Back to Splunk Professional Services
SERVICE GROUP: Implementation & Optimization
Migration from Another SIEM
Planned replacement of SIEMs such as QRadar or ArcSight with Splunk Enterprise Security.
Service objective
Carry out the planned replacement of SIEM solutions such as QRadar, ArcSight, or others, migrating data, configurations, and use cases to Splunk Enterprise Security while guaranteeing full operational continuity and minimizing transition risk.
Scope by SKU
| SKU | Focus | SKU code |
|---|---|---|
| Up to 5 sources and 5 use cases | Initial migration integrating up to 5 critical sources and activating 5 equivalent use cases in Splunk. | SRV-IMP-MIG005-GL-01 |
| Up to 10 sources and 10 use cases | Migration integrating up to 10 sources and 10 use cases, correlation optimization, and initial dashboards. | SRV-IMP-MIG010-GL-01 |
| Up to 20 sources and 20 use cases | Full migration with up to 20 sources and 20 use cases, adaptation of complex cases, technical and executive dashboards. | SRV-IMP-MIG020-GL-01 |
Deliverables
- Migration plan and target architecture document.
- Source configuration and ingestion in Splunk.
- Adapted and validated use cases.
- Final report with improvements and recommendations.
Prerequisites
- Administrative access to the current SIEM platform and to Splunk.
- Inventory of active sources and use cases.
- Active Splunk Enterprise Security license.
Service results
- Operational continuity throughout the SIEM transition.
- Sources and use cases migrated and optimized in Splunk.
- Functional dashboards and alerts adapted to the new platform.
- Reduced dependency on the previous platform.
Roles involved
- Security and data architect.
- Use case consultant.
- Administrator of the current SIEM and Splunk.
Differentiators
- Based on real SIEM replacement experience in LATAM.
- Official Splunk SIEM Replacement Workshop methodology.
- Preservation of business logic and key reports.
- Reduced operational impact during the change.
- Recommendations to optimize what was migrated into Splunk.
- Minimizes coexistence time between platforms.
- Use cases adapted to frameworks such as MITRE ATT&CK.