Splunk vs Elastic Security: when each option fits your SIEM
Self-managed Elastic Security can replace much of the detection, investigation and endpoint scope that most teams use from Splunk Enterprise Security, but not all of it without a paid tier. The detection engine, including correlation, indicator match and threshold rules, sits in the subscription tiers, and the self-managed page places the detection engine and case management under Platinum, which Elastic no longer sells to new customers. For a new self-managed buyer, the realistic choice is Basic, which is free, or Enterprise, which adds endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on. Confirm with Elastic which tier covers each capability on your list before you assume a free deployment covers your detections.
Splunk fits best when your team depends on SPL searches, a large library of Splunk apps and content, or a renewal that is already priced and staffed around the platform, and when a move would cost more in rebuilt content than it saves in licensing. Elastic fits best when you need Elastic Defend on endpoints, Timeline and Cases for investigations, and a stack you can run in your own network under a clear license, and when you can accept that the default distribution is under the Elastic License 2.0, which is source-available rather than OSI-approved, with AGPLv3 also offered. Three decision points should drive the review: which Elastic tier covers the features you use, where your data must physically sit (Elastic Security runs on Elasticsearch and Kibana in your own cluster, which means you own sizing and hot, warm and cold tiers), and how many correlation searches you must rewrite as detection rules. Ask your Elastic partner or account team to map your current saved searches and alerts to rules before you commit.
Which platform fits which scenario
This table matches six common situations to the platform that usually fits better, and explains the condition that makes each advantage matter. Read each row against your own environment, since the right answer often depends on existing content, licensing and in-house skills. The main takeaway is that Elastic Security's free tier covers much of the stack, but the detection engine and endpoint response features need a paid subscription.
| Scenario | Better fit | Why |
|---|---|---|
| Existing Splunk SIEM with custom correlation searches | Splunk Enterprise Security | Rewriting many SPL correlation searches as Elastic detection rules is real migration work. Stay with Splunk longer if the content library is large and tightly tuned, and plan a phased move. |
| Team already runs Elasticsearch or Kibana | Elastic Security | Existing index management, Kibana skills and cluster operations carry over. The effort then centers on enabling Elastic Security content and on the subscription tier you need. |
| Endpoint detection with host isolation | Elastic Security with Enterprise subscription | Host isolation and malware and ransomware prevention sit in the paid Enterprise tier, not the free Basic tier. Confirm the tier and the Elastic Defend features in writing before you plan endpoint coverage. |
| Strict data residency or air-gapped requirement | Elastic Security (self-managed) | Self-managed deployment keeps security data inside your own networks. Confirm package availability and offline update procedures for your air-gapped environment, and whether your required features are offered in that tier. |
| Small security team with limited Elastic operations experience | Splunk or a managed service, unless you budget for Elastic operations | Running Elasticsearch needs node role design, index lifecycle policies, upgrades and capacity planning. A small team without that skill should weigh the operations load against the Splunk renewal or a managed option. |
| Buyer who needs vendor-run support on day one | Splunk Enterprise Security or Elastic Cloud | Vendor support for the platform and its premium content is in place from the start. Self-managed Elastic needs a support subscription, and an implementation partner can cover setup but not vendor-level support. |
Which Elastic tier covers the security features you need
The Basic tier is free to self-manage and already includes baseline security for the Elastic Stack. Elastic made TLS, the file and native user realms and role-based access control free in Basic with Elasticsearch 6.8.0 and 7.1.0 on May 20, 2019, so transport encryption and local access control do not need a subscription. Confirm with Elastic which detection and case capabilities, if any, sit in Basic for your target release, because the subscriptions page places the detection engine and case management in paid tiers.
- Transport and access control: TLS, the file and native user realms and role-based access control are included.
- Detection engine: Confirm with Elastic whether any part of the detection engine is available in Basic before you rely on it.
- Single sign-on: SAML and OpenID Connect are not part of the Basic feature set on the subscriptions page.
- Endpoint prevention: Malware and ransomware prevention and host isolation are listed under Enterprise, not Basic.
- Operating cost: Your costs are the hardware, storage, staff time and any outside support you buy.
Ask Elastic for a written feature matrix for your exact release line before you assume Basic covers a specific rule or case workflow.
The Enterprise tier is the paid self-managed subscription that the subscriptions page lists for the endpoint and access features most security teams ask about. Elastic places endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on under Enterprise. Enterprise also covers the security features the page lists for field- and document-level security and encryption at rest support, so check each item against your requirements rather than assuming the whole list applies.
