This presentation introduces Splunk Enterprise Security (ES) and its security portfolio. It discusses Splunk's workflow and frameworks that enable key security use cases. The frameworks presented include Notable Events, Asset and Identity, Risk, Threat Intelligence, and Adaptive Response. Desh Cyber is highlighted as a reliable partner that provides Splunk-based security solutions along with training and 24/7 monitoring services.

1. Presentation Topics : Splunk Enterprise Security(ES).
Presenter : Md Mofijul Haque
Business Development Executive
Sabuz@deshcloud.com

2. OUTCOME….
 INTRODUCE WITH SPLUNK ENTERPRISE SECURITY(ES)
SPLUNK SECURITY PORTFOLIO
SPLUNK WORKFLOW & FRAMEWORK
FRAMEWORKS ENABLE USE CASES
WHY DESH CYBER IS RELIABLE
Q&A

3. SPLUNK TURNS MACHINE DATA INTO
ANSWERS

4. MOSTLY FACED SECURITY OPERATIONS NOW
A DAYS

5. SPLUNK WORK AS
FULLY OPTIMIZED FOR MODERN SECURITY
OPERATIONS

6. SPLUNK SECURITY PORTFOLIO

7. HOW SPLUNK ETERPRISE SECURITY WORKS

8. SPLUNK ENTERPRISE SECURITY FRAMEWORK

9. WORKFLOW FOR STREAMLINED INCIDENT
MANAGEMENT
NOTABLE EVENTS FRAMEWORK
Streamline Incident
Management
Consolidated incident
management allows effective
lifecycle management of
security incidents. Make Rapid Decisions
Automatically aligns all
security context together for
fast incident qualification
and provides predefined
analysis paths
Refine Security Management
Investigation management and
customizations to support
complex process integration
requirements.

10. NOTABLE EVENTS AND INCIDENT REVIEW
Use for Security Operations
“Application” logics are pre-built on
top of Splunk Enterprise as data
platform.
Provide graphically oriented user
experience supporting the security
operations workflow
Intuitive User Interface Optimized for
Security
Operations
Security operational tasks designed
into user interface versus search bar
interface.
Key relevant information
automatically presented as summary
of incident.

11. INCIDENT REVIEW INTERFACE

12. SEARCH AND NAVIGATION INTERFACE

13. CONSOLIDATED INCIDENT MANAGEMENT
INTERFACE

14. WORKFLOW PROCESS 1: EVENT OVERVIEW

15. WORKFLOW PROCESS 2: INCIDENT CONTEXT

16. WORKFLOW PROCESS 3: ANALYSIS ACTIONS

17. WORKFLOW PROCESS 4: REMEDIATION
ACTIONS

18. NOTABLE EVENT FRAMEWORK

19. ASSET AND IDENTITY FRAMEWORK
Automatically maps asset and identity context to incidents
Fast Incident
Qualification
By automating
context enrichment,
SecOps can qualify
more incidents
quickly
Extended Situation Based
Insights
Rich enrichment allows
more accurate assessment
of situational aspect of
incidents

20. SECURITY ENRICHED CONTEXT..

21. ASSET AND IDENTITY FRAMEWORK : ASSET
DATABASE

22. ASSET AND IDENTITY FRAMEWORK : IDENTITY
DATABASE

23. ASSET AND IDENTITY FRAMEWORK :
ENRICHMENT

24. REPRESENTATIVE LIST OF ASSETS AND
IDENTITIES

25. ASSET AND IDENTITY FRAMEWORK

26. RISK FRAMEWORK
Quantitative metrics are applied to distinguish
importance

27. RISK ANALYSIS DASHBOARD

28. RISK ANALYSIS WITH INCIDENT REVIEW

29. RISK FRAMEWORK

30. THREAT INTELLIGENCE FRAMEWORK
Finding hidden IOCs using comprehensive threat intelligence mappings

31. THREAT INTEL SUPPORT

32. CONFIGURE THREAT INTELLIGENCE

33. THREAT INTELLIGENCE IN INCIDENT REVIEW

34. THREAT ACTIVITY

35. THREAT INTELLIGENCE FRAMEWORK

36. USE CASE LIBRARY

37. SPLUNK AS THE SECURITY NERVE CENTER

38. ADAPTIVE RESPONSE FRAMEWORK

39. ADAPTIVE RESPONSE FRAMEWORK

40. FRAMEWORKS ENABLE USE CASES

44. REWIND…

45. WHY DESH CYBER ?
• HIGHLY EXPERIENCED TECHNICAL TEAM .
• BEST COMPETITIVE PRICE WITH BEST SERVICE.
• FIRST BANGLADESHI COMPANY TO ASSOCIATE PARTNER WITH SPLUNK .
• WE WILL PROVIDE TRAINING TO YOUR ORGANIZATIONS .
• DESH CYBER WILL PROVIDE 24/7 MONITORING TO YOUR ORGANIZATIONS .

46. WE ALSO PROVIDE ….
PHISHING AWARNESS TRAING
(KNOWBE4)
EMAIL THREAT SOLUTIONS
(VAILMAIL)
CISCO UMBRELLA
& MANY OTHER SECURITY
TOOLS AND SERVICES

47. STAY WITH US .THANKS YOU

48. Q & A ?
Reference Credit Goes To
Him