stackArmor Security MicroSummit - AWS Security with Splunk
•Download as PPTX, PDF•
2 likes•617 views
stackArmor MicroSummit Creating a SOC/NOC and Security Insights with Splunk and SplunkCloud: Splunk talk about how to leverage and deploy Splunk ES and the latest SplunkCloud offering to rapidly develop a SIEM and Operational Insights platform quickly. Learn about the latest SplunkCloud offering from Splunk and available on the AWS Marketplace.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to stackArmor Security MicroSummit - AWS Security with Splunk
Similar to stackArmor Security MicroSummit - AWS Security with Splunk (20)
More from Gaurav "GP" Pal
More from Gaurav "GP" Pal (18)
Recently uploaded
Recently uploaded (20)
stackArmor Security MicroSummit - AWS Security with Splunk
- 1. © 2017 SPLUNK INC.© 2017 SPLUNK INC. Splunk and AWS Securing the Cloud Kam Amir | Splunk Cloud Architect kam@splunk.com 08/03/2017
- 2. © 2017 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward-looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved. Forward-Looking Statements
- 3. © 2017 SPLUNK INC. Agenda ▶ What is Machine Data? ▶ Why Splunk? ▶ Splunk Security Use Cases • Partnerships and integrations with third party vendors • Splunk Security Apps ▶ Splunk on AWS ▶ Splunk App for AWS
- 4. © 2017 SPLUNK INC. What is Machine Data?
- 5. © 2017 SPLUNK INC. ORDER, 2016-05-21T14:04:12.484,10098213,569281734,67.17.10.12,43CD1A7B8322,SA-2100 MAY 21 14:04:12.996 wl-01.acme.com Order 569281734 failed for customer 10098213. Exception follows: weblogic.jdbc.extensions.ConnectionDeadSQLException: weblogic.common.resourcepool.ResourceDeadException: Could not create pool connection. The DBMS driver exception was: [BEA][Oracle JDBC Driver] Error establishing socket to host and port: ACMEDB-01:1521. Reason: Connection refused 05/21 16:33:11.238 [CONNEVENT] Ext 1207130 (0192033): Event 20111, CTI Num:ServID:Type 0:19:9, App 0, ANI T7998#1, DNIS 5555685981, SerID 40489a07-7f6e-4251-801a- 13ae51a6d092, Trunk T451.16 05/21 16:33:11:242 [SCREENPOPEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 CUSTID 10098213 05/21 16:37:49.732 [DISCEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 {actor:{displayName: “Go Boys!!”,followersCount:1366,friendsCount:789,link: http://dallascowboys.com/,location:{displayName:“Dallas, TX”,objectType:“place”}, objectType:“person”,preferredUsername:“B0ysF@n80”,statusesCount:6072},body: “Can’t buy this device from @ACME. Site doesn’t work! Called, gave up on waiting for them to answer! RT if you hate @ACME!!”,objectType:“activity”,postedTime:“2016-05-21T16:39:40.647-0600”} What Does Machine Data Look Like? SOURCES Order Processing Twitter Care IVR Middleware Error
- 6. © 2017 SPLUNK INC. Machine Data Contains Critical Insights SOURCES Order Processing Twitter Care IVR Middleware Error Customer ID Order ID Product ID ORDER, 2016-05-21T14:04:12.484,10098213,569281734,67.17.10.12,43CD1A7B8322,SA-2100 MAY 21 14:04:12.996 wl-01.acme.com Order 569281734 failed for customer 10098213. Exception follows: weblogic.jdbc.extensions.ConnectionDeadSQLException: weblogic.common.resourcepool.ResourceDeadException: Could not create pool connection. The DBMS driver exception was: [BEA][Oracle JDBC Driver] Error establishing socket to host and port: ACMEDB-01:1521. Reason: Connection refused 05/21 16:33:11.238 [CONNEVENT] Ext 1207130 (0192033): Event 20111, CTI Num:ServID:Type 0:19:9, App 0, ANI T7998#1, DNIS 5555685981, SerID 