Bringing Mainframe Security Information Into Your Splunk Security Operations Center
•Download as PPTX, PDF•
0 likes•142 views
In today’s always-on IT world, a single security breach can bring your business to a standstill. You rely on Splunk’s powerful platform for monitoring, integrating, analyzing and visualizing security data from across your enterprise to protect your organization from security threats and incidents. However, Splunk doesn’t natively interact with mainframe and IBM i systems, leaving a glaring blind spot. Join us to learn how to effectively integrate Mainframe and IBM i security data into Splunk- providing you with a comprehensive view of your security operations landscape. Topics will include: - An overview of different types of security data and how to tap into mainframe & IBM i data in your Splunk Security Operations Center - Unique and comparative differentiators across security data integration tools to be used within the Splunk Security Operations center - Customer use cases and examples
Recommended
More Related Content
What's hot
What's hot (14)
Similar to Bringing Mainframe Security Information Into Your Splunk Security Operations Center
Similar to Bringing Mainframe Security Information Into Your Splunk Security Operations Center (20)
More from Precisely
More from Precisely (20)
Recently uploaded
Recently uploaded (20)
Bringing Mainframe Security Information Into Your Splunk Security Operations Center
- 1. Bringing Mainframe Security Information into Your Splunk Security Operations Center Eric Sorenson, Cyber Security Specialist, Splunk Peter Coppenrath, Director of Technology Alliances, Precisely David Friedman, Senior Sales Engineer, Precisely
- 2. Housekeeping Webinar Audio • Today’s webcast audio is streamed through your computer speakers • If you need technical assistance with the web interface or audio, please reach out to us using the Q&A box Questions Welcome • Submit your questions at any time during the presentation using the Q&A box. If we don't get to your question, we will follow-up via email Recording and slides • This webinar is being recorded. You will receive an email following the webinar with a link to the recording and slides
- 3. The leader in data integrity Our software, data enrichment products and strategic services deliver accuracy, consistency, and context in your data, powering confident decisions. of the Fortune 100 97 countries 100 2,500 employees customers 12,000 Brands you trust, trust us Data leaders partner with us 3 3
- 4. Splunk for Security Full-Fidelity | Real-Time Streaming | Massively Scalable | AI/ML-driven Analytics (Apps, Technical Architectures, Connectors, Partners, Community) +
- 5. Accelerating automation with innovation in intelligence Deep integration across the portfolio
- 6. Assumption of Incompatability 6 Unix Linux Windows Easy Data Sharing Unified Security Concepts Monitor together Mainframe & System i Isolated systems Incompatible Security Concepts Platform specific monitoring
- 7. Unified Security Monitoring 7 SYSOUT LOG4j SMF Records SYSLOG Desktops Telecoms GPS Locations Storage Network Servers Devices Databases Custom Apps 360 View Unix Linux Windows Easy Data Sharing Unified Security Concepts Monitor together Mainframe & System i Isolated systems Incompatible Security Concepts Platform specific monitoring
- 8. Sources of Mainframe Machine Data System State SYSSOUT Live SPOOL Db2 USS Alerts Network Components Forwarder API SYSLOG SYSLOGD SMF RMF File Load Log4j IMS A breadth of information unsurpassed. 8
- 9. Security SMF Record Types 9 Record Description Record Description Record Description IPL Header Integrated Catalog Facility Define Activity DB2 Statistics SMF Dump Header VSAM Component or Cluster Opened DB2 Accounting SMF Dump Trailer VSAM Component or Cluster Status DB2 Performance, Audit, and Monitor Step Termination Integrated Catalog Facility Delete Activity CICS SMF Data Records SMF Data Lost Integrated Catalog Facility Alter Activity Subtype 1 Class 3 - Performance Data I/O Configuration RMF Processor Activity Subtype 1 Class 4 - Exception Data Vary Device Online RMF Paging Activity Subtype 2 - CICS Statistics Vary Device Offline RMF Activity (Subtypes 1 thru 5) Hardware Capacity, Reporting, and Statistics Data Set Activity RMF Channel Path Activity WebSphere MQ Performance Statistics Data Set Activity RMF Activity of Several Resources (Subytpes 1-8) WebSphere MQ Accounting Data DFSORT Statistics RMF Page Data Set Activity Message Flow Accounting and Statistics Scratch Data Set Status RMF Trace Activity TCP/IP Statistics Rename Non-VSAM Data Set Status RMF Enqueue Activity TCP Records Direct Access Volume RMF Virtual Storage and I/O Queuing Activity WebSphere Application Records Vital Signs for VTAM(SDS) RMF II Activity (Subtype 15) Connect:Direct Statistics Records Common Address Space Work Security Product Processing Compuware Abend-Aid Dynamic DD RACF Initialization Syncsort Ironstream SMF records DIV Objects and VLF Statistics Integrated Cryptographic Service facility Syncsort MFX SMF Records DFSMS Statistics and Configuration RACF Audit Data Compuware Application Audit VTAM Tuning Statistics System Status ACF2 Security Product JES2 Network SYSOUT Transmission File System Activity BMC CMF Monitor record VSAM Volume Data Set Updated System Resource Manager (SRM) Decisions DFSMShsm Function Statistics IBM Session Manager
- 10. A Simple, Scalable, Efficient Approach! 10 Get all your security information • Collect critical mainframe log data: SMF records, SYSLOGs, SyslogD, Log4j, mainframe files, and more in real time • Translate, transform and prepare mainframe machine data for easier analysis • Securely forward into Splunk® Enterprise for real-time operational intelligence and visualization • Scale to billions of SMF records and SYSLOGs per day with minimum impact to your mainframe SYSOUT LOG4j SMF Records SYSLOG Desktops Telecoms GPS Locations Storage Network Servers Devices Databases Custom Apps 360 View
- 11. See Attacks in Splunk ES 11
- 12. Access Issues 12
- 14. Thank You
Editor's Notes
- With Splunk for Security, your SOC team can take advantage of the integrated modern SOC platform with industry-leading SIEM, UEBA, and SOAR solutions.