Partner Exec Summit 2018 - Frankfurt: Analytics-driven Security und SOAR

Presentation from the Partner Executive Summit, Frankfurt, 21. November 2018

1. Analytics-Driven Security und Security Orchestration Automation And Response Angelo Brancato CISSP, CISM, CCSK | Security Specialist, EMEA November 21st, Frankfurt am Main

2. Splunk turns machine data into answers Network Servers DevOps Users Cloud Security Databases Of the Same Data DIFFERENT People ASKING DIFFERENT Questions

3. Splunk was built for change from the beginning Send unstructured data from all systems, devices and people Splunk doesn’t structure your data until you start to ask it questions Suite of tools empower you to investigate, monitor and act on any data, anywhere Ideal to detect everchanging cyber attacks

4. Threats ARE more Complex and far reaching NOT CLOSING The Skills GAP Security to Enable business and THE mission

5. TIER 1 ANALYST WORK WILL BE AUTOMATED TIME NOW SPENT TUNING DETECTION AND RESPONSE LOGIC PLATFORM TO ORCHESTRATE THEM ALL 90 % 50 % 1

6. Splunk Security Portfolio DATA PLATFORM ANALYTICS OPERATIONS Platform for Machine Data

7. Splunk Security Portfolio DATA PLATFORM ANALYTICS OPERATIONS Platform for Machine Data Search and Investigate Proactive Monitoring and Alerting Security Situational Awareness Real-time Risk Insight & Automation Reactive Proactive Level 1 Level 2 Level 3 Level 4

8. + Free Apps 125+ Examples, with 180+ Searches Data Onboarding Guides Content Mapping (MITRE ATT&CK, Killchain etc.) Mapping to Premium Apps On-Prem, Cloud, SaaS or Hybrid Performance at Scale Open Ecosystem Native ML/AI Integration

9. + Free Apps ... Many great , free Apps to solve a specific Problem

10. ASSET AND IDENTITY CORRELATION NOTABLE EVENT & INVESTIGATION THREAT INTELLIGENCE RISK ANALYSIS ADAPTIVE RESPONSE CONTENT UPDATE +

11. +

12. Event Sequencing to optimize threat detection and accelerate investigation Use Case Library for faster detection and incident response Updated Investigation Workbench to reduce time to contain and remediate .Conf2018 Release Splunk Enterprise Security 5.2

13. + + Realm of Known Realm of Unknown

14. Splunk-to-Kafka UBA ingestion for enhanced performance and reliability User Feedback Learning to improve threat detection and anomaly customization Native UBA SSO authentication support for IAM tools .Conf2018 Release Splunk User Behavior Analytics 4.2

15. + +

16. + + Optional Optional

17. Decision Making Acting SIEM THREAT INTEL PLATFORM HADOOP GRC AUTOMATED MANUAL (TODAY) FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION TIER 1 TIER 2 TIER 3 Observe Point Products Orient Analytics SOAR for Security Operations Faster execution through the loop yields better security

18. Decision Making Acting SIEM THREAT INTEL PLATFORM HADOOP GRC AUTOMATED AUTOMATED WITH PHANTOM FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION TIER 1 TIER 2 TIER 3 Observe Point Products Orient Analytics SOAR for Security Operations Faster execution through the loop yields better security ACTION RESULTS / FEEDBACK LOOP

19. Splunk SANDBOX QUERY RECIPIENTS USER PROFILE HUNT FILE HUNT FILE FILE REPUTATION FILE ASSESSMENT RUN PLAYBOOK “REMEDIATE" EMAIL ALERT Automated Malware Investigation “Automation with Phantom enables us to process malware email alerts in about 40 seconds vs. 30 minutes or more.” Adam Fletcher CISO, Blackstone A Phantom Case Study

20. Clustering support for scale, performance and redundancy Indicator View for improved threat analysis and hunting Integrated Splunk Search, the only SOAR platform with this capability ANNOUNCING Splunk Phantom 4.1

21. Cloud Security Endpoints Orchestration WAF & App Security Threat Intelligence Network Web Proxy Firewall Identity and Access The thought process The intuition The reflexes Machine Learning & Adaptive Operations & Analytics Driven Security & Splunk as the Security Nerve Center

22. Cloud Security Endpoints Orchestration WAF & App Security Threat Intelligence Network Web Proxy Firewall Identity and Access The thought process The intuition The reflexes Machine Learning & Adaptive Operations & Analytics Driven Security & Splunk as the Security Nerve Center TIER 1 ANALYST WORK WILL BE AUTOMATED TIME NOW SPENT TUNING DETECTION AND RESPONSE LOGIC PLATFORM TO ORCHESTRATE THEM ALL 90 % 50 % 1

23. SPLUNK User Behavior Analytics 4.2 SPLUNK Enterprise Security 5.2 SPLUNK Phantom 4.1 Event Sequencing Accelerate Investigation Investigation Workbench User Feedback Splunk-to-Kafka UBA Connector Targeted Hunting Indicator View Playbook Import Wizard Faster Remediation Use Case Library Optimized Threat Detection Raw Event Drill Down Container-Based Architecture Clustering Support User Management UI Splunk Integration New Onboarding Tour SECURITY PREMIUM APPS – Conf18 Releases

24. Thank you!