40489a07-7f6e-4251-801a- 13ae51a6d092, Trunk T451.16 05/21 16:33:11:242 [SCREENPOPEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 CUSTID 10098213 05/21 16:37:49.732 [DISCEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 {actor:{displayName: “Go Boys!!”,followersCount:1366,friendsCount:789,link: http://dallascowboys.com/,location:{displayName:“Dallas, TX”,objectType:“place”}, objectType:“person”,preferredUsername:“B0ysF@n80”,statusesCount:6072},body: “Can’t buy this device from @ACME. Site doesn’t work! Called, gave up on waiting for them to answer! RT if you hate @ACME!!”,objectType:“activity”,postedTime:“2016-05-21T16:39:40.647-0600”} Order ID Twitter ID Customer ID Customer ID Time waiting on hold Customers Tweet Company’s Twitter ID
- 7. © 2017 SPLUNK INC. Machine Data Contains Critical Insights SOURCES Order Processing Twitter Care IVR Middleware Error Customer ID Order ID Product ID ORDER, 2016-05-21T14:04:12.484,10098213,569281734,67.17.10.12,43CD1A7B8322,SA-2100 MAY 21 14:04:12.996 wl-01.acme.com Order 569281734 failed for customer 10098213. Exception follows: weblogic.jdbc.extensions.ConnectionDeadSQLException: weblogic.common.resourcepool.ResourceDeadException: Could not create pool connection. The DBMS driver exception was: [BEA][Oracle JDBC Driver] Error establishing socket to host and port: ACMEDB-01:1521. Reason: Connection refused 05/21 16:33:11.238 [CONNEVENT] Ext 1207130 (0192033): Event 20111, CTI Num:ServID:Type 0:19:9, App 0, ANI T7998#1, DNIS 5555685981, SerID 40489a07-7f6e-4251-801a- 13ae51a6d092, Trunk T451.16 05/21 16:33:11:242 [SCREENPOPEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 CUSTID 10098213 05/21 16:37:49.732 [DISCEVENT] SerID 40489a07-7f6e-4251-801a-13ae51a6d092 {actor:{displayName: “Go Boys!!”,followersCount:1366,friendsCount:789,link: http://dallascowboys.com/,location:{displayName:“Dallas, TX”,objectType:“place”}, objectType:“person”,preferredUsername:“B0ysF@n80”,statusesCount:6072},body: “Can’t buy this device from @ACME. Site doesn’t work! Called, gave up on waiting for them to answer! RT if you hate @ACME!!”,objectType:“activity”,postedTime:“2016-05-21T16:39:40.647-0600”} Order ID Twitter ID Customer ID Customer ID Time waiting on hold Customers Tweet Company’s Twitter ID
- 8. © 2017 SPLUNK INC. Why Splunk?
- 9. © 2017 SPLUNK INC. © 2017 SPLUNK INC.
- 10. © 2017 SPLUNK INC. True End State: Complete Hybrid Visibility On- Premises Private Cloud Public Cloud Storage Telecoms Security Web Services Networks Containers Web Clickstreams RFID Lambda Servers Messaging GPS Location Config EC2 Online Services DatabasesCall Detail Records Energy Meters CloudTrail End-to-End Visibility Index Untapped Data: Any Source, Type, Volume Application Delivery IT Operations Security, Compliance and Fraud Business Analytics Internet of Things and Industrial Data EMR RDS
- 11. © 2017 SPLUNK INC. Splunk Markets Developer Platform (REST API, SDKs) IT Operations Application Delivery Business Analytics Internet of Things and Industrial Data Security, Compliance and Fraud Platform for Operational Intelligence
- 12. © 2017 SPLUNK INC. The Splunk Portfolio Rich Ecosystem of Apps & Add-Ons Splunk Premium Solutions Mainframe Data Relational Databases MobileForwarders Syslog/ TCP IoT Devices Network Wire Data Hadoop Platform for Operational Intelligence
- 13. © 2017 SPLUNK INC. Splunk Security Use Cases
- 14. © 2017 SPLUNK INC. Recent Headlines Do you want to be front page news?
