.conf Go 2023 - Raiffeisen Bank International Speaker: Manuel Traxler - Security Manager

1. © 2023 SPLUNK INC.
Security Manager
Manuel Traxler

2. © 2023 SPLUNK INC.
Unleash the potential of your
analysts:
Empower them to automate like
professionals
Revolutionizing SOPs:
The art of standardization - change the
way of writing SOPs
Increasing efficiency:
the key to faster automation and
reduced workloads

3. © 2023 SPLUNK INC.
.. coordinating the collaboration between
external providers and our team while
ensuring rapid, efficient, and standardized
data enrichment without shooting ourselves
into the foot.
A Challenge
we have to overcome

4. © 2023 SPLUNK INC.
Chapter 1
How to intake & define
SOPs at scale

5. © 2023 SPLUNK INC.
Too many SOPs
Investigation
Steps
SOPs Unique
Investigation
Steps
Different
Categories
for the analyst to
select the steps
relevant to the alert
2000 600 60 6

6. © 2023 SPLUNK INC.

7. © 2023 SPLUNK INC.

8. © 2023 SPLUNK INC.
SOP’s with Benefits
✅ Available as JSON
✅ Store on Code repository for versioning and provisional purposes
✅ SOPs become faster to create and easier to understand
✅ Easy maintaining of SOP through MS PowerApps

9. © 2023 SPLUNK INC.
Chapter 2
Workbooks

10. © 2023 SPLUNK INC.
SOPs living in GIT, not in SOAR
https://git-scm.com/downloads/logos

11. © 2023 SPLUNK INC.
Workbooks!
Workbooks are lists of standard
tasks that you follow when you
evaluate events or cases.
Phase
Task
Phase
Task

12. © 2023 SPLUNK INC.
Chapter 3
Automate investigation

13. © 2023 SPLUNK INC.
Workflow
Investigation
Input Playbooks perform the
investigation steps previously
selected by the use case
author.
Alert
Potentially suspicious activity
found in Splunk SIEM. Alert is
sent to SOAR.
Workbooks
Automation Playbook
identifies triggered Use Case
and applies corresponding
Workbook.

14. © 2023 SPLUNK INC.

15. © 2023 SPLUNK INC.

16. © 2023 SPLUNK INC.
Inspiration
✅ Everybody automates faster
✅ SOPs in “refurbished” format (vendor agnostic)
✅ Don’t waste time