Cisco and Splunk: Under the Hood of Cisco IT Breakout Session
9 likes10,379 views
Cisco has a long-standing relationship with Splunk, using its software and services for IT operations, security analytics, and other purposes across its global data centers. Some key points: - Cisco has used Splunk for over 7 years to monitor over 70 applications and aggregate data from various systems. - Splunk helps Cisco improve IT operations by reducing issues by 50% and resolution times by 90%, and reducing operational costs by 80%. - Cisco's security team uses Splunk to conduct investigations, detecting up to 2-3 million security events per day from various sources. This allows for faster investigations and automated tasks. - Cisco designs and validates architectures for running Splunk on its Cisco UCS servers
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Cisco and Splunk: Under the Hood of Cisco IT Breakout Session (20)
Ad
More from Splunk (20)
Recently uploaded (20)
Cisco and Splunk: Under the Hood of Cisco IT Breakout Session
- 1. Robert Novak, Cisco Big Data Partner CSE Quinn Zuo and Ruby Chiang, Cisco IT July 2015 Cisco and Splunk: Under the Hood of Cisco IT
- 2. Agenda • Cisco’s History with Splunk • How Cisco Uses Splunk • IT Operations • Security Analytics • There’s an App for that! • Splunk + Cisco UCS = Better Together • Learn More
- 3. Would you like to play a game?
- 5. Top 3 Questions 5 Cisco makes servers?
- 6. Top 3 Questions 6 Cisco makes servers? Cisco does big data? 2
- 7. Top 3 Questions 7 Cisco makes servers? Cisco does big data? 2 What’s going on with Cisco and Splunk?
- 8. Funny you should ask…
- 9. Big Data & Analytics – Gain Insight from your Data Data Analytics with Splunk on Cisco UCS Splunk drives operational insights and outcomes for our customers on Cisco UCS Infrastructure Data is the lifeblood of any applications and business. While the real value is in the analytics and the ability of a company to use that intelligence to gain a desired business outcome UCS 6200 Series Fabric Interconnects UCS Manager, UCS Director Express UCS C220/C240 M4 Servers LAN, SAN, Management
- 10. Cisco’s Footprint with Splunk 70+ Monitored Applications 7+ Year Relationship Across 7 Global Data Centers Flexible infrastructure to accommodate new business needs
- 11. How Cisco Uses Splunk Data Analytics with Splunk on Cisco UCS for Cisco’s IT Operations
- 12. Cisco IT Operations Challenges Provide self-service & self- healing capabilities Reduce time required to detect & resolve issues Monitor, manage, protect, and avoid security incidents Manage Cisco UCS Hardware Platforms Empower Cisco’s internal Cloud users to manage their own environments
- 13. Cisco’s IT Operations Results Proactive monitoring enables 50% reduction in high priority issues 80% reduction in operational costs 90% improvement in problem resolution and root cause analysis times Improvements in system stability, availability and performance “Splunk pulls data from all the logs and gives our operations teams a single place to look and work together to solve problems.” — Piyush Bhargava, Distinguished Engineer, Cisco IT
- 14. IT Operations @ Cisco Aggregated multiple siloed systems into Splunk Monitoring 70+ Applications 846% increase of search volume per day in one year Operational Intelligence in minutes rather than hours Cisco IT uses Splunk to index a broad range of system logs and machine data for networking devices, operating systems, unified communications, video events, and applications.
- 15. Don’t take my word for it… Ruby Chiang, IT Program Manager for Cisco IT Quinn Zuo, Cisco IT Architect responsible for EventPro Observations and experiences from the folks at Cisco IT who make it happen
- 16. Under the hood of Cisco EventPro
- 17. Data Center on Canvas Service Categories Service Assets Logical Architecture Physical Architecture End to End View
- 19. Insights Across Cisco - Platform Business Unit Platform SPLUNK App Sources and Logs SYSLOG Windows Active Directory ACS Storage • Infra Structure • IT OPS • Security • Commerce • Sales & Marketing • Channels • Engineering • Webex • CCIX (web + app) • FTP • RAC DB • WSG • PING • OBIEE • ACE • Splunk on Splunk • Deployment Monitor • VMware App • UCS App • JMX App • Unix App • NetApp App • Network • Linux / Unix • UCS • VMWare ESXi • Datacenter battery / temperature logs • Pre-Prod Event Logs • Production Event Logs • Event Logs • Event Logs • AAA Logs • ISE Logs • Event Logs Search Heads Indexers Storage Data Center • 16 VMs (64 core X 32 GB) • 32 VMs (16 core X 16 GB) • 56 TB SAN – Hot & Warm • 28 TB NAS - Cold • Prod: RCDN – 8 SH & 10 Indexers • Prod: ALLEN – 8 SH & 10 Indexers • DR: RTP – 4 SH & 2 indexers
- 20. Insights Across Cisco - Dashboard 3. Security – Hits Monitoring 1. ATS Index Utilization for CCIX layer 2. IT Infrastructure – App Monitoring 4. Marketing – Campaign Activity
- 21. Splunk Searches – Daily Average 1. Interactive Searches = 55K+ 2. Scheduled Searches = 45K+ 3. Total Searches = 100K+ 4. Number of Users = 180+
- 22. 10 Indexers 16 Search Heads 47 Search Heads 32 Indexers Daily Indexing ~ 2TB 2014 2014 2015 2015 2015 Cisco’s IT Operations Evolving with Splunk Daily Indexing 300G 2010
- 23. Data Analytics with Splunk on Cisco UCS for Security Analytics Using Splunk @ Cisco CSIRT
