Session Sponsored by Splunk: Splunk for the Cloud, in the Cloud
•
5 likes•1,646 views
As more critical workloads move to the cloud, there is a need for increased levels of operational intelligence. Organisations need to ensure that mission-critical cloud deployments adhere to security and compliance standards. They also need to ensure application performance and uptime in the cloud meet customer expectations. To meet these needs, Splunk has closely aligned with AWS to deliver solutions that offer real-time visibility into cloud management, infrastructure, billing and services. Attend this session to learn how Splunk can help you move to the cloud with agility and confidence Speaker: Richard Smith, Alliance Manager, ANZ and Simon O’Brien; Senior Systems Engineer, Splunk
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Session Sponsored by Splunk: Splunk for the Cloud, in the Cloud
Similar to Session Sponsored by Splunk: Splunk for the Cloud, in the Cloud (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
Session Sponsored by Splunk: Splunk for the Cloud, in the Cloud
- 3. Federal Government Observations Today’s agenda – Digital Transformation – Delivering balance of Innovation through IT while keeping lights on – Operating under challenging conditions Security and Citizens privacy and protection Decreasing resources, increasing complexity Opportunity to leverage platforms such as AWS and Splunk. 3
- 5. Big Data Comes from Machines Volume | Velocity | Variety | Variability GPS, RFID, Hypervisor, Web Servers, Email, Messaging, Clickstreams, Mobile, Telephony, IVR, Databases, Sensors, Telematics, Storage, Servers, Security Devices, Desktops 5
- 6. Building a Big Data Platform HA / DR Admin Data Security Apps SDKs/APIScale Collect Data Index Data Enrich Data Search & Explore Analyze & Predict Report & Visualize Alert & Action 6
- 7. Fully Integrated Enterprise Platform HA / DR Admin Data Security Apps SDKs/APIScale Collect Data Index Data Enrich Data Search & Explore Analyze & Predict Report & Visualize Alert & Action 7
- 8. Structured RDBMS SQL Search Schema at Write Schema at Read Traditional Splunk Splunk Approach to Machine Data Copyright © 2014 Splunk Inc. 8 ETL Universal Indexing Volume Velocity Variety Unstructured
- 18. Copyright © 2016 Splunk Inc. Historical Data Real-time Data Statistical Models DB, Hadoop/S3/NoSQL, Splunk Machine Learning T – a few days T + a few days Why is this so challenging using traditional methods? • DATA IS STILL IN MOTION, still in a BUSINESS PROCESS. • Enrich real-time MACHINE DATA with structured HISTORICAL DATA • Make decisions IN REAL TIME using ALL THE DATA • Combine LEADING and LAGGING INDICATORS (KPIs) Splunk Security Operations Center Network Operations Center Business Operations Center
- 20. Auto Scaling group Availability Zone #1 security group security group root volume data volume Amazon S3 bucket logs Amazon EBS snapshot CloudFront distribution EC2 instance web app server CloudWatch CloudTrail Config Region(s) Sample AWS Infrastructure
- 21. Auto Scaling group Availability Zone #1 security group security group root volume data volume Amazon S3 bucket logs Amazon EBS snapshot CloudFront distribution EC2 instance web app server CloudWatch CloudTrail Config Region(s)
- 22. Splunk Components Search, correlate, report, visualize and alert on AWS data 22 Add-on for AWS Splunk App for AWS Explore Analyze Dashboard Alert Collect, parse, extract and normalize AWS machine data
- 23. 23 Splunk App for AWS EC2 EMR Kinesis R53 VPC ELB S3 CloudFront CloudTrail CloudWatch Redshift SNS API Gateway Config RDS CF IAM Lambda Explore Analyze Dashboard Alert Act AWS Data Sources End State: Comprehensive AWS Visibility
- 24. Hybrid 24 Search Head(s) Indexer(s) On Premises Private Cloud Public Cloud Search Head(s) Indexer(s) On Premises Private Cloud Public Cloud Hybrid Search Single Pane of Glass Visibility
- 27. Three Main Use Cases IT Operations – Remediation of Complex Issues – Move from Break-fix to Service Delivery Security – Monitor known and unknown security risks – Deliver insights and forensic capacibility Analytics – Provide new insights into data Agency already has – Real-time data analysis and insights 27
- 31. Challenges: • Analyze website visits and visitor habits in real-time • Cater to a diverse set of users • ETL process was slow & expensive; tool was overkill • Manual recovery process, time away from real work Value delivered: • Deeper insights with fast searches over larger logs • Ability to mirror KPIs and scorecards as that of prior BI tool • Excited and happy users – real-time data, new insights, better metrics • Better user experience - track session usage and form use 31 European Patent Office – Better Insights, Happier Users “Suddenly we have people who were never directly interested in web analytics… they want to access Splunk because now they can see things in real time, like the dashboards, gain new insights.”
