In short: Splunk Enterprise Security is the SIEM from Splunk, a Cisco company. Version 8 comes in two editions: Essentials, for threat detection, investigation, threat intelligence and case management, and Premier, which adds native Splunk SOAR, user and entity behaviour analytics and Automated Threat Analysis. Recent releases add Cisco Talos enrichment and AI agents for the SOC.
What is Splunk Enterprise Security?
Splunk Enterprise Security (ES) is a security application that runs on the Splunk platform, either Splunk Cloud Platform or Splunk Enterprise on your own infrastructure. Splunk ingests machine data from almost anything (firewalls, endpoints, identity providers, cloud services, applications) and ES turns that data into detections, findings and investigations with a workflow for the analysts who work them.
Cisco completed its acquisition of Splunk in March 2024. Splunk keeps its own brand, so you will see "Splunk, a Cisco company". ES is not a "Cisco Secure" product, but Cisco now positions it as the threat intelligence and response anchor of its security portfolio, alongside Cisco XDR and Cisco Talos.
Essentials vs Premier
Splunk sells ES 8 in two editions. Premier includes everything in Essentials.
| Capability | Essentials | Premier |
|---|---|---|
| Threat detection, alert triage, investigation and case management | Yes | Yes |
| Detection Studio for building and testing detections | Yes | Yes |
| Exposure analytics (asset and identity discovery) | Yes | Yes |
| Threat Intelligence Management | Yes | Yes |
| Splunk AI Assistant for Security | Yes, where available | Yes, where available |
| Native Splunk SOAR automation | No | Yes |
| User and entity behaviour analytics (UEBA) | No | Yes |
| Automated Threat Analysis, powered by Splunk Attack Analyzer | No | Yes, where available |
| SOC AI agents (for example Detection Builder and Automation Builder) | Some | Yes |
| AI SOC Analyst and Connector Builder agent (ES 8.7) | No | Yes |
Some features need Splunk Cloud, or Splunk Cloud Connect for on-premises deployments (for example the AI Assistant on premises), and availability varies by region and agent. We check the current capability matrix for your deployment before recommending an edition.
What the recent 8.x releases added
- ES 8.4 (February 2026): Cisco Talos data appears on an investigation's intelligence tab, helping analysts classify URLs, IP addresses, domain names and similar indicators
- ES 8.5 (April 2026): Splunk Attack Analyzer threat analysis for phishing investigations, with static analysis of email bodies and metadata, resource trees, system verdicts and email screenshots, plus SOAR apps for Microsoft Graph (Office 365), IMAP and Gmail that create findings in the analyst queue
- ES 8.6 (8.6.1 generally available on 4 August 2026): the first set of agentic SOC agents, including Detection Builder, Triage, Malware Reversing, Phishing Analysis, Guided Response, Automation Builder and SOP agents, and the AI Assistant for on-premises ES through Splunk Cloud Connect
- ES 8.7 (2 September 2026): the AI SOC Analyst and a Connector Builder agent in Premier (the AI SOC Analyst is enabled on request), Automation Builder improvements, and Enterprise Security on MCP, which exposes alerts, entities and findings to AI tools
- ES 8.8 (controlled availability from 21 October 2026): investigation aggregation that groups related findings across domains, detection rerun after outages, finer-grained role-based access, Exposure Analytics entity posture and risk profiles, and UEBA dataset management in Premier
Cisco describes this direction as the agentic SOC: AI agents handling repetitive triage and enrichment while analysts approve and direct. Some agent features require Splunk Cloud or a request to Splunk to enable, so treat them as options to evaluate rather than assumptions.
Splunk Enterprise Security and Cisco XDR together
ES and Cisco XDR overlap less than it might seem:
- XDR gives fast, curated detection and response across integrated security tools, with prebuilt correlation and response actions
- ES gives you every log source, long retention, custom detections in SPL, risk-based alerting, compliance reporting and a full case workflow
In a combined design, XDR handles the high-fidelity security incidents and response, while ES holds the wider data for hunting, audit and detections XDR does not cover. Cisco also publishes the Cisco Security Cloud app on Splunkbase, which brings data from Cisco security products such as Secure Firewall, Secure Endpoint, Secure Network Analytics and Duo into Splunk, and can import Cisco XDR incidents into ES. For Splunk Cloud, a separate Cisco Talos Intelligence for Enterprise Security Cloud app enriches findings with Talos intelligence.
Deployment and licensing in general terms
- Splunk Cloud Platform: Splunk runs the platform for you; this is where new AI and agent features usually land first
- Splunk Enterprise: you run Splunk in your own data centre or cloud tenancy, with Splunk Cloud Connect for some cloud-only features
- Licensing: ES is licensed on top of the Splunk platform, which Splunk sells by data ingest or by workload, as a term subscription
- Edition choice: Premier usually makes sense once you plan to automate response with SOAR or need UEBA; otherwise Essentials plus targeted automation is enough
ES costs depend heavily on data volume and retention, so ask us for a quote once we have sized your sources.
Who it suits and how we help
ES suits organisations with an established security operations function, a regulatory need to retain and report on logs, or a wide mix of data sources that a curated XDR cannot ingest. Smaller teams usually get faster results from Cisco XDR first, adding ES later.
We help by sizing data sources and retention, choosing between Essentials and Premier, onboarding Cisco and third-party data, tuning detections and risk-based alerting, and connecting ES to XDR and Splunk SOAR. Contact us using the form.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Splunk owned by Cisco?
Yes. Cisco completed its acquisition of Splunk in March 2024. Splunk keeps its own brand and describes itself as Splunk, a Cisco company.
What is the difference between Splunk ES Essentials and Premier?
Essentials covers threat detection, triage, investigation, threat intelligence and case management. Premier adds native Splunk SOAR, user and entity behaviour analytics and Automated Threat Analysis, plus Premier-only AI features such as the AI SOC Analyst.
Does Splunk Enterprise Security include Cisco Talos intelligence?
From ES 8.4, Cisco Talos data appears on the intelligence tab of an investigation, helping analysts classify URLs, IP addresses and domains. For Splunk Cloud deployments, the Cisco Talos Intelligence for Enterprise Security Cloud app on Splunkbase also enriches findings automatically.
Do I need Splunk Enterprise Security if I have Cisco XDR?
Not always. XDR covers detection and response across integrated security tools. ES adds wider log collection, long retention, custom detections and compliance reporting. Many SOCs run both.
Can Splunk Enterprise Security run on premises?
Yes. ES runs on Splunk Enterprise on your own infrastructure as well as on Splunk Cloud Platform, although some newer AI features are cloud-only or need Splunk Cloud Connect.