Using Splunk at MoneyGram International
•
2 likes•1,038 views
Heidi Coleman is a data scientist at MoneyGram International whose team uses Splunk to detect and anticipate fraud attacks. Prior to using Splunk, MoneyGram had to reactively investigate fraud after it occurred, but now Splunk generates alerts when suspicious activity is detected, allowing MoneyGram to proactively contact agents. Leveraging Splunk's search capabilities and ability to join multiple log types has helped MoneyGram identify anomalous patterns and geolocate suspicious entities. This has significantly reduced MoneyGram's fraud losses since implementing Splunk.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Using Splunk at MoneyGram International
Similar to Using Splunk at MoneyGram International (20)
More from Splunk
More from Splunk (20)
Recently uploaded
Recently uploaded (20)
Using Splunk at MoneyGram International
- 1. Copyright © 2014 Splunk Inc. MoneyGram International
- 2. 2 Heidi Coleman, Data Scientist, Global Information Assurance
- 3. 3 My Background and Role • Master’s degree in statistics • Experience in computer programming • At MoneyGram for just over 2 years • Team Mission: Detect and anticipate fraud attacks • Fun Fact: Expecting baby “Spleidi” in June
- 4. 4 MoneyGram Overview A B Send Agent Sender Receive Agent Receiver
- 5. 5 MoneyGram Q3 2015 Overview Financial data updated in Q4 2015
- 6. 6 How We Got Started • Money transfer business is susceptible to fraud activity • New types of fraud attacks every day • Investigate fraud attacks and plan to prevent future attempts
- 7. 7 Prior to Utilizing Splunk Fraud Attack Occurred Agent Noticed Fraudulent Activity MoneyGram was notified Proactive process needed!
- 8. 8 Now with Splunk Splunk Alert Generated MoneyGram Investigates Suspicious Activity MoneyGram Contacts Agent
- 9. 9 Leveraging Splunk Alerts are triggered when search results meet specific conditions, such as: • Anomalous behavior from the same entity within a certain timeframe (15 minutes, one hour, two hours, etc.) • Suspicious patterns only visible by joining logs together to create a more specific search (one log contains a unique attribute identifier and another contains a corresponding attribute identifier that can identify suspicious behavior) Using Regular Expressions we can: • Identify anomalies in attributes or unusual patterns in known behavior Geolocations: • Extracting the IP address and respective geolocation allows us to investigate when the behavior of an entity is not what we are expecting
- 11. 11 Anomaly Detection • Anomaly detection: application logs, web traffic logs, login information, etc. • Investigate fraud attack patterns and determine root cause • Build alerts to prevent future fraud attempts
- 12. 12 Anomaly Detection Spike in activity on Feb 15th – Fraudulent or legitimate?
- 13. 13 Splunk Enterprise at MoneyGram Web Applications Custom Applications Splunk Indexers Splunk Forwarders Servers x 52 Virtual Servers x 4 Splunk Search Heads
- 14. 14 Advantages of Splunk Visibility to info not present in databases Easy to use search function Set alerts quickly Create new or edit existing use cases
- 15. 15 Finding Value With Splunk • Splunk Enterprise helped with significant savings due to its ability to target behavior of known fraud rings • Prevented more fraud losses in 2015 than past 2 years combined due to Splunk’s timeliness of alerting for fraudulent activity • Double-digit year over year fraud loss decreases from 2014 to 2015
- 16. 16 Top Takeaways Start with one use case and expand from there Experiment with scheduling alerts Challenge yourself to discover an unknown trend or pattern
- 17. 17 Get a Good Night’s Sleep… “At the end of the day we can rest a little bit easier knowing that Splunk is watching out for us.” - Heidi Coleman, MoneyGram
- 18. Thank You