Cisco lays out security, observability plans for Splunk

Cisco's first order of business now that its acquisition of Splunk has closed is to integrate its Talos threat intelligence with Splunk's security tools, among other plans to consolidate and integrate the combined companies' security and observability products.

Company officials laid out a five-point integration plan in a blog post this week after disclosing the deal's closure six months after it was first announced. Integration plans will focus on AI, security, observability, network management and tool consolidation.

The security category included the most specific details of the five, beginning with integrating Talos with Splunk over the next several months. Eventually, Cisco plans to feed cloud, network and endpoint monitoring data from its products into Splunk's security information and event management (SIEM) and security orchestration, automation and response tools. Cisco and Splunk security tools will also combine virtual assistants.

In observability, Cisco plans "a common experience and workflow optimizations across the Cisco and Splunk Observability portfolios," according to the blog post. "In time, IT and engineering teams can expect AI-driven root cause analysis enhancements and assistants, inclusive of Splunk IT Service Intelligence."

Splunk and Cisco tools will combine into a secure networking tool, the blog continued, although it did not provide further detail. Ultimately, "we believe the market trend towards tool consolidation -- and the convergence of networking, security, and observability -- creates a significant opportunity for Cisco and our customers," the post read.

While the two companies have plenty of overlapping products, one Splunk customer said he sees each bringing separate strengths into the product integration.

"Splunk tried very hard in the observability space by bringing in Splunk Observability. We demoed it, and it was decent but nowhere near as mature as other platforms," especially in application performance management, said Steve Koelpin, lead Splunk engineer for a Fortune 1,000 company in the Midwest. "Cisco is much more mature on that front, and it will be really good to bring in Splunk, which is a leader with logs and metrics."

Andy Thurai

Still, the amount of overlap between tools could force some potentially difficult architectural decisions, said Andy Thurai, an analyst at Constellation Research. He pointed to the unfinished work of merging logs from Splunk Cloud with Splunk Observability Cloud as an example.

"Then, which model stays," he asked. "AppDynamics? Or do you bring everything into the full-stack observability model that they're building?" 

Cisco has drawn criticism in the past for how long it's taken the company to fully integrate its acquisitions, including AppDynamics, which Cisco acquired in 2017. Full integration with other Cisco acquisitions such as ThousandEyes and Portshift, both acquired in 2020, didn't become generally available until mid-2023.

Integrations with Splunk will likely happen faster than that, Thurai said. But he predicted it will be at least two years before Splunk integration plans come to fruition.

"It's a pretty decent portfolio, but how it all comes together is anyone's guess," Thurai said. "Given the size of this acquisition, nothing is going to happen at least for a couple of years. … That's not new or just for Cisco. The same thing happens with any big company."