- Endpoint protection: Malware and ransomware prevention and host isolation for Elastic Defend endpoints.
- Single sign-on: SAML and OpenID Connect for centralized sign-in to Kibana.
- Access controls: Confirm field- and document-level security and attribute-based access control against your role model.
- Detection placement: The detection engine and machine learning anomaly detection are listed under Platinum, which is no longer sold to new customers, so confirm with Elastic which tier includes the detection engine for your purchase.
- Cost drivers: The subscription fee, the node count your contract covers and your support level are the main recurring items.
Request a quote that names each feature in this tab and the Elastic release line it applies to, and ask Elastic to confirm the detection engine tier in writing.
Elastic Cloud is Elastic's hosted option, and Elastic points customers who want new paid security features in the Platinum-era bundle to Elastic Cloud instead of a self-managed Platinum purchase. Elastic Cloud moves the operation of the cluster to Elastic, which changes where your security data is hosted and who runs the upgrades. This is a different deployment decision from the self-managed tabs, so treat it as a separate option when data residency or air-gapped requirements apply.
- Feature availability: Confirm which detection, case and endpoint features Elastic Cloud includes for your plan, since the self-managed subscription page does not define them.
- Hosting location: Check the regions and hosting arrangement against your data residency rules.
- Operations: Elastic operates the cluster, so your staff spend less time on upgrades and capacity work.
- Lock-in: Hosted operation is harder to move away from than a self-managed cluster you control.
- Air-gapped use: Hosted service does not fit air-gapped networks, so self-managed tiers remain the option there.
Ask Elastic to confirm which Elastic Cloud plan includes each capability you need and where your data is stored before you compare it with a self-managed deployment.
How the capabilities compare, feature by feature
This table sets Splunk Enterprise Security against self-managed Elastic Security across eight capabilities that security teams usually ask about first. Read each row with the Elastic subscription tier in mind, because several security features sit outside the free Basic tier. Where a Splunk cell says to confirm, check the feature with Splunk against your licensed version before you plan around it.
| Capability | Splunk Enterprise Security (commercial) | Elastic Security (self-managed) |
|---|---|---|
| Detection rules and correlation | Correlation searches and notable events. Confirm rule types, suppression options and alerting behavior for your version. | Detection engine with correlation, indicator match and threshold rules. Confirm its tier, since Platinum listed it and new buyers choose Basic or Enterprise. |
| Prebuilt content and delivery | Confirm with Splunk how Enterprise Security content updates are delivered, what they include and how often they arrive. | Prebuilt rules are developed in the elastic/detection-rules repository and delivered automatically to the Kibana detection engine. |
| Investigation timelines and cases | Confirm the investigation, timeline and case workflow in your Enterprise Security version and whether it needs extra apps. | Timeline for investigations and Cases. Case management was listed under Platinum, so confirm the current tier before purchase. |
| Entity analytics and ML anomaly detection | Confirm which entity analytics and behavioral analytics options are included in your license and which need add-ons. | Entity analytics and ML anomaly detection. Alerting rules based on anomaly detection are limited to Platinum and Enterprise. |
| Endpoint agent and EDR | Confirm which endpoint agent and response capabilities your Splunk license includes and whether they come from a separate product. | Elastic Agent runs Elastic Defend and is managed in Fleet. Malware and ransomware prevention and host isolation sit on Enterprise. |
| Search and query language | SPL, with saved searches, and export through the CLI, REST API and SDKs. Confirm feature parity for your use cases. | Elasticsearch query APIs and Kibana query tools. SPL searches need rewriting into Elastic rules and queries before they run. |
| Single sign-on | Confirm which SSO protocols Splunk supports for your deployment and whether they require a specific license. | SAML and OpenID Connect are on Enterprise. Basic includes TLS, file and native user realms and role-based access control. |
| Field- and document-level security | Confirm the role-based field and data restriction options in your Splunk version and license. | Field- and document-level security sits in paid tiers. Confirm the exact tier for the Elastic version you plan to run. |
Where your security data sits and who runs the cluster
Moving from Splunk to self-managed Elastic Security changes who holds the keys to security telemetry, where it is stored and which evidence you produce. Each card covers one decision point that shapes residency, identity and audit readiness.
