Splunk .conf 2018 agenda software#

Splunk is also opening its machine learning tools so customers can write their own algorithms or fine-tune those provided by Splunk. I attended sessions that used Splunk for risk scoring, adversary emulation testing using the MITRE ATT&CK framework, integration with Apache Kafka, etc. It’s always interesting to see how customers are building new use cases on top of Splunk.Splunk promotes and welcomes this industry cooperation. There were user-led session on valuable integrations between Splunk and Palo Alto Networks, Symantec, etc. It seems like every other security vendor (except for competitors) has a Splunk application or integrates with Splunk.Splunk security benefits from some other core Splunk capabilities, including stream processing, data fabric search, Splunk mobile, Splunk TV, etc.This model is like ESG’s security analytics and operations platform architecture ( SOAPA) – capture security data, analyze security data, act upon security data. Splunk now presents its security architecture in three layers: a data layer, analytics layer, and operations layer.I want to automate a task that takes 10 minutes that we do hundreds of times every week.” It’s worth noting that with the acquisition of Phantom, Splunk is much more focused on security operations processes and best practices than it was in the past. As one presenter said, “I don’t want to automate an hour-long task we do once a week. There is a short-term focus on automating mundane tasks. Using Phantom (or other security automation/orchestration tools), Splunk customers are automating as many security processes as they can, as quickly as they can.OODA is a good framework for the Splunk/Caspida/Phantom triad. This is a military technique for decision making based upon data analytics. With the addition of Phantom, Splunk talked a lot about the OODA loop (i.e.choosing which security operations tasks to delegate to partners), but Splunk’s list is pretty complete.

Splunk .conf 2018 agenda software#

SOAPA functionality for data management services, software services, etc.) and outsourcing (i.e.

Providing a central place to measure all aspects of reporting. Deliver a security-centric tracking system that spans security incident management lifecycles. Offer a workbench for security operations while connecting to collaboration tools like Slack. Provide intuitive tools to figure out what cyber-attacks are happening and why they are happening. Monitor and record security operations and then recommend proven actions to the SOC team. Use APIs to connect security controls together for investigations and remediation actions. Automate all pedestrian tasks and accelerate more complex tasks. Using advanced analytics to identify new attacks and then spreading the warning around to all connected customers. Collecting and processing a growing body of security telemetry.

Splunk articulated a vision of security analytics/operations for 2020 that included 10 areas:.

I spent the early part of this week in Orlando, attending Splunk.