- 15. © 2017 SPLUNK INC. Security SECURITY AND COMPLIANCE REPORTING REAL-TIME MONITORING OF KNOWN THREATS INCIDENT INVESTIGATIONS AND FORENSICS FRAUD DETECTION DETECT UNKNOWN THREATS INSIDER THREAT
- 16. © 2017 SPLUNK INC. Splunk for Security Splunk Enterprise Security 500+ Security Apps Splunk User Behavior Analytics Palo Alto Networks Symantec DNS OSSEC NetFlow Logic Cisco Security Suite F5 Security PCI Compliance Active Directory Blue Coat Proxy SG
- 17. © 2017 SPLUNK INC. ▶ Splunk Security Essentials ▶ https://splunkbase.splunk.com/app/3 435/ ▶ Splunk Security Essentials for Ransomware ▶ https://splunkbase.splunk.com/app/3 593/ Security Focused Splunk Apps Free apps available from Splunkbase
- 18. © 2017 SPLUNK INC. ▶ Splunk Enterprise Security • Analytics-Driven SIEM • Real Time Monitoring • Prioritize and Act • Rapid Investigations • Handle multi-step investigations • Deploy on-prem, Splunk Cloud or private hybrid Cloud • Improve Operational Efficiency Splunk Enterprise Security (ES) Data driven SIEM
- 19. © 2017 SPLUNK INC. Splunk Adaptive Response Partners Diagram Copy/paste this graphic to use in your own presentations Identity and Access Internal Network Security Endpoints OrchestrationWAF & App Security Threat Intelligence Network Web Proxy Firewall +
- 20. © 2017 SPLUNK INC. Splunk on AWS
- 21. © 2017 SPLUNK INC. ▶ AWS Advanced Technology Partner ▶ AWS Big Data Competency ▶ AWS Security Competency ▶ AWS DevOps Competency ▶ AWS Government Competency ▶ AWS Education Competency ▶ AWS IoT Competency ▶ AWS MSP Technology Provider ▶ AWS Marketplace Partner ▶ AWS Security by Design Program Partner ▶ 1st partner with published Blueprints for AWS Lambda ▶ 1st partner to pass SaaS extension for Well Architected framework Splunk’s AWS Credentials
- 22. © 2017 SPLUNK INC. 100% Uptime SLA SOC2 Type II Certified Runs on AWS Cloud Services Apps Splunk App for AWS, ServiceNow, Salesforce, etc. AWS Specific Integrations CloudTrail, CloudWatch/Logs, Config/Rules, Inspector, Kinesis, S3, VPC Flow Logs, Billing, SQS, SNS Splunk Core + Enterprise Security & ITSI available Enterprise on AWS For small IT teams starts $90/mo Starts at 1gb/day BYOL with Amazon EC2 Apps and Integrations SaaS on AWS Delivery Models Splunk Runs On & With AWS Deploy with AWS Quick Start!
- 23. © 2017 SPLUNK INC. Splunk App for AWS
- 24. © 2017 SPLUNK INC. End-to-End Visibility with AWS and Splunk Billing Reports S3 Access Logs CloudTrail Logs ELB Access Logs CloudFront Access Logs Application Logs Config Snapshots & History Files Other Service Logs Kinesis Stream SQS Lambda RDS Redshift CloudTrail SNS S3 CloudWatch Metrics CloudWatch Events CloudWatch Logs EC2 System Manager Events ECS Container & Task State Changes EBS Volume & Snapshot Notifications EMR Cluster & Instance State Changes Auto Scaling Group State Changes CodeDeploy Instance & Deployment State Changes AWS Console Sign-In Events AWS Health & Trusted Advisor Events KMS Events Config ElastiCache Cluster Events CloudFormation Stack Events CloudWatch Alarms ELB Metrics CloudFront Metrics EC2 Metrics EBS Metrics ECS Metrics DynamoDB Metrics EMR Metrics Kinesis Metrics Lambda Metrics API Gateway Metrics S3 Metrics Route53 Metrics SNS Metrics RDS Metrics AWS Add-on DB Connect Native path (via AWS) Push path (via Splunk HEC) Pull path (via Splunk Modular Input or DB Input) VPC Flow Logs Lambda Logs API Gateway Logs Custom Application Logs API Gateway Custom Events DynamoDB Table Updates S3 Events Cognito Events Custom Config Rules CodeCommit Repo Events IoT v1.1
- 25. © 2017 SPLUNK INC. Topology Usage Splunk App for AWS: The Value ▶ View user activity ▶ Gain a full audit trail ▶ Detect anomalous behavior ▶ View EC2 utilization metrics ▶ View by account, region, instance ▶ Supports numerous AWS services ▶ Visualize your AWS Environment ▶ View resource relationships ▶ Gain playback history ▶ Compare and correlate events ▶ View in a time-series ribbon ▶ Accelerate investigations ▶ Leverage machine learning toolkit ▶ Gain billing recommendations ▶ Detect security and billing anomalies ▶ Gain view into resource cost ▶ Improve RI planning / utilization ▶ Monitor actual spend vs. forecast Security Billing Timeline Insights
