The document discusses an overview presentation on Splunk Enterprise Security and User Behavior Analytics. It provides an agenda for the SplunkLive London2016 conference that includes sessions on operational security intelligence, Splunk for enterprise security featuring user behavior analytics, cloud breach detection and response, and a Splunk user group meeting. It also introduces the presenter and provides a disclaimer. The presentation will cover new features in Splunk Enterprise Security 4.1 including prioritizing investigations, enhanced investigation timelines, and integrating behavioral analytics into the SIEM workflow. It will also discuss what is new in Splunk User Behavior Analytics 2.2 such as enhanced insider threat and cyber attack detection.

1. Copyright © 2016 Splunk Inc.
Enterprise Security &
UBA Overview
SplunkLive London2016
Johan Bjerke, Senior Sales Engineer
Technical Splunk Guy

2. 2
Splunk Live Security Track Today
13:00-14:00: Operational Security Intelligence
14:00-15:00: Splunk for Enterprise Security featuring User
Behavior Analytics
15:00-16:00: Cloud Breach – Detection and Response
16:00-17:00: Happy Hour
17:00 – 19:30: Splunk London User Group Meeting

3. 3
3
> Johan Bjerke johan@splunk.com
• 2+ years at Splunk
• Splunk Security SME
whoami

4. 4
Disclaimer
4
During the course of this presentation, we may make forward looking statements regarding future events or the
expected performance of the company. We caution you that such statements reflect our current expectations and
estimates based on factors currently known to us and that actual events or results could differ materially. For important
factors that may cause actual results to differ from those contained in our forward-looking statements, please review
our filings with the SEC. The forward-looking statements made in the this presentation are being made as of the time
and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or
accurate information. We do not assume any obligation to update any forward looking statements we may make.
In addition, any information about our roadmap outlines our general product direction and is subject to change at any
time without notice. It is for informational purposes only and shall not, be incorporated into any contract or other
commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include
any such feature or functionality in a future release.

5. 5
Agenda
Splunk Portfolio Update
Enterprise Security 4.1
User Behavior Analytics 2.2

6. 6
Splunk Solutions > Easy to Adopt
VMware
Platform for Machine Data
Exchange PCISecurity
Across Data Sources, Use Cases & Consumption Models
IT Svc Int
Splunk Premium Solutions Rich Ecosystem of Apps
ITSI UBA
UBA
Mainframe
Data
Relational
Databases
MobileForwarders Syslog/TCP IoT
Devices
Network
Wire Data
Hadoop
& NoSQL

7. What is Splunk ES?

8. Platform for Machine Data
Splunk Enterprise Security
Advancing analytics-driven security
Security and
Compliance Reporting
Monitor and
Detect
Investigate Threats
and Incidents
Analyze and
Optimize Response

9. 9
Open Solutions Framework
Supports critical security related management framework features
9
Enterprise
Security
Framework
• Notable Events Framework
• Threat Intelligence Framework
• Risk Scoring Framework
• Identity & Asset Framework
Customer Apps
APPs /
Content
Partner Apps
APPs /
Content
Splunk Apps
APPs /
Content
• Export
• Import
• Share
• Summarization Framework
• Alerting & Scheduling
• Visualization Framework
• Application Framework
External
Instance

10. More Honors – March 2016
● Best SIEM Solution

11. What’s new in Splunk Enterprise Security 4.1 ?

12. 12
Prioritize and Speed Investigations
Centralized incident review combining risk and
quick search
Use the new risk scores and quick searches to
determine the impact of an incident quickly
Use risk scores to generate actionable alerts to
respond on matters that require immediate
attention.
ES 4.1

13. 13
Enhanced Investigation Timeline
Add file attachments to
Investigation Timeline
Export Investigation Timeline as PDF

14. 14
Behavioral Analytics in SIEM Workflow
• All Splunk UBA results available in Enterprise Security
• Workflows for SOC Manager, SOC analyst and Hunter/Investigator
• Splunk UBA can be purchased/operated separately from Splunk Enterprise Security
ES 4.1 and UBA 2.2

