Splunk Enterprise Security

May 23, 2021Download as PPTX, PDF0 likes546 views

This presentation introduces Splunk Enterprise Security (ES) and its security portfolio. It discusses Splunk's workflow and frameworks that enable key security use cases. The frameworks presented include Notable Events, Asset and Identity, Risk, Threat Intelligence, and Adaptive Response. Desh Cyber is highlighted as a reliable partner that provides Splunk-based security solutions along with training and 24/7 monitoring services.

Presentation Topics : Splunk Enterprise Security(ES).
Presenter : Md Mofijul Haque
Business Development Executive
Sabuz@deshcloud.com

OUTCOME….
 INTRODUCE WITH SPLUNK ENTERPRISE SECURITY(ES)
SPLUNK SECURITY PORTFOLIO
SPLUNK WORKFLOW & FRAMEWORK
FRAMEWORKS ENABLE USE CASES
WHY DESH CYBER IS RELIABