Short overview of Splunk User Group and AIops Use-cases

1. © 2023 SPLUNK INC.
Splunk
User Group
Reboot
March 2023

2. © 2023 SPLUNK INC.
Splunk T-Shirt Company
It’s not just a Platform …. it’s a Lifestyle!!

3. © 2023 SPLUNK INC.
Steering Committee
We can always use an extra hand!

4. © 2023 SPLUNK INC.
User Group Guidelines
● GOAL: Create an authentic, technical forum to share ideas, use-cases and best
practices
● Led by the community - This is not a Sales Forum
● Presentations should be approx. 30 mins with time for discussion
● 2 or 3 topics per meet up (helps broaden the interest)
● Discuss if we want to rotate locations (have some virtual events)
● The group can determine the frequency (at least 1 meeting per quarter)
What to Expect from this forum

5. © 2023 SPLUNK INC.
Become an ACTIVE participant!
● Join the Calgary Splunk User Group
○ https://usergroups.splunk.com/calgary-splunk-user-group/
○
● Join the Calgary Community Hub
○ Posts, Blogs, Idea Exchange
○ https://community.splunk.com/t5/Calgary-User-Group/gh-p/CalgaryUserGroup
○
● Join the Calgary Slack channel
○ Easy connection
○ http://splk.it/slack
○ #calgary
A little bit of setup …. for a whole lot of valuable information

6. © 2023 SPLUNK INC.
Community Resources
● Find Splunk events and seminars in your region:
https://www.splunk.com/en_us/about-us/events.html
● Leverage Splunk Community Resources:
Splunk Answers: Submit questions, Search previous answers,
Splunk IDEAS: Submit ideas for product enhancements or upvote existing ideas
https://www.splunk.com/en_us/community.html
● Check out other Splunk User Groups for interesting topics and ideas
Leverage your peers

7. © 2023 SPLUNK INC.
Some Sample Topics
● XRDR (Cross Region Disaster Recovery)
● Federated Search
● Ingest Actions & Edge Processor
● Risk Based Alerting
● How Security & O11Y Align
● Building Better Dashboards
● Innovative Vertically Aligned Use Cases (Industry specific use-cases)
Please be vocal on what interests you

8. © 2023 SPLUNK INC.
.CONF23 - July 17 - 20th
Las Vegas, NV

9. © 2023 SPLUNK INC.
Please Complete the Survey
Help us Drive the focus and direction of this Group!

10. © 2023 SPLUNK INC.
Thank You!

11. © 2023 SPLUNK INC.
Building
AIOps Use
Cases in
Splunk
March 2023

12. © 2023 SPLUNK INC.
Splunk App for Data Science
& Deep Learning (DSDL)
Built for Data Scientists and Splunk Users
• Code Examples: Guided model building, testing, and deployment
of deep learning frameworks and other data science and machine
learning examples and algorithms
• Container Management: Containers & models can be
productionized for scalability & optimization of resources, e.g. CPU
& GPU
• Frameworks: PyTorch, Tensorflow, SpaCy, DASK, Rapids, Spark,
…
• Tools: Jupyter Lab Notebooks, Tensorboard, MLflow, Spark, GIT, …
Extensible to operationalize any use case
• Open Source: New frameworks & Python Libraries freely available
for integration into DSDL via github
• Acceleration: Support for GPU accelerated data science, machine
learning, deep learning or other inference pipelines
Extension for MLTK to operationalize
advanced custom AI / ML use cases

13. © 2023 SPLUNK INC.
Powershell
Command-Line
Classification
Methods:
- Count Tokenization
- Logistic regression
Technologies:
- MLTK
- Custom Pre-Trained Model Deployment
Requirements:
- Labelled dataset
Details:
- Content Page
- ESCU
Tokenization and Classification could be applied
to a wide range of other data sources:
User-Agents? Web access logs?

14. © 2023 SPLUNK INC.
Windows Event Code
Clustering + Anomaly
Detection
Methods:
- Statistical Analysis
- Clustering (DBScan)
- Unsupervised
Technologies:
- MLTK
Requirements:
- Windows event code data
- Well controlled environment
Details:
- .conf21

15. © 2023 SPLUNK INC.
Domain Generation
Algorithm Detection
Methods:
- Feature Engineering
- Text Entropy
- PCA
- Ngram Analysis
Technologies:
- MLTK/DSDL
Requirements:
- DNS Data
Details:
- DGA App - MLTK
- ESCU Content - DSDL
A very good example of an application of labelled
data to a useful classifier in Splunk

16. © 2023 SPLUNK INC.
JA3 Signature
Analysis
Methods:
- One-hot Encoding
- UMAP
Technologies:
- DSDL
Requirements:
- JA3 Signature Data (Zeek)
Details:
- Blog
- Talk (Upcoming)
- DSDL Notebook
JA3 Signatures are a challenge to understand as
they are very high cardinality. UMAP allows
visualising a complex high-cardinality space.
Could be extended to generic behaviors?
Host Classification based on CIM features?