15. 15
Expanded Threat Intelligence ES 4.1
Supports Facebook ThreatExchange
An additional threat intelligence
feed that provides following threat
indicators -domain names, IPs and
hashes
Use with ad hoc searches and
investigations
Extends Splunk’s Threat Intelligence Framework

16. Enterprise Security
Demo

17. What is Splunk UBA?

18. 18
TECHNOLOGY EVOLUTION
1995
2002
2008
2011
2015
END-POINT SECURITY NETWORK SECURITY EARLY CORRELATION OBJECT ANALYSIS BEHAVIOR ANALYSIS

19. 19
IN 2014, INDUSTRY SPENT
$1.7 Billion
SECURE EMAIL
GATEWAY
$1.3 Billion
SECURE WEB
GATEWAY
$2.8 Billion
ENDPOINT
PROTECTION
$1.2 Billion
INTRUSION
PREVENTION
$9.4 Billion
FIREWALL

20. 20
$16+ Billion
But, we need
even more tools

21. 21
FAMILIAR WITH THESE BREACHES?
January 2015 February 2015 February 2015
Morgan Stanley
730K
PII Records
Anthem Insurance
80M
Patient Records
Office of Personal
Management
22M
PII Records
July 2015
Pentagon Unclassified
Email System
4K
PII Records

22. 22
SO, WHAT IS THE COMPROMISED / MISUSED
CREDENTIALS OR DEVICES
LACK OF RESOURCES
(SECURITY EXPERTISE)
LACK OF ALERT PRIORITIZATION &
EXCESSIVE FALSE POSITIVES
PROBLEM?

23. 23
EXTERNAL
ATTACK
USER ACTIVITY
Peter and Sam access a compromised website -
backdoor gets installed
The attacker uses Peter’s stolen credential and VPNs into
Domain Controller
The attacker uses the backdoors to download and execute
WCE – password cracker
Peter’s and Sam’s devices begin communicating with
CnC
The attacker logs in as Sam and accesses sensitive
documents from a file share
The attacker steals the admin Kerberos ticket and
escalates the privileges for Sam
The attacker uses Peter’s VPN credential to connect,
copies the docs to an external staging server, and logs
out after three hours
Day 1
.
.
Day 2
.
.
Day N

24. 24
INSIDER
THREAT
John connects via VPN
Administrator performs ssh (root) to a file share -
finance department
John executes remote desktop to a system
(administrator) - PCI zone
John elevates his privileges
root copies the document to another file share -
Corporate zone
root accesses a sensitive document
from the file share
root uses a set of Twitter handles to chop and copy the
data outside the enterprise
USER ACTIVITY
Day 1
.
.
Day 2
.
.
Day N

25. Splunk User Behavioral Analytics
Automated Detection of INSIDER THREATS AND CYBER ATTACKS
Platform for Machine Data
Behavior Baselining
& Modelling
Unsupervised
Machine Learning
Real-Time & Big
Data Architecture
Threat & Anomaly
Detection
Security Analytics

26. 26
MULTI-ENTITY BEHAVIORAL MODEL
Temporal Window
USER HOST NETWORK APPLICATION DATA
Activity A
Activity N
Activity A
Activity N
Activity A
Activity N
Activity A
Activity N
Activity A
Activity N
ACTIVITY A ACTIVITY C ACTIVITY F ACTIVITY B ACTIVITY L

27. 27
ATTACK DEFENSES

28. 28
INSIDER
THREAT
Day 1
.
.
Day 2
.
.
Day N
John connects via VPN
Administrator performs ssh (root) to a file share -
finance department
John executes remote desktop to a system
(administrator) - PCI zone
John elevates his privileges
root copies the document to another file share -
Corporate zone
root accesses a sensitive document
from the file share
root uses a set of Twitter handles to chop and copy the
data outside the enterprise
USER ACTIVITY
Unusual Machine Access
(Lateral Movement; Individual
& Peer Group)
Unusual Zone (CorpàPCI)
traversal (Lateral Movement)
Unusual Activity Sequence
Unusual Zone Combination
(PCIàCorp)
Unusual File Access
(Individual & Peer Group)
Multiple Outgoing Connections
& Unusual SSL session duration

