Softwr

Security & Cybersecurity · head to head

Microsoft Defender for Endpoint vs Splunk Enterprise Security

Microsoft Defender for Endpoint logo

Microsoft Defender for Endpoint

Security & Cybersecurity

Enterprise endpoint security built into Microsoft 365

From
On request
Rated
-
Full reviewWebsite
Splunk Enterprise Security logo

Splunk Enterprise Security

Security & Cybersecurity

The platform for operational intelligence

From
On request
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: Microsoft Defender for Endpoint pricing not published on public websites; quote required from Microsoft sales; Splunk Enterprise Security splunk Enterprise Security is licensed separately from the Splunk platform, so a SIEM deployment needs both
  • They diverge on capability: Microsoft Defender for Endpoint covers Threat & vulnerability management, Splunk Enterprise Security covers Security monitoring.

Where they differ

Only the attributes on which Microsoft Defender for Endpoint and Splunk Enterprise Security actually diverge.

Attributes where Microsoft Defender for Endpoint and Splunk Enterprise Security differ
AttributeMicrosoft Defender for EndpointSplunk Enterprise Security
Pricing modelquotesubscription
PlatformsWindows, macOS, Linux, iOS, AndroidWeb, Api
Founded19752003

Identical on both: starting price (On request), free tier (No), user rating (Not yet rated), category (Security & Cybersecurity).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Microsoft Defender for Endpoint

  • Threat & vulnerability management
  • Attack surface reduction
  • Next-gen protection
  • EDR
  • Auto investigation
  • Microsoft Threat Experts
  • Threat analytics
  • Secure score

Only in Splunk Enterprise Security

  • Security monitoring
  • Incident review
  • Risk-based alerting
  • Threat intelligence
  • Investigation workbench
  • MITRE ATT&CK mapping
  • Automated response
  • Compliance reporting

Both cover

  • ServiceNow
  • ISO 27001
  • FedRAMP

What people use each for

The jobs each tool is most often brought in to do.

Microsoft Defender for Endpoint

  • Enterprise endpoint security across Windows, macOS, Linux, Android, and iOS via Plans 1 or 2not Splunk Enterprise Security
  • Small and medium-sized businesses using Microsoft Defender for Business as alternativenot Splunk Enterprise Security
  • Organisations using Microsoft 365 E5 which includes Defender for Endpoint Plan 2not Splunk Enterprise Security

Splunk Enterprise Security

  • Running a security operations centre on Splunk indexed log datanot Microsoft Defender for Endpoint
  • Correlation searches, risk based alerting and incident investigationnot Microsoft Defender for Endpoint
  • Compliance reporting from pooled security telemetrynot Microsoft Defender for Endpoint

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Microsoft Defender for Endpoint

  • Pricing not published on public websites; quote required from Microsoft sales
  • Defender for Endpoint Plan 1 and Plan 2 do not include server licenses; additional licensing required for server protection
  • Specific feature differences between Plan 1 and Plan 2 require consulting Microsoft documentation

Splunk Enterprise Security

  • Splunk Enterprise Security is licensed separately from the Splunk platform, so a SIEM deployment needs both
  • Splunk publishes no rate for Enterprise Security and directs buyers to contact a pricing expert
  • UEBA, SOAR and automated threat analysis require the Premier edition rather than Essentials
  • The platform underneath can be billed by ingest volume, workload or activity, so the total cost depends on a pricing model chosen at contract time rather than a list price

Pricing, plan by plan

Microsoft Defender for Endpoint

On request

No published plan breakdown. See the Microsoft Defender for Endpoint review.

Splunk Enterprise Security

On request
  • Workload PricingFree
    • Pay per compute
    • Flexible scaling
    • All features
  • Ingest PricingFree
    • Pay per GB ingested
    • Predictable costs
    • All features
  • Entity PricingFree
    • Pay per monitored entity
    • Security focused
    • All features

Which should you pick?

Choose Microsoft Defender for Endpoint if

  • You need threat & vulnerability management.
  • You work on Windows, macOS, Linux, iOS, Android.
  • You also want attack surface reduction.
Microsoft Defender for Endpoint review

Choose Splunk Enterprise Security if

  • You need security monitoring.
  • You work on Web, Api.
  • You also want incident review.
Splunk Enterprise Security review

Questions people ask

Is Microsoft Defender for Endpoint or Splunk Enterprise Security better?
Neither clearly leads. Microsoft Defender for Endpoint starts at On request and Splunk Enterprise Security at On request, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Microsoft Defender for Endpoint or Splunk Enterprise Security?
Microsoft Defender for Endpoint starts at On request and Splunk Enterprise Security at On request.
Does Microsoft Defender for Endpoint or Splunk Enterprise Security run on more platforms?
Microsoft Defender for Endpoint runs on Windows, macOS, Linux, iOS, Android. Splunk Enterprise Security runs on Web, Api.
What is Microsoft Defender for Endpoint best used for?
Microsoft Defender for Endpoint is most often used for enterprise endpoint security across windows, macos, linux, android, and ios via plans 1 or 2, small and medium-sized businesses using microsoft defender for business as alternative, organisations using microsoft 365 e5 which includes defender for endpoint plan 2. Of those, enterprise endpoint security across windows, macos, linux, android, and ios via plans 1 or 2 and small and medium-sized businesses using microsoft defender for business as alternative are not what Splunk Enterprise Security is typically brought in for.
What can Microsoft Defender for Endpoint do that Splunk Enterprise Security cannot?
Microsoft Defender for Endpoint covers Threat & vulnerability management, Attack surface reduction, Next-gen protection, EDR. Splunk Enterprise Security covers Security monitoring, Incident review, Risk-based alerting, Threat intelligence. Both handle ServiceNow, ISO 27001, FedRAMP.
ShareXLinkedInRedditWhatsAppEmail

Related pages

More on Microsoft Defender for Endpoint

More on Splunk Enterprise Security

Keep looking

Other head to heads