- 26. © 2017 SPLUNK INC. Topology Usage Splunk App for AWS: The Value ▶ View user activity ▶ Gain a full audit trail ▶ Detect anomalous behavior ▶ View EC2 utilization metrics ▶ View by account, region, instance ▶ Supports numerous AWS services ▶ Visualize your AWS Environment ▶ View resource relationships ▶ Gain playback history ▶ Compare and correlate events ▶ View in a time-series ribbon ▶ Accelerate investigations ▶ Leverage machine learning toolkit ▶ Gain billing recommendations ▶ Detect security and billing anomalies ▶ Gain view into resource cost ▶ Improve RI planning / utilization ▶ Monitor actual spend vs. forecast Security Billing Timeline Insights
- 27. © 2017 SPLUNK INC. IT Operations Security Cost Management ▶ What is my EBS footprint and posture across all my accounts and all my regions? ▶ Who started/stopped/restarted what instances and when? ▶ What EC2 instances are underutilized and perhaps overprovisioned? ▶ What is the traffic volume into my VPC and where is it originating from? ▶ Why are certain resources unreachable from certain subnets/VPCs? ▶ List resources with missing or non-conforming tags ▶ Who added that rule in the security group that protects our application servers? ▶ Where is the blocked traffic into that VPC coming from? ▶ What was the activity trail of a particular user before and after that incident? ▶ Alert me when a user imports key-pairs or when a security group allows all ports ▶ What instances are provisioned outside of a VPC, by whom and when? ▶ What security groups are defined but not attached to any resource? ▶ How many instances am I running? ▶ What reserved instances have I purchased in the past? ▶ What is my reserved instance utilization? ▶ How much am I paying per account? ▶ How much am I using per service across all accounts? ▶ How many reserved instances should I buy based on usage? ▶ Is this account within budget this month, and how has it tracked in the last year? Detailed Use Cases
- 28. © 2017 SPLUNK INC. AWS CloudWatch Populates the Following Dashboards in the Splunk App for AWS: Overview Topology Usage Overview EC2 Instances EBS Volumes ELB Instances Relational Database Service Current Month Estimated Billing Insights Overview / EC2 / ELB / EBS Insights Billing Anomaly Insights Lambda
- 29. © 2017 SPLUNK INC. AWS CloudWatch Logs Data from the CloudWatch Logs service, including VPC flow logs. Flow logs allow you to capture IP traffic flow data for the network interfaces in your resources. Dashboards: • Topology • VPC Flow Logs – Traffic Analysis • VPC Flow Logs – Security • Analysis
- 30. © 2017 SPLUNK INC. AWS CloudTrail Records AWS API calls for your account and delivers log files to you Populates Dashboards: • Overview • Topology • Security Overview • IAM Activity • VPC Activity • Security Groups • Key Pairs Activity • Network ACLs • User Activity • Insights Overview • Security Anomaly Insights • Timeline
- 31. © 2017 SPLUNK INC. AWS Config Populates the Following Dashboards in the Splunk App for AWS: Overview Topology Security Groups Resource Activity Timeline Config Rules
- 32. © 2017 SPLUNK INC. Customer Use Cases City of Los Angeles Integrates Real-Time Security Intelligence Sharing Across 40+ City Agencies
- 33. © 2017 SPLUNK INC. City of Los Angeles Integrates Real-Time Security Intelligence Sharing Across 40+ City Agencies “By deploying the Splunk SIEM solution, we enhance our detection and response capabilities to protect the City’s critical assets from all manner of cyber threats and intrusions. By utilizing a cloud solution, our security team can focus on security events rather than deploying and maintaining infrastructure.” ENTERPRISE SECURITY ON SPLUNK CLOUD • Executive Summary • White Paper
- 34. © 2017 SPLUNK INC. ▶ 6000+ IT and Business Professionals ▶ 200+ Sessions ▶ 80+ Customer Speakers PLUS Splunk University ▶ Three days: Sept 23-25, 2017 ▶ Get Splunk Certified for FREE! ▶ Get CPE credits for CISSP, CAP, SSCP SEPT 25-28, 2017 Walter E. Washington Convention Center Washington, D.C. .conf2017 The 8th Annual Splunk Conference conf.splunk.com