Data location under Splunk
Splunk Enterprise keeps indexes on servers you operate, while Splunk Cloud Platform stores them in Splunk-managed infrastructure. Either way, the question for your residency review is which regions, subprocessors and retention settings apply to security logs that often contain user identifiers and internal addresses. Ask Splunk for written answers on hosting location and backup copies before you compare them with your own cluster.
Data location under self-managed Elastic
A self-managed Elastic Security deployment keeps Elasticsearch data nodes, Kibana and detection rule execution inside your cloud accounts, data centers or air-gapped network. You decide the storage tiers, snapshot repositories and where hot, warm and frozen data lands. Confirm that snapshot targets and any Elastic Agent output destinations also sit inside your approved boundary.
Elastic Cloud as a hosted option
Elastic Cloud moves operation of the cluster to Elastic, so the data location question becomes a vendor contract question. It can suit teams that do not want to run cluster upgrades, but you inherit Elastic's regions, support model and subprocessor list. Ask for the hosting regions, backup location and key management terms in writing, and compare them with the on-premises option before deciding.
Identity and single sign-on needs
Single sign-on through SAML or OpenID Connect, and Active Directory or LDAP mapping, are paid features in Elastic's subscription tiers, not part of the free Basic tier. Check which identity provider your analysts use and whether role mapping must follow your existing access reviews. Budget for an Enterprise subscription if SSO is a control requirement, since Basic covers the free security features only.
Compliance evidence and access control
Field- and document-level security, attribute-based access control and audit logging decide how you show that analysts see only the security data they need. Self-managing the cluster means you produce the configuration, role and access evidence yourself. DeployOpen prepares these controls and the evidence for your assessment, but independent auditors issue any attestation, so agree with your auditor early which artifacts they will sample.
Trust boundary created by Elastic Agent and Fleet
Elastic Agent and Fleet push policies to every enrolled endpoint and collect security data, including Elastic Defend protection. Whoever administers Fleet can change what agents collect or block, so the Fleet admin role becomes a privileged control point. Document who may enroll agents, how agent policies are approved and how changes are logged before you retire Splunk forwarders.
What you pay for each side, and what recurs
The main difference between the two sides is where the recurring money goes. On the Splunk side, the license is the largest recurring line, and the price is set by Splunk's licensing terms for your contract, which you should confirm in writing with Splunk or your reseller, including how ingest or workload is measured and what happens when you exceed it. Premium apps such as Enterprise Security are usually a separate line item on top of the platform, so ask for each app as its own price. Renewal risk is the cost you cannot plan around: a renewal that falls near a version upgrade (see the Splunk Enterprise end of support page) can combine a price change with upgrade effort in one budget cycle. On the Elastic side, the recurring license is a subscription tier, not a per-GB fee for the platform itself. Elasticsearch and Kibana are available under the Elastic License 2.0, AGPLv3 and SSPL 1.0, and the free Basic tier does not include the detection engine, Platinum is no longer sold to new customers, and Enterprise carries endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on. Confirm which tier each feature you rely on requires in the Elastic subscriptions page before you size the purchase.
On the self-managed Elastic side, most of the recurring cost is infrastructure and people. Infrastructure follows your data tiers: hot nodes for recent, heavily searched events, warm, cold and frozen tiers for older data, each with its own storage and compute profile. A highly available cluster needs at least three master-eligible nodes, so plan for that minimum even if your data volume is small. Staff time is the cost most often underestimated. Someone must tune and maintain detection rules, track changes from the prebuilt rules in the elastic/detection-rules repository, and schedule upgrades within each release line's support window. Outside support is an optional recurring contract, and its scope is a line item to request, not an assumed cost. Ask whether your team or a provider carries pager duty and upgrade testing.
Separate one-time work from recurring cost when you build the budget. One-time items include the migration itself: converting forwarders to Elastic Agent managed through Fleet, mapping correlation searches to detection rules, designing the cluster and standing up a test environment. Recurring items are the subscription, the infrastructure for every data tier, staff time and any outside support. When you request a written quote, ask: which subscription tier and how many nodes or resources it covers; whether features you need are included at that tier; how the price changes at higher data volumes or after renewal; what the quote assumes about cluster sizing and retention; who performs the migration and upgrade work; and what support hours and response terms are included. A quote that does not answer these points cannot be compared with the current Splunk renewal on equal terms.
