Uploaded bySplunk
Webinar: Splunk Enterprise Security Deep Dive: Analytics
The document is a presentation by Splunk Inc. detailing their enterprise security solutions, including forward-looking statements about the company's performance and product direction. It highlights their accolades, customer base, and various security frameworks and capabilities related to threat detection, incident response, and risk analysis. Splunk emphasizes their analytics-driven approach to security and integration with external applications to enhance their services.
More Related Content
Similar to Webinar: Splunk Enterprise Security Deep Dive: Analytics
Webinar: Splunk Enterprise Security Deep Dive: Analytics
- 1.
- 2. Safe Harbor Statement During the courseof this presentation, we may make forward looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. 2
- 3.
- 4.
- 5. Splunk – Leader in Cybersecurity 5 Company (NASDAQ: SPLK) • Founded 2004, first software release in 2006 •HQ: San Francisco / Regional HQ: London, Hong Kong • Over 2,500 employees, based in 12 countries Business Model / Products • Free download to massive scale • Splunk Enterprise, Splunk Cloud, Splunk Light • Hunk: Splunk Analytics for Hadoop 12,000+ Customers • Customers in 100 countries • 85 of the Fortune 100 • Largest license: Over 1 Petabytes per day
- 6.
- 7.
- 8.
- 9. Splunk Enterprise Security: Frameworks 9 Framework Detail Notable Events Identify noteworthy incidents from events and then manage state Asset & Identityperforms asset and identity correlation for fields that might be present in an event Threat Intelligence Consume and manage threat feeds, data Risk Analysis Identify actions that raise the risk profile of individuals or assets Adaptive Response Interface for retrieving, sending and running actions by integrating with external applications
- 10.
- 11. SIEM Use Cases Critical Capabilities* ES Frameworks *Gartner Research Document : 2016 Critical Capabilities for SIEM Basic Security Monitoring Advanced Threat Defense Forensics and Incident Response Real-Time Monitoring User Monitoring Incident Response and Management Advanced Analytics Threat intelligence & Business Context Advanced Threat Defense Data and Application Monitoring Deployment and Support Flexibility Notable Events Asset & Identity Threat Intelligence Risk Analysis Adaptive Response
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24. Collect, manage Categorize CorrelateSearch Data Management Threat Activity Correlation Data / Notable Events Data Search Threat Intelligence Framework Framework built-in Splunk Enterprise Security
- 25.
- 26.
- 27.
- 32. Insight from Across Ecosystem Effectively leverage security infrastructure to gain a holistic view 1. Palo Alto Networks 2. Anomali 3.Phantom 4. Cisco 5. Fortinet 6. Threat Connect 7. Ziften 8. Acalvio 9. Proofpoint 10. CrowdStrike 11.Symantec (Blue Coat) 12.Qualys 13.Recorded Future 14.Okta 15.DomainTools 16.Cyber Ark 17.Tanium 18.Carbon Black 19.ForeScout Workflow Identity Network Internal Network Security App Endpoints Web Proxy Threat Intel
- 33.
- 34.
- 35.
- 36.
- 37. Splunk Response Process 37 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNowis planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target
- 38.
- 39.