- 24. About CSIRT • Cisco Computer Security Incident Response Team (CSIRT) • CSIRT = Security Monitoring and Incident Response • Architecture, Engineering, Research, and Investigations • Enterprise global threat and 24x7 incident response
- 25. CSIRT Environments Recent Snapshot 300 locations in 90 countries 400 buildings 1500+ labs 100,000+ employees on network 50-300 malware-related cases opened in a typical week 650,000+ ip devices on network 130,000 windows hosts 50,000 Linux hosts 40,000 routers 2-3 million highly tuned ids events per day 10+ billion netflow records per day
- 26. Replacing a SIEM @ Cisco • Challenges: SIEM could not meet security needs – Very difficult to index non-security or custom app log data – Serious scale and speed issues. 10GB/day and searches took > 6 minutes – Difficult to customize with reliance on pre-built rules which generated false positives Security Information and event management
- 27. Replacing a SIEM @ Cisco, cont’d • Enter Splunk: Flexible SIEM and empowered team – Easy to index any type of machine data from any source – Over 60 users doing investigations, correlations, reporting, advanced threat detection – All the data + flexible searches and reporting = empowered team – 2TB/day and searches take less than a minute. 7 global data centers with 350TB stored data – Flashback Malware Example – Estimate Splunk is 25% the cost of a traditional SIEM
- 28. CSIRT Logging DeploymentCSIRT Logging Deployment
- 29. 33 percent reduction in the time required to conduct security investigations All security data is readily available in a single, centralized portal for faster and simpler access Ability to automate routine tasks and search log data allows CSIRT analysts to work more effectively Substantially easier correlation allows for more thorough investigations Heading Cisco Security Analytics Results
- 30. Cisco’s CSIRT engineers applied their experiences during the CSIRT deployment to a new O’Reilly book now available at most booksellers bitly.com/infosecplaybook “And they wrote the book …” 30
- 31. There’s an app for that… (or a technology add-on, at least)
- 32. 120+ security apps & add-onsSplunk app for Enterprise Security Splunk Apps for Cisco Environments Cisco ASA NetFlow Logic OSSEC Cisco WSA Cisco ESA Cisco ISE Sourcefire Active Directory Cisco Security Suite MobileIron Bit9 ETD Norse Darklist 500+ apps/add-ons Cisco ACI, IOS, Nexus 9000 Cisco UCS VMware NetApp Servicenow UNIX/Linux
- 33. Splunk App for Cisco UCS NEW AND IMPROVED as of May 28, 2015 Aggregates, monitors, trends and analyzes all relevant data from Cisco UCS Manager instances Enables proactive capacity and performance monitoring/ management, fault trending, power and cooling, and more Works with other Splunk add-ons and data sources (including Enterprise Security and PCI Compliance add-ons) to aggregate and correlate data across your enterprise 33 Application s Operating Systems Hypervisors UCS server, storage, network
- 34. Splunk on Cisco UCS
- 35. What is Cisco’s Unified Computing System (UCS)? Unified Management: UCS Manager uses policy-based configuration to ensure consistent deployments Unified Fabric: Integrated 10 Gigabit Ethernet and Storage Networking (FCoE/iSCSI) Service Profiles: Maintain consistency across batches of servers and multiple applications. Deploy and expand in record time. Performance: Built with 10GbE at the core, 40GbE available, repeatable configurations and performance, and over 100 benchmark records
- 36. Why Splunk on Cisco UCS? Time to Deployment: Spin up a mutually validated, pre-tested environment in minutes rather than days or weeks Total Cost of Ownership: Integrated networking and management reduce customer cost and effort to migrate, deploy, and expand Time to Grow: Expand servers and network capacity quickly and consistently
- 37. Cisco UCS + Splunk = Better Together Seamless Scalability Facilitates Rapid Growth – Scale Splunk from a single server to distributed/clustered deployment – Grow your clusters efficiently and consistently – Runs on the same UCS C-Series servers as other big data platforms Split Second Response Times – Exceptional performance for “needle-in-a-haystack” searches – Consistent performance as simultaneous users increase Simplified Repeatable Deployments – Four pre-tested UCS Integrated Infrastructures – Capacity or performance optimization – NEW! Cisco Validated Design (CVD) with HA and Archiving
- 38. 250 GB indexed per day 4 months retention 250 GB indexed per day 1 month retention Single Server Cisco UCS Reference Architectures UP to 4TB indexed per day 3 months Retention Up to 4TB indexed per day 1 year Retention Clustered Deployment Retention optimized Performance optimized
- 39. Cisco Validated Design (CVD) for Splunk • Developed by Cisco and Splunk engineers in Spring 2015 • 250+ page guide to design and deployment, pallet to production • Based on UCS C-Series (C220, C240, C3160) servers and Splunk Enterprise software • Includes high availability & data archiving • Download for free at cisco.com/go/bigdata_design
- 40. Learn more about Splunk and Cisco UCS
- 41. SplunkBase app resources: splunkbase.splunk.com Cisco’s Big Data Design Hub: cisco.com/go/bigdata_design features Cisco Validated Designs (CVDs) and other architectural docs Big Data Applications Hub: cisco.com/go/bigdata features reference architectures, solution briefs, infrastructure, automation, etc. Learn More About Splunk on Cisco UCS!
- 42. Thank you.