What moving detections from Splunk to Elastic involves
The sequence turns Splunk correlation searches, alerts and data sources into a self-managed Elastic Security deployment that analysts have tested in parallel before Splunk is retired. The amount of work depends mostly on how much custom SPL content the team has built.
Inventory Splunk content and data sources
The security engineering lead exports a list of every correlation search, scheduled alert, dashboard, installed app and data input in use, including the Enterprise Security premium app if it is licensed. Each item is tagged as prebuilt, lightly customized or fully custom, and each data source is marked with its owner and its importance to detection. The inventory is complete when every active alert has an owner and a stated purpose, and the team can say which ones analysts act on each week.
Choose the Elastic subscription tier
The team decides which self-managed tier covers its needs before any cluster is built. Elastic's subscriptions page lists the detection engine, machine learning anomaly detection and case management under Platinum, which is no longer sold to new customers, and endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on under Enterprise. The owner of licensing confirms the tier in writing with Elastic or a reseller, and the decision record lists each Splunk feature that maps to a paid Elastic feature, so the budget reflects the tier actually required.
Size and deploy the Elasticsearch cluster
The platform team sizes the cluster from measured daily ingest, retention targets and search load, then assigns node roles such as master-eligible, data tiers, ingest and machine learning. Elastic's node roles documentation notes that a highly available cluster needs at least three master-eligible nodes. Kibana, Fleet Server and, if used, Elastic Cloud on Kubernetes are installed with TLS, role-based access and single sign-on configured. The step is done when a test index receives events, a health check passes and a failover test keeps search available.
Roll out Elastic Agent through Fleet
Engineers replace Splunk Universal Forwarders with Elastic Agent, which Fleet manages centrally, and enable Elastic Defend on endpoints where the team wants endpoint detection. Rollout starts with a pilot group of hosts and expands in waves, with each wave checked for missing events, parsing errors and agent health in Fleet. The step closes when every planned source sends data to Elastic and Splunk still receives the same feeds, so the two platforms can be compared during testing.
Map correlation searches to detection rules
Each Splunk correlation search is matched to an Elastic detection rule. Prebuilt rules from the elastic/detection-rules repository are enabled where they fit, and the repository's README notes that the latest prebuilt rules reach the Kibana detection engine automatically, so the team should review enabled rules after each update rather than assume their content is unchanged. Custom searches are rewritten as correlation, indicator match or threshold rules, and alert suppression is configured where Splunk used throttling. Each rule carries an owner and a test case, and the step is complete when every retained search has a documented equivalent or a recorded reason for dropping it.
Test detections in parallel
Splunk and Elastic run side by side on the same data for a period the security lead sets. Analysts replay known attack simulations and historical incidents, then compare alert volume, false positive rates and time to triage between the two platforms. Gaps are logged, rules are tuned, and tests are repeated until the team accepts the results for each detection category. The output is a signed test report listing matched, missing and changed detections, which becomes the evidence base for the cutover decision.
Migrate historical data and decide retention
The team exports the historical events it must keep, using Splunk's CLI or REST API for bulk retrieval, and loads them into Elastic indices with the retention and data tier settings it has chosen. Data that is only needed for occasional lookups can stay in archive form, and the decision for each data set is recorded with its legal or investigation reason. The step is done when sample queries against migrated data return the same results as Splunk and the retention policy has been approved by compliance.
Cut over alerting and train analysts
Alert routing, ticket integrations and on-call paths are switched from Splunk to Elastic, with Cases used for investigation records where the team has licensed them. Analysts complete hands-on training on Timeline investigations, rule tuning and the Elastic query syntax, and runbooks are rewritten to match. Once the cutover is confirmed, Splunk alerts are disabled in stages, and the step closes when the on-call rota has run a full cycle without alert gaps. Retiring Splunk follows after a review period set by the security leadership, when licenses and infrastructure are decommissioned.
What buyers ask before moving SIEM content to Elastic
What does a move from Splunk to self-managed Elastic Security cost?
The cost is mostly people time and infrastructure, not a license fee for the free tier. Your main cost components are the Elasticsearch and Kibana cluster (compute, storage and retention), the engineering hours to map correlation searches to detection rules, the work to deploy Elastic Agent and Fleet across endpoints, and the subscription if you need features outside Basic. Recurring costs include cluster hosting, upgrades and rule maintenance. Ask any quote to split one-time migration work from ongoing operations, and to state which Elastic tier it assumes. We do not publish prices; a quote follows from the written scope.
