAR system that integrates orchestration, playbook automation, and case management. Splunk names Splunk Enterprise Security, Splunk IT Service Intelligence, and the Splunk Common Information Model as Splunk solutions that use pre-written macros.[1][12][17]

Splunk describes AI Assistant in Security as available to cloud customers of Splunk Enterprise Security, and says it automates repetitive steps and guides analysts in daily investigation workflows. Splunk describes a Triage Agent, in alpha, that evaluates, prioritises, and explains alerts. Splunk describes an Automation Builder Agent, in alpha, that turns natural language into SOAR playbooks. Splunk describes a Malware Threat Reversing Agent for customers of Splunk Attack Analyzer that summarizes threats by breaking down malicious scripts.[18]

Splunk Cloud Platform is described as a way to collect, index, and visualize data in the cloud. Splunk Enterprise is described as collecting, indexing, and visualizing data using an on-premises engine. Splunk describes Splunkbase as the place to discover, share, and install apps and add-ons with the Splunk community. Splunk says teams can connect and act on data through integrations and apps on Splunkbase, across cloud, SaaS, IT, and machine data from OT and IoT. Splunk says teams can instrument with native OpenTelemetry support, SDKs, and agents.[12]

Splunk describes Federated Search as the unifying search layer across the data estate, covering Splunk-managed locations and supported customer-managed stores such as Amazon S3 and Snowflake. Splunk describes Splunk AI Assistant as a natural-language entry point to the search workflow. Agent Mode is available in Splunk AI Assistant 2.1 or later for supported Splunk Cloud Platform and Cloud Connected deployments running Splunk platform 10.1 or later. Splunk describes the Splunk AI Toolkit as providing step-by-step guided workflows to build and deploy models for common business challenges.[19][20]

Splunk says Splunk Edge Processor applies cryptographic functions to data in real time as the data flows within an on-premises environment. Splunk says ODBC-enabled apps such as Microsoft Excel, Power BI, and Tableau can connect to the Splunk platform, with SQL queries used to interact with the server. Splunk describes Splunk Log Observer Connect as an integration that lets logs on Splunk Enterprise or Splunk Cloud Platform be queried and associated with Related Content in Splunk Observability Cloud.[12][19][21][22]

On the observability side, Splunk says teams can use AI SRE agents to isolate root causes across environments and identify targeted fixes such as rollbacks or capacity adjustments. Splunk says teams can track LLM token usage with visibility and attribution. Splunk describes a healthcare organization using the Splunk platform to monitor and analyze logs generated from medical devices.[12][13][14][19][21]

Splunk on the record

Sources

Splunk full record

  1. [1]ProductsSplunk · splunk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Cisco completes acquisition of splunkCisco · newsroom.cisco.com · published March 18, 2024 · Tier A
  3. [3]Get the most out of splunk infrastructure monitoring and splunk itsiSplunk · splunk.com · published November 17, 2020 · Tier A
  4. [4]Contact usSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  5. [5]CarrefourSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  6. [6]IntelSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  7. [7]FinraSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  8. [8]Alaska airlinesSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  9. [9]HondaSplunk · splunk.com · undated page, accessed October 10, 2026 · Tier A
  10. [10]Cisco delivers trusted ai at scale through new splunk advancementsCisco · newsroom.cisco.com · published September 15, 2026 · Tier A
  11. [11]Cisco buys galileo strengthen splunks agentic monitoring capabilitiesSiliconANGLE · siliconangle.com · published April 9, 2026 · Tier B
  12. [12]Get Data In | Platform (last updated lastModifiedISO)Splunk · undated page, accessed October 28, 2026 · Tier A
  13. [13]Analytics Story: Warzone RAT | Splunk Security ContentSplunk · published May 13, 2026 · Tier A
  14. [14]Analytics Story: Trickbot | Splunk Security ContentSplunk · published May 13, 2026 · Tier A
  15. [15]Splunk | Data Platform for Security, Observability & AISplunk · undated page, accessed October 28, 2026 · Tier A
  16. [16]Splunk Enterprise Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed October 28, 2026 · Tier C
  17. [17]Using advanced macros - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  18. [18]L’IA au service de la sécurité | SplunkSplunk · undated page, accessed November 3, 2026 · Tier A
  19. [19]Investigating and searching across your data estate with Cisco Data Fabric powered by the Splunk platform - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  20. [20]Preparing data for use with the Splunk AI Toolkit - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  21. [21]De-identifying PII consistently with hashing in Edge Processor - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  22. [22]Using Log Observer Connect with Cloud Platform - Splunk LanternSplunk Lantern · undated page, accessed November 3, 2026 · Tier A
  23. [23]Splunk Launches Hosted Generative AI Models: Native-AI Insights, Zero Setup, Maximum SecuritySplunk · published February 18, 2026 · Tier A
  24. [24]Announcing Splunk Enterprise 10.2 & Splunk Cloud Platform 10.2 – Next Generation Querying & AnalyticsSplunk · published January 16, 2026 · Tier A
  25. [25]Splunk Observability + Galileo: Bridging the AI Trust GapSplunk · published May 28, 2026 · Tier A

UnderDefense full record

  1. [1]underdefense.comUnderDefense · underdefense.com · undated page, accessed October 26, 2026 · Tier A
  2. [2]Compliance PricingUnderDefense · undated page, accessed November 10, 2026 · Tier A
  3. [3]Agentic AI SOC & Compliance Automation Platform | UnderDefenseUnderDefense · undated page, accessed November 10, 2026 · Tier A
  4. [4]Elastic Cloud Pricing 2026: Serverless, Hosted, and SIEMUnderDefense · undated page, accessed November 10, 2026 · Tier A
  5. [5]Cloudflare Pricing 2026: WAF, Zero Trust, and EnterpriseUnderDefense · undated page, accessed November 10, 2026 · Tier A
  6. [6]Palo Alto Networks Pricing 2026: Firewalls, SASE, and XDRUnderDefense · undated page, accessed November 10, 2026 · Tier A
  7. [7]2025 MXDR Pricing Guide: Choosing the Right MXDR providerUnderDefense · undated page, accessed November 10, 2026 · Tier A
  8. [8]Episode 4: Cyber Resilience 201 — AWS Cloud Security - UnderDefenseUnderDefense · undated page, accessed November 10, 2026 · Tier A
  9. [9]E-Mail Under Attack - UnderDefenseUnderDefense · undated page, accessed November 10, 2026 · Tier A
  10. [10]UnderDefense MAXI Reviews & Product DetailsG2 · undated page, accessed November 10, 2026 · Tier C

Spot a factual error? Request a correction.