- 35. © 2017 SPLUNK INC.© 2017 SPLUNK INC. Thank You
Editor's Notes
- Unlike traditional structured data or multi-dimensional data– for example data stored in a traditional relational database for batch reporting – machine data is non-standard, highly diverse, dynamic and high volume. You will notice that machine data events are also typically time-stamped – it is time-series data. Take the example of purchasing a product on your tablet or smartphone: the purchase transaction fails, you call the call center and then tweet about your experience. All these events are captured - as they occur - in the machine data generated by the different systems supporting these different interactions. Each of the underlying systems can generate millions of machine data events daily. Here we see small excerpts from just some of them.
- When we look more closely at the data we see that it contains valuable information – citizen id, case id, time waiting on hold, twitter id … what was tweeted. What’s important is first of all the ability to actually see across all these disparate data sources, but then to correlate related events across disparate sources, to deliver meaningful insight.
- If you can correlate and visualize related events across these disparate sources, you can build a picture of activity, behavior and experience. And what if you can do all of this in real-time? You can respond more quickly to events that matter. For example, if an organizations captured the customers twitter ID in their customer profile this correlation would be possible. Where that didn’t exist, they could at least group by demographic with the tweets. You can extrapolate this example to a wide range of use cases – security and fraud, transaction monitoring and analysis, web analytics, IT operations and so on.
- Splunk has several applications and partnerships that make us especially relevant for the Internet of Things: Community apps such as modular inputs for REST Endpoints, Kinesis, Kafka, and JMS Messaging Services allow easy connection to and ingestion of the high velocity and volume data available from the web services and from web based messaging queues that are becoming so common in IoT data delivery. Splunk’s DB Connect allows connection to data stored in relational databases, as well as to traditional structured metadata sources which can be used for Splunk lookups. And for the makers in the house, a community supported Splunk Universal Forwarder for ARM architectures runs on platforms like Raspberry Pi for easy access to the data and applications running on those IoT devices. Strong partnerships with companies well established in the internet of things, including Kepware, CQCloud and DataFlare for industrial data collection, analytics and visualization, and ThingWorx and MachineShop for IoT platforms integration in the Enterprise.
- Splunk is a Security Intelligence Platform and we can address a number of security use cases. We’re more flexible than a SIEM and can be used for non-security use cases. Splunk software can complement or replace existing SIEM deployments, while also addressing more complex security use cases, such as supporting fraud detection and finding insider threats.
- The Spunk Security Intelligence Platforms consists of multiple components. Foundational to the platform is Splunk Enterprise, our core product. Every Splunk deployment includes this for indexing and storage. Using this alone, customers can perform searches and easily build reports/dashboards from their data. A variety of applications can be installed on top of the Splunk Enterprise, ranging from 3rd party vendor apps, community developed apps and Splunk Apps. You can build apps on top for your use or to share within your company. Apps are a collection of reports, dashboards, and searches purpose-built for a specific use. Our premium security app is the Splunk Enterprise Security. It provides out-of-the-box security workflow, dashboards, reports, correlation rules that bring together security and infrastructure technologies across your company. Any of the apps can be mixed-and-matched to achieve the desired level of functionality.