How long does a Splunk to Elastic Security migration take?
Duration depends on how many correlation searches, dashboards, forwarders and data sources you run, how much historical data you keep, and how long parallel running needs to last before detections match. No duration is fixed by the platform itself. A practical first step is an inventory of saved searches and alerts, which sets the scope. The written scope agreed before work starts should state the timeline and the milestones, including the parallel run period.
What does our security team need to contribute?
Expect to supply people who know your detections, data sources and incident response process. The security team confirms which Splunk alerts still matter, reviews mapped detection rules for false positives, and approves the cutover. Platform and infrastructure staff provide the Kubernetes or virtual machine capacity, network paths, identity integration and storage. Ask the proposal to name these roles and the hours expected from each.
Can our own team do the migration without an implementation partner?
Yes, a team with Elasticsearch operations experience and detection engineering skills can do this in-house. The harder parts are rewriting SPL correlation logic as Elastic detection rules, tuning alert volume, sizing node roles and keeping the cluster upgraded. Elastic's detection rules are published in the elastic/detection-rules repository, which gives your team a reference set to start from. Confirm internal capacity honestly before deciding, because the parallel run is where most gaps show up.
Is Elastic Basic enough for our detection content?
Basic covers the open features most teams start with, but the detection engine, machine learning anomaly detection and case management sit in paid tiers for self-managed deployments. Elastic's subscriptions page lists the detection engine, alert suppression, Attack Discovery, host isolation and malware prevention under paid tiers. Platinum is no longer sold to new customers. List every Splunk Enterprise Security feature you use, then check each against Elastic's current subscriptions page before choosing a tier.
How does licensing differ between Enterprise self-managed and Elastic Cloud?
Self-managed Enterprise is a subscription you run on your own infrastructure, with the security features and support that Elastic lists for that tier. Elastic Cloud is a hosted service billed by Elastic, where Elastic operates the cluster. Elastic points new buyers who want Platinum-level features toward Elastic Cloud. Both models change who runs upgrades and backups, so compare them against your data residency rules. Ask the vendor to confirm current pricing and included features in writing, since tiers change.
What happens to our historical Splunk data?
Historical data does not move automatically. You choose whether to export and reindex it, keep Splunk read-only for an archive period, or retain only the recent window needed for investigations. Splunk search results can be exported through Splunk Web, the CLI, the REST API and SDKs, and the CLI is the most stable retrieval method according to Splunk's documentation. Confirm the retention obligations that apply to your sector before deciding what to drop.
Can DeployOpen run the migration under a fixed-scope agreement?
Yes, most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted platforms inside your own infrastructure, and prepares evidence for compliance assessments. DeployOpen does not issue audit reports or certifications. Ongoing support and upgrades are available as retainers. A quote follows from the written scope, so share your Splunk inventory first.
How DeployOpen helps you evaluate, implement or migrate
DeployOpen plans, implements, hardens, backs up and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Splunk vs Elastic Security, we start with a written scope that separates what the free Elastic tier covers from the subscription features your detections depend on.
How we scope
- Inventory current Splunk detections, data sources, retention needs and the Splunk Enterprise Security content in use
- Map each correlation search to a detection rule type and flag which ones depend on paid Elastic subscription features
- Agree the subscription tier question, deployment model and endpoint coverage in the written scope before work starts
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing; a quote follows from that scope
How we build
- Deploy a self-managed Elasticsearch and Kibana cluster in your environment, with node roles and tiers sized to your data plan
- Configure Elastic Agent and Fleet for log collection, and Elastic Defend where the endpoint scope calls for it
- Load and tune prebuilt and custom detection rules, then test them against replayed or sample events from your environment
- Integrate case management, authentication and access controls with your existing identity and ticketing systems
How we hand over
- Document architecture, data flows, detection rule inventory and the mapping from each former Splunk search
- Run the existing Splunk and Elastic pipelines in parallel until detection results are reviewed and agreed with your team
- Deliver runbooks for backups, upgrades, index lifecycle management and license or subscription tracking
- Prepare control evidence and configuration records for your compliance assessment; independent auditors issue any attestation
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover
- Plan upgrades around Elastic's published end-of-life dates, confirming current supported release lines with Elastic before each change
- Re-test detection content after upgrades, rule updates or changes in log sources
- Security testing of the deployed stack, including applications, APIs and infrastructure, can be scoped separately
