Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise...

13
Copyright © 2017 Splunk Inc. Splunk Enterprise Security Analytics-Driven Security Emil Borgelin, Sr Sales Engineer

Transcript of Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise...

Page 1: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

Copyright©2017SplunkInc.

SplunkEnterpriseSecurityAnalytics-DrivenSecurity

EmilBorgelin,Sr SalesEngineer

Page 2: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

CYBERCRIMINALS

MALICIOUSINSIDERS

NATIONSTATES

Page 3: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

TheEver-ChangingThreatLandscape

53%Victimsnotifiedbyexternalentity

100%Validcredentials

wereused

143Median#ofdaysbeforedetection

Source:MandiantM-TrendsReport2012-2016

Page 4: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

Analytics-DrivenSecurity

Risk-Based

ContextandIntelligence

ConnectingDataandPeople

Page 5: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

RECOVERPREPARE DETECTPREVENT

Page 6: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SecurityIntelligence

DeveloperPlatform

Reportand

analyze

Customdashboards

Monitorandalert

Adhocsearch

ThreatIntelligence

Asset&CMDB

EmployeeInfo

DataStoresApplications

OnlineServices

WebServices

SecurityGPS

Location

Storage

Desktops

Networks

PackagedApplications

CustomApplications

Messaging

TelecomsOnline

ShoppingCart

WebClickstreams

Databases

EnergyMeters

CallDetailRecords

SmartphonesandDevices

Firewall

Authentication

ThreatIntelligence

Servers

Endpoint

ExternalLookups

Page 7: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

Connectingthe“data-dots”viamultiple/dynamicrelationships

Persist,Repeat

Threatintelligence

Auth - UserRoles

HostActivity/Security

NetworkActivity/Security

Attacker,knowrelay/C2sites,infectedsites,filehashes,IOC, attack/campaignintentandattribution

Wheretheywent,whotalkedtowhom,attacktransmitted,abnormaltraffic,malwaredownload

Whatprocessisrunning(malicious,abnormal,etc.)Processowner,registrymods,attack/malwareartifacts,patchinglevel,attacksusceptibility

Accesslevel,privilegedusers,likelihoodofinfection,wheretheymightbeinkillchain

Delivery,exploitinstallation

Gaintrustedaccess

ExfiltrationDataGatheringUpgrade(escalate)Lateralmovement

Persist,Repeat

Page 8: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SinglePlatformforSecurityIntelligence

SECURITY&COMPLIANCEREPORTING

REAL-TIMEMONITORINGOFKNOWNTHREATS

DETECTUNKNOWNTHREATS

INCIDENTINVESTIGATIONS&FORENSICS

FRAUDDETECTION

INSIDERTHREAT

SplunkComplements,ReplacesandGoesBeyondExistingSIEMs

Page 9: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SplunkEnterpriseSecurity

Risk-BasedAnalytics VisualizeandDiscoverRelationships

EnrichSecurityAnalysiswithThreatIntelligence

SplunkEnterpriseSecurityisanadvancedSIEMandSecurityIntelligencePlatformthatempowersSecOps tomonitor,detect,investigateandrespondtoattacksand

threatswhileminimizingriskandsafeguardingyourbusiness.

Page 10: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SplunkEnterpriseSecurity

IncidentInvestigations& ManagementAlerts&Dashboards&Reports

StatisticalOutliers&RiskScoring&UserActivity ThreatIntel&Asset&IdentityIntegration

Pre-builtsearches,alerts,reports,dashboards,incidentworkflow,andthreatintelligencefeeds

Page 11: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

AppsforSecuritySplunk

EnterpriseSecurity130+

SecurityAppsAdditionalSplunkApps

Sourcefire

CiscoSecuritySuite

ISE

PaloAltoNetworks

FireEye

Symantec

DShield

DNS

OSSEC

VENDOR COMMUNITYCISCO

SPECIFIC

Page 12: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SIEMcomparisontotheSplunkEnterpriseSecurity

Page 13: Splunk Enterprise Security - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Security.pdf · Risk-Based Analytics Visualize and Discover Relationships ... Splunk

SIEMcomparisontoSplunkLEGACYSIEM SPLUNK

Datasources Limited Anytechnology, device

Custom DeviceSupport Difficult Easy

AddIntelligence Difficult Easy

Customized Reporting Required3rd partyApp Built-in(fromsearch)

SpeedofSearch/Reporting SlowandUnusable Fast andResponsive

Correlation Difficult(rule-based)

Easy(search-based)

Scalability Limited Extensible


SplunkLive! Zürich 2016 - Splunk Enterprise 6.4

SplunkLive! Zürich 2016 - Splunk Enterprise 6.4

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

PeopleSoft and Splunk - Sierra-Cedar, Inc. · defined in PeopleSoft into Splunk Enterprise. Splunk Enterprise is a machine data platform specifically designed to store and analyze

PeopleSoft and Splunk - Sierra-Cedar, Inc. · defined in PeopleSoft into Splunk Enterprise. Splunk Enterprise is a machine data platform specifically designed to store and analyze

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

アル 4.7.0 Splunk Enterprise Security¨ˆ画 デプロイの計画 Splunk Enterprise Security のデプロイを設定した Splunk platform インストールで います。Enterprise