29. A Few CUSTOMER FINDINGS
q Malicious Domain
q Beaconing Activity
q Malware: Asprox
q Webshell Activity
q Pass The Hash Attack
q Suspicious Privileged
Account activity
q Exploit Kit: Fiesta
q Lateral Movement
q Unusual Geo Location
q Privileged Account
Abuse
q Access Violations
q IP Theft
RETAIL HI-TECH MANUFACTURING FINANCIAL

30. PROXY SERVER
FIREWALL
WHAT DOES SPLUNK UBA NEED?
ACTIVE DIRECTORY /
DOMAIN CONTROLLER
DNS, DHCP
SPLUNK ENTERPRISE ANY SIEM AT A MINIMUM

31. 31
WHAT CUSTOMERS HAVE TO SAY ABOUT SPLUNK UBA
Splunk UBA is unique in its data-science driven approach to automatically finding hidden threats rather than
the traditional rules-based approaches that doesn’t scale. We are pleased with the efficacy and efficiency of this
solution as it makes the life of our SOC analysts’ way better.
Mark Grimse, VP IT Security, Rambus
A layered defense architecture is necessary to combat modern-day threats such as cyberattacks and insider
threats, and it’s crucial to use a data science driven approach in order to find unknown patterns. I found Splunk
UBA to be oneof themost advanced technologies within thebehavioralanalytics space.
Randolph Barr, CSO, Saba

32. Splunk UBA and Splunk ES Integration
SIEM, Hadoop
Firewall, AD, DLP
AWS, VM,
Cloud, Mobile
End-point,
App, DB logs
Netflow, PCAP
Threat Feeds
DATA SOURCES
DATA SCIENCE DRIVEN
THREAT DETECTION
99.99% EVENT REDUCTION
UBA
MACHINE LEARNING IN
SIEM WORKFLOW
ANOMALY-BASED CORRELATION
101111101010010001000001
111011111011101111101010
010001000001111011111011

33. What’s New in UBA 2.2

34. 34
Enhanced Insider Threat and Cyber Attack Detection
DETETION
Threat Detection Framework
• Custom threat modeling with anomalies
Expanded Attack Coverage
• Data access and physical data loss
New Viewpoint
• Precision, prioritization and correlation of alerts with anomalies
UBA 2.2

35. 35
Create custom threats using 60+
anomalies.
Create custom threat scenarios on top of anomalies
detected by machine learning.
Helps with real-time threat detection and leverage to
detect threats on historical data.
Analysts can create many combinations and
permutations of threat detection scenarios along with
automated threat detection.
Detection : Custom Threat Modeling Framework UBA 2.2

36. 36
Detection : Enhanced Security Analytics
Visibility and
baseline metrics
around user,
device, application
and protocol
30+
new metrics
USER CENTRIC DEVICE CENTRIC
APPLICATION CENTRIC PROTOCOL CENTRIC
Detailed Visibility, Understand Normal Behavior
UBA 2.2

37. 37
Context Enrichment
Citrix NetScaler (AppFlow)
FireEye Email (EX)
Symantec DLP
Bit9/Carbon Black
Digital Guardian
And many more….
Improved Precision and Prioritization of Threats
§ Risk Percentile & Dynamic Peer Groups
§ Support for Additional 3rd Party Devices
UBA 2.2

38. UBA Demo

39. 39
SEPT 26-29, 2016
WALT DISNEY WORLD, ORLANDO
SWAN AND DOLPHIN RESORTS
• 5000+ IT & Business Professionals
• 3 days of technical content
• 165+ sessions
• 80+ Customer Speakers
• 35+ Apps in Splunk Apps Showcase
• 75+ Technology Partners
• 1:1 networking: Ask The Experts and Security
Experts, Birds of a Feather and Chalk Talks
• NEW hands-on labs!
• Expanded show floor, Dashboards Control
Room & Clinic, and MORE!
The 7th Annual Splunk Worldwide Users’ Conference
PLUS Splunk University
• Three days: Sept 24-26, 2016
• Get Splunk Certified for FREE!
• Get CPE credits for CISSP, CAP, SSCP
• Save thousands on Splunk education!

40. Thank You!