Presentation slides from Splunk Discovery held in Köln on January 17th 2020.

1. © 2019 SPLUNK INC.
Splunk Incident Response,
Orchestrierung und
Automation
Splunk Discovery Köln
17. Januar 2020

2. During the course of this presentation, we may make forward‐looking statements
regarding future events or plans of the company. We caution you that such statements
reflect our current expectations and estimates based on factors currently known to us
and that actual events or results may differ materially. The forward-looking statements
made in the this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, it may not contain current or
accurate information. We do not assume any obligation to update
any forward‐looking statements made herein.
In addition, any information about our roadmap outlines our general product direction
and is subject to change at any time without notice. It is for informational purposes only,
and shall not be incorporated into any contract or other commitment. Splunk undertakes
no obligation either to develop the features or functionalities described or to include any
such feature or functionality in a future release.
Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud,
Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the
United States and other countries. All other brand names, product names, or
trademarks belong to their respective owners. © 2019 Splunk Inc. All rights reserved.
Forward-
Looking
Statements
© 2019 SPLUNK INC.

3. © 2019 SPLUNK INC.
Beate Passul
Senior Sales Engineer

4. © 2019 SPLUNK INC.
Security Operations Practices
Need to Change
• Too Many Alerts
• Not Enough Insights
• Too Many
• No Integration
• Attracting
• Training
• Retaining
Incident
Response Tools Skills
• Orchestration &
Automation
• Horizontal & Vertical
Scale

5. © 2019 SPLUNK INC.
Incident
Response
Challenge

6. © 2019 SPLUNK INC.
Incident Response Takes Significant Time
Source: SANS 2017 Incident Response Survey
1-3 months
2–7 days
Time from Compromise To Detection Time from Detection To Containment Time from Containment To Remediation

7. © 2019 SPLUNK INC.
Where Does Your Time Go?
When working an incident, which phase generally takes the longest to complete
in your organization?
Day in the life of a security professional survey © 2016 EMA, Inc.

8. © 2019 SPLUNK INC.
Time-to-Contain + Time-to-Remediate =
86%
When working an incident, which phase generally takes the longest to complete
in your organization?
Day in the life of a security professional survey © 2016 EMA, Inc.

9. © 2019 SPLUNK INC.
Tools

10. © 2019 SPLUNK INC.
Poll #1
How many security tools and technologies does your company use?
• < 10
• 10–25
• 26–50
• 51–75+

11. © 2019 SPLUNK INC.
Tools and Technologies Galore
TOO MANY TOOLS
On average, organizations are using
between 25 and 30 different security
technologies and services.
Source: CyberSecurity Analytics and Analytics in Transition, ESG, 2017

12. © 2019 SPLUNK INC.
Skills and
Scale
Orchestration and Automation

13. © 2019 SPLUNK INC.
Orchestration vs. Automation
Orchestration
• Security Orchestration is the machine-based
coordination of security actions across tools and
technologies.
• Brings together or integrates different
technologies and tools
• Provides the ability to coordinate informed
decision making, formalize and automate
responsive actions
Automation
• Security Automation is the machine-based
execution of security actions.
• Focus is on how to make machines do
task-oriented "human work”
• Improve repetitive work, with high confidence
in the outcome
• Allows multiple tasks or "playbooks" to
potentially execute numerous tasks

14. © 2019 SPLUNK INC.
Poll #2
Do you use Security Orchestration Automation and Response (SOAR)?

15. © 2019 SPLUNK INC.
SOAR
Maestro
App
actions
App
actions
App
actions
App
actions
App
actions
App
actions
App
actions
App
actions
App
actions
App
actions
Playbook

16. © 2019 SPLUNK INC.
Automation & Orchestration
Adoption Growing
Source: CyberSecurity Analytics and Analytics in Transition, ESG, 2017

17. © 2019 SPLUNK INC.
Security
Nerve Center
Overview

18. © 2019 SPLUNK INC.
Security Nerve
Center
Orient
Observe
Decide
Act
Network
Identity & Access
Threat
Intelligence
Mobile
EndpointsCloud Security
WAF & App
Security
Web Proxy Firewall
Analytics
Orchestration

19. © 2019 SPLUNK INC.
Splunk Security Portfolio
DATA PLATFORM
ANALYTICS OPERATIONS
Platform for Machine Data

