Today’s threat landscape has triggered an explosion of new security solutions all promising to identify threats and reduce risk. Yet, with all these new approaches, breaches continue to rise as organizations struggle to use their security controls effectively and quickly respond to threats.

1. © 2018 SPLUNK INC.
ZenithLive 2018
Phantom + Zscaler
Ian Forrest
Staff Sales Engineer – Phantom
iforrest@splunk.com

2. © 2018 SPLUNK INC.
▶ Phantom Overview
▶ Zscaler + Phantom
▶ Use Cases
▶ Q&A
Agenda

3. © 2018 SPLUNK INC.
What is Phantom?
The industry-leading SOAR platform
SOAR = Security Orchestration, Automation, and Response
▶ Security Orchestration is the machine-based coordination of security actions
across a complex infrastructure.
▶ Security Automation is the machine-based execution of security actions.
▶ Security Response refers to the policy-based coordination of human and
machine-based activities for event/case/incident workflows.

4. © 2018 SPLUNK INC.
What Security Problem does Phantom help solve?
Escalating volume
of security alerts
Resource shortage of 1 million
security professionals
Endless assembly line of
point products
Static independent controls
with no orchestration
Speed of detection, triage, &
response time must improve
Costs continue
to increase
ALERTSRESOURCES PRODUCTS
STATIC SPEED COSTS

5. © 2018 SPLUNK INC.
Observe
Point Products
Orient
Analytics
Decide Act
FIREWALL
IDS / IPS
ENDPOINT
WAF
ADVANCED MALWARE
FORENSICS
MALWARE DETONATION
SIEM
THREAT INTEL PLATFORM
HADOOP
GRC
FIREWALL
IDS / IPS
ENDPOINT
WAF
ADVANCED MALWARE
FORENSICS
MALWARE DETONATION
Current Security Operations process
TIER 1
TIER 2
TIER 3
AUTOMATED MANUAL (TODAY)
People x Time = Cost

6. © 2018 SPLUNK INC.
Decide Act
SIEM
THREAT INTEL PLATFORM
HADOOP
GRC
Automating Security Operations
FIREWALL
IDS / IPS
ENDPOINT
WAF
ADVANCED MALWARE
FORENSICS
MALWARE DETONATION
FIREWALL
IDS / IPS
ENDPOINT
WAF
ADVANCED MALWARE
FORENSICS
MALWARE DETONATION
TIER 1
TIER 2
TIER 3
Observe
Point Products
Orient
Analytics
AUTOMATED WITH PHANTOM
Same People x Less Time = Lower Cost
AUTOMATED

7. © 2018 SPLUNK INC.
PHANTOMKEYCONCEPTS
SIEM
DATA LAKE
MESSAGE BUS
EMAIL
THREAT INTELLIGENCE
INCIDENT
VULNERABILITY
INVESTIGATE ENDPOINT
REIMAGE ENDPOINT
DEPLOY INDICATORS
INVESTIGATE PHISHING
”BLOCK IP”
“DISABLE USER”
“GEOLOCATE IP”
“DETONATE FILE”
“RUN QUERY”
“SEND EMAIL”
“FILE REPUTATION”
“LIST PROCESSES”
“SNAPSHOT VM”
CISCO ASA
MICROSOFT AD
MAXMIND
CUCKOO
SPLUNK
SMTP
THREATGRID
TANIUM
VMWARE
PERIMETER_FW
PRIMARY_DC
PRIMARY_SIEM
EXCHANGESERVER
CFO_LAPTOP
Data Sources Playbooks Actions Apps Assets Owners
BOB
SAM
FRED

8. © 2018 SPLUNK INC.
INTEGRATIONS
Phantom/Splunk Current Integrations
SPLUNK NOTABLE EVENT + ADAPTIVE RESPONSE
RUN QUERY
POST DATA
ON POLL
RUN QUERY
POST DATA
DATA MODEL + PHANTOM SPLUNK APP
RUN QUERY
POST DATA

9. © 2018 SPLUNK INC.
INTEGRATIONS
Phantom/Zscaler Integration

10. © 2018 SPLUNK INC.
10
Use Cases
• Investigate Suspicious URL
• Zscaler Patient Zero Alert Response

11. © 2018 SPLUNK INC.
11
Q&A