- 32. Challenges: • Proactive hunting of cyber adversaries • Resource (analysts) constraints • Cumbersome malware detection process • Myopic visibility into the network Value Delivered: • Went from reactive to proactive • Made Tier 1 analysts immediately effective • Holistic visibility across network • Bonus: IT Operations troubleshooting • Validate security deployment decisions 32 White House Military Office – From Hunted to Hunter “Splunk has helped us take Tier 1 security analysts and make them immediately effective to defend our network.”
- 33. Splunk Use: • Monitor and analyze IT systems and network behavior for the Autonomic Logistics Information System (ALIS), supporting the F-35 Lightning • Visibility into enterprise application performance issues from the end- user perspective • Application trouble shooting • Compliance and Auditing (DFARS, NIST 800.171 and .53) Value Delivered: • Within days of deployment, discovered infrastructures they didn’t know they had • Identified performance issues and insights into anamoloies 33 JSF/ F-35 uses Splunk for Compliance Security, Application Management/ Dev Ops. “F-35 aircraft are flying data centers that generate a massive amount of information on each flight. The IT systems and applications supporting this program are essential, and Splunk Enterprise’s role is to support daily ALIS operations.”
- 34. Challenges: • Ensure FISMA and agency level policy compliance • Ability to pinpoint unusual behavior or traffic • Silos of visibility and operations Value Delivered: • Dashboard specifically for FISMA compliance • Deep forensics to investigate advanced threats • Understand abnormal and unusual behavior • Dynamic situational awareness 34 NASA Earth Observing System – Easier Compliance and Improved Security Posture “Splunk is the way forward. It helps you find a needle in a haystack.”
- 35. Better Code, Faster Development and Migration to Cloud • Reduced error rates by 2 orders of magnitude in a couple of weeks • Rapidly found and fixed one line of code responsible for 30,000+ errors • Real-time dashboards on error rates and production impact • In-depth visibility as they strategically migrate apps to AWS Cloud
- 39. FREE CLOUD TRIAL FREE DOWNLOAD FREE AMAZON MACHINE IMAGES (AMI) 39 Easy to Try & Get Started 1 32
- 40. Thank you
- 42. Agenda • This session is meant for AWS users who are setting up the Splunk App for AWS (or people who will be doing so after this session!). • Using the Splunk App for AWS you will gain visibility across your AWS Deployment.
- 43. Agenda • AWS Components • Permissions for SQS, SNS and S3 buckets • Setting up Splunk App for AWS • Questions & Answers – at the Splunk booth after this session!
- 44. Splunk Offerings in AWS • Splunk App for AWS: Integrates w/CloudTrail, Config and Billing, VPC Flow Logs Integrations• Self-managed cloud deployments • Self-deploy in AWS • Integrated with EMR • Search data in S3 • Hourly pricing Self-managed • Cloud service designed for small IT environments • $90 a month • Splunk Enterprise as a service • Full app, SDK, API, platform support Cloud-service
- 45. AWS Architecture Diagram Amazon Instances Amazon Logging Layer Amazon Messaging Amazon Storage / Queues Splunk Collects the data from the AWS SQS and the S3 bucket using the AWS SDK for python (Boto3). S3 Bucket AWS ConfigAWS CloudTrail AWS CloudWatch AWS SQS AWS SNSSNS Topic AWS Instance with CloudWatch VPC Flow Logs
- 46. Requirements For Splunk App For AWS • Splunk • Splunk 6.1 or later • Splunk Add-on for Amazon Web Services • Splunk Add-on for Amazon Web Services +1.1.0 required for AWS Config • AWS • AWS CloudTrail: Enable CloudTrail with SQS and SNS. • AWS Config: Enable Config with SQS and SNS. • Billing: Refer to the AWS documentation to turn on AWS detailed billing. • VPC Flow Logs: Enable VPC Flow log collection.
- 55. THANKYOU