Webinar: Splunk Enterprise Security Deep Dive: Analytics
•
8 recomendaciones•2,498 vistas
Splunk Enterprise Security (ES) ist ein Analytics-getriebenes SIEM, das Security Operations Teams erfolgreich bei der Gefahrenbekämpfung unterstützt. Aber wussten Sie auch schon, dass es aus einem Framework aufgebaut ist, das ganz individuell genutzt werden kann, um spezifische Sicherheitsanforderungen angehen zu können? In unserem Webinar zeigen wir Ihnen die technischen Details hinter dem ES-Framework: - Asset- und Identitäts-Korrelationen - beachtenswerte Events - Threat intelligence - Risikoanalyse - Investigation und Adaptive Response Wir werden Alltags-Beispiele besprechen und Ihnen anhand einer Demo die Schlüssel-Frameworks zeigen, die Ihnen dabei helfen werden, Securityprobleme zu lösen.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (20)
Similar a Webinar: Splunk Enterprise Security Deep Dive: Analytics
Similar a Webinar: Splunk Enterprise Security Deep Dive: Analytics (20)
Más de Splunk
Más de Splunk (20)
Último
Último (20)
Webinar: Splunk Enterprise Security Deep Dive: Analytics
- 2. Safe Harbor Statement During the course of this presentation, we may make forward looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. 2
- 5. Splunk – Leader in Cybersecurity 5 Company (NASDAQ: SPLK) • Founded 2004, first software release in 2006 • HQ: San Francisco / Regional HQ: London, Hong Kong • Over 2,500 employees, based in 12 countries Business Model / Products • Free download to massive scale • Splunk Enterprise, Splunk Cloud, Splunk Light • Hunk: Splunk Analytics for Hadoop 12,000+ Customers • Customers in 100 countries • 85 of the Fortune 100 • Largest license: Over 1 Petabytes per day
- 9. Splunk Enterprise Security: Frameworks 9 Framework Detail Notable Events Identify noteworthy incidents from events and then manage state Asset & Identity performs asset and identity correlation for fields that might be present in an event Threat Intelligence Consume and manage threat feeds, data Risk Analysis Identify actions that raise the risk profile of individuals or assets Adaptive Response Interface for retrieving, sending and running actions by integrating with external applications
- 11. SIEM Use Cases Critical Capabilities* ES Frameworks * Gartner Research Document : 2016 Critical Capabilities for SIEM Basic Security Monitoring Advanced Threat Defense Forensics and Incident Response Real-Time Monitoring User Monitoring Incident Response and Management Advanced Analytics Threat intelligence & Business Context Advanced Threat Defense Data and Application Monitoring Deployment and Support Flexibility Notable Events Asset & Identity Threat Intelligence Risk Analysis Adaptive Response
- 24. Collect, manage Categorize Correlate Search Data Management Threat Activity Correlation Data / Notable Events Data Search Threat Intelligence Framework Framework built-in Splunk Enterprise Security
- 32. Insight from Across Ecosystem Effectively leverage security infrastructure to gain a holistic view 1. Palo Alto Networks 2. Anomali 3. Phantom 4. Cisco 5. Fortinet 6. Threat Connect 7. Ziften 8. Acalvio 9. Proofpoint 10. CrowdStrike 11.Symantec (Blue Coat) 12.Qualys 13.Recorded Future 14.Okta 15.DomainTools 16.Cyber Ark 17.Tanium 18.Carbon Black 19.ForeScout Workflow Identity Network Internal Network Security App Endpoints Web Proxy Threat Intel
- 34. Demo
- 35. Wrap Up
- 37. Splunk Response Process 37 Risk score triggers alert for target OPs team responds, gathers info, claims notable events & updates them with info OPs team creates incidents for automated in- depth malware scans an/or automated forensics, updates events OPs team submits any binary samples from target to enterprise AV vendor, requests AC scan & cleanup Infosec confirm using Splunk & data collected by Ops that target is clean. If target is not clean, IS can request rebuild or access to target for more forensics Notes 1. Integration with ServiceNow is planned 2. Process is Pareto-inspired: 80% of events can be handled by this process, on 80% of the infrastructure (Windows, server/client) and resolved at least 80% effective in the first instance 3. For events which OPs cannot resolve (no skills, no access) they can always add value by collecting information about the target
- 39. Q&A