20. © 2019 SPLUNK INC.
Adaptive Operations Framework
Mission
• Deeply integrate with the best
security technologies to
improve cyber defenses and
maximize operational
efficiency.
Approach
• Gather, analyze, share, and
take action using end-to-end
context across across multiple
security domains.
Partner ecosystem enables the Security Nerve Center
Network
Identity & Access
Threat
Intelligence
EndpointsCloud Security
WAF & App
Security
Web Proxy Firewall
Operations
Data / Analytics
Splunk Phantom
Apps & Playbooks
Splunk Enterprise Security
Adaptive Response Actions
Splunkbase
Apps & Add-Ons
240+ Integrations / 1,200+ APIs

21. © 2019 SPLUNK INC.
Phantom
Security Operations

22. © 2019 SPLUNK INC.
Operationalizing Security
Integrate your team,
processes, and tools together.
• Work smarter by automating repetitive
tasks allowing analysts to focus on
more mission-critical tasks.
• Respond faster and reduce dwell times
with automated detection, investigation,
and response.
• Strengthen defenses by integrating
existing security infrastructure together
so that each part is an active
participant.
With Phantom
Automation
Event Management

23. © 2019 SPLUNK INC.
Automation
• Automate repetitive tasks to force
multiply team efforts.
• Execute automated actions in
seconds versus hours.
• Pre-fetch intelligence to support
decision making.
Automation
Event Management

24. © 2019 SPLUNK INC.
Orchestration
• Coordinate complex workflows across your
SOC.
• 200+ Apps & growing
• 1000+ API’s
Automation
Event Management

25. © 2019 SPLUNK INC.
Case
Management
• Create case templates that replicate your
SOPs.
• Manage your response to threats with
precision.
• Embed automation within a case task.
Automation
Event Management

26. © 2019 SPLUNK INC.
How it Works
Automated Malware
Investigation
• “Automation with Phantom
enables us to process
malware email alerts in
about 40 seconds vs.
30 minutes or more.”
— Adam Fletcher, CISO
A Phantom Case Study
SANDBOX QUERY RECIPIENTS
USER PROFILE
HUNT FILE
HUNT FILE
FILE REPUTATION
FILE ASSESSMENT
RUN PLAYBOOK
“REMEDIATE"
EMAIL ALERT

27. © 2019 SPLUNK INC.
Demo

28. © 2019 SPLUNK INC.

29. © 2019 SPLUNK INC.

30. © 2019 SPLUNK INC.

31. © 2019 SPLUNK INC.

32. © 2019 SPLUNK INC.

33. © 2019 SPLUNK INC.

34. © 2019 SPLUNK INC.

35. © 2 0 1 9 S P L U N K I N C .
Splunk Phantom on your mobile device
• Phantom on Splunk Mobile brings the power of
Phantom security orchestration, automation, and
response (SOAR) capabilities to your mobile device.
• No need to open your laptop. Orchestrate
security operations from the palm of your
hand.
• Respond faster than ever before, because
you’re reachable from anywhere.
• Run playbooks, triage events, and
collaborate with colleagues – all on-the-go.

36. © 2019 SPLUNK INC.
Key
Takeaways
Splunk offers options to
accelerate incident response
with orchestration and
automation
1) Use Phantom with Splunk or Splunk
Enterprise Security to accelerate Incident
Investigation and Response
2) Use Adaptive Operations Framework to
realize your security nerve center
3) Splunk offers market proven,
comprehensive solutions for Incident
Response
4) Use with all Security domains and related IT
domains to solve incident response use
cases and more

37. © 2019 SPLUNK INC.
Join our community
get access to playbooks and app integrations
https://my.phantom.us

38. © 2019 SPLUNK INC.
Agenda
Splunk Discovery
Köln
17. Januar 2020
09:00–10:30 Keynote und Demo – Die Data-to-Everything Plattform
10:30–11:00 Pause
Tech Track (Jupiter I+II) Business Track (Saturn I+II)
11:00–11:45
Mit der Splunk Plattform Daten in
Mehrwert umwandeln
ROI in Datenprojekten (in English)
11:45–12:30
Abenteuer bei Monitoring und
Troubleshooting
Kunden Use Cases
12:30–13:30 Mittagessen
13:30–14:15 Security Analytics Methoden Die Zukunft von Security Operations
14:15–15:00
Splunk Incident Response,
Orchestrierung und Automation
Die Zukunft von ITOA – von Monitoring zu
Observability
15:00–15:30 Pause
15:30–16:15 Kunden Use Case: TÜV Trust IT
16:15–17:00 Networking Drinks

39. Thank You
© 2019 SPLUNK INC.