アル 4.7.0 Splunk Enterprise Security¨ˆ画 デプロイの計画 Splunk Enterprise Security のデプロイを設定した Splunk platform インストールで います。Enterprise

Enterprise Security Solutions OVERVIEW - Zones, Incmedia.zones.com/.../solutions-overview...micro-enterprise-security.pdf · Enterprise Security Solutions OVERVIEW. ... Security has,

Enterprise Security Solutions OVERVIEW - Zones, Incmedia.zones.com/.../solutions-overview...micro-enterprise-security.pdf · Enterprise Security Solutions OVERVIEW. ... Security has,

Splunk Enterprise on the AWS Cloud - Cloud Object … Web Services – Splunk Enterprise on the AWS Cloud September 2017 Page 2 of 23 Step 2. Subscribe to the Splunk Enterprise AMI

Splunk Enterprise on the AWS Cloud - Cloud Object … Web Services – Splunk Enterprise on the AWS Cloud September 2017 Page 2 of 23 Step 2. Subscribe to the Splunk Enterprise AMI

Getting Started with Splunk Enterprise

Getting Started with Splunk Enterprise

Splunk Enterprise for IT Troubleshooting Hands-On

Splunk Enterprise for IT Troubleshooting Hands-On

Splunk Enterprise Securing Splunk Enterprise with … · Install SELinux and configure Splunk ... functions that do not fall into the scope of ... Criteria efforts and keep documentation

Splunk Enterprise Securing Splunk Enterprise with … · Install SELinux and configure Splunk ... functions that do not fall into the scope of ... Criteria efforts and keep documentation

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

THE SPLUNK GUIDE TO OPERATIONAL …...Splunk Guide to Operational Intelligence 2 The Splunk Approach Splunk Enterprise is the first enterprise-class platform that collects and indexes

Splunk Enterprise 向け Cisco HyperFlex システム ......Splunk Enterprise 向け Cisco HyperFlex システム Splunk ワークロード向けにプライベート Cloud-in-a-Box

Splunk Enterprise 向け Cisco HyperFlex システム ......Splunk Enterprise 向け Cisco HyperFlex システム Splunk ワークロード向けにプライベート Cloud-in-a-Box

Reference Architecture: Splunk Enterprise with ThinkSystem ... · Reference Architecture: Splunk Enterprise with ThinkSystem Servers Describes reference architecture for Splunk Enterprise

Reference Architecture: Splunk Enterprise with ThinkSystem ... · Reference Architecture: Splunk Enterprise with ThinkSystem Servers Describes reference architecture for Splunk Enterprise

Splunk Enterprise on Red Hat Storage Server 2.1

Splunk Enterprise on Red Hat Storage Server 2.1

Cisco UCS Director Express for Big Data with Splunk Enterprise...Cisco UCS Director Express for Big Data with Splunk Enterprise Deploying Splunk Cluster with Archival Node and NFS

Cisco UCS Director Express for Big Data with Splunk Enterprise...Cisco UCS Director Express for Big Data with Splunk Enterprise Deploying Splunk Cluster with Archival Node and NFS

데이터 전달 Splunk Enterprise 6.1docs.splunk.com/images/a/a6/Splunk-6.1.1-ko_KO... ·  · 2014-11-15데이터 통합 데이터 통합은 여러 Forwarder에서 단일 Splunk

데이터 전달 Splunk Enterprise 6.1docs.splunk.com/images/a/a6/Splunk-6.1.1-ko_KO... ·  · 2014-11-15데이터 통합 데이터 통합은 여러 Forwarder에서 단일 Splunk

관리자 매뉴얼 Splunk Enterprise 7.0 - docs.splunk.com · Splunk Enterprise 관리 소개 이 매뉴얼의 사용 방법 이 매뉴얼에서는 Splunk를 관리할 수 있는

관리자 매뉴얼 Splunk Enterprise 7.0 - docs.splunk.com · Splunk Enterprise 관리 소개 이 매뉴얼의 사용 방법 이 매뉴얼에서는 Splunk를 관리할 수 있는

Using Splunk Enterprise with VxRail Appliances and Isilon for … · 2021. 1. 24. · Splunk Enterprise 6.5.0 Splunk Universal Forwarder 6.5.0 RedHat Linux 64-bit 6.7 VMware vSphere

Using Splunk Enterprise with VxRail Appliances and Isilon for … · 2021. 1. 24. · Splunk Enterprise 6.5.0 Splunk Universal Forwarder 6.5.0 RedHat Linux 64-bit 6.7 VMware vSphere

SPLUNK Enterprise and VMAX All Flash - Performance ... · PDF fileSplunk Enterprise and VMAX All Flash. ... Splunk Enterprise ... The new VMAX All Flash family introduced in 2016 is

SPLUNK Enterprise and VMAX All Flash - Performance ... · PDF fileSplunk Enterprise and VMAX All Flash. ... Splunk Enterprise ... The new VMAX All Flash family introduced in 2016 is

Splunk Enterprise Overview - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Overview.… · Splunk Enterprise Overview. 2 Make machine data accessible, usable

Splunk Enterprise Overview - zc.proact.lvzc.proact.lv/wp-content/uploads/2017/03/Splunk Enterprise Overview.… · Splunk Enterprise Overview. 2 Make machine data accessible, usable