- ~2:00 minutes Enumerate AWS specific offerings and solutions. Briefly describe each one: Splunk cloud – SaaS application built on AWS, 100% uptime SLA and it’s SOC 2 certified Splunk paid AMI coming in July , currently you can get a BYOL in marketplace AMI. Splunk Light, starts at 90$/month for 1GB per day Enterprise Security: This is positioned as a “premium service” ITSI: Splunk App for AWS:
- Cloudwatch provides monitoring for AWS resources and the customer applications running on the Amazon infrastructure. Customers use Cloudwatch to monitor EC2 instances, EBS volumes, ELBs, RDS, VPC Flow logs, and other metrics Cloudwatch functions through AWS API’s which are available through the AWS SDK Cloudwatch enables the monitoring of Ec2 instances as well as other AWS resources (Monitor metrics on Amazon DynamoDB tables, Amazon EBS volumes, Amazon RDS DB instances, Amazon Elastic MapReduce job flows, Elastic Load Balancers, Amazon SQS queues, Amazon SNS topics, and more for no additional charge. No additional software needs to be installed.) Custom metrics can be generated for custom applications via a simple API request which are then monitored by Cloudwatch. Alarms can be set when certain thresholds are met, and users can be either be notified of these alerts, or have AWS react dynamically with auto scaling the infrastructure.
- Cloudwatch provides monitoring for AWS resources and the customer applications running on the Amazon infrastructure. Customers use Cloudwatch to monitor EC2 instances, EBS volumes, ELBs, RDS, VPC Flow logs, and other metrics Cloudwatch functions through AWS API’s which are available through the AWS SDK Cloudwatch enables the monitoring of Ec2 instances as well as other AWS resources (Monitor metrics on Amazon DynamoDB tables, Amazon EBS volumes, Amazon RDS DB instances, Amazon Elastic MapReduce job flows, Elastic Load Balancers, Amazon SQS queues, Amazon SNS topics, and more for no additional charge. No additional software needs to be installed.) Custom metrics can be generated for custom applications via a simple API request which are then monitored by Cloudwatch. Alarms can be set when certain thresholds are met, and users can be either be notified of these alerts, or have AWS react dynamically with auto scaling the infrastructure.
- AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. With CloudTrail, you can get a history of AWS API calls for your account, including API calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services (such as AWS CloudFormation).
- AWS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance. Config Rules enables you to create rules that automatically check the configuration of AWS resources recorded by AWS Config. Common use cases: Discovery Change Management Audit and Compliance Troubleshooting Security and Incident Analysis With AWS Config, you can discover existing and deleted AWS resources, determine your overall compliance against rules, and dive into configuration details of a resource at any point in time. These capabilities enable compliance auditing, security analysis, resource change tracking, and troubleshooting.
- The live expression of our community is our users conference. Journalists last year said it was more like a family reunion than a technology conference, and we take that as a compliment. It’s the best place to share best practices, new ideas and learn directly from the smartest people in the Splunk ecosystem. Doesn’t matter if you’re just getting started with Splunk or are a veteran user, everyone learns something and gets reenergized at .conf2017. 4 inspired Keynotes 165+ Breakout sessions addressing all areas and levels of Operational Intelligence – IT, Business Analytics, Mobile, Cloud, IoT, Security… and MORE! 30+ hours of invaluable networking time with industry thought leaders, technologists, and other Splunk Ninjas and Champions waiting to share their business wins with you! Join the 50%+ of Fortune 100 companies who attended .conf2016 to get hands-on with Splunk. You’ll be surrounded by thousands of other like-minded individuals who are ready to share exciting and cutting edge use cases and best practices. You can also deep dive on all things Splunk products together with your favorite Splunkers. Head back to your company with both practical and inspired new uses for Splunk, ready to unlock the unimaginable power of your data! Arrive in DC a Splunk user, leave Orlando a Splunk Ninja! REGISTRATION IS OPEN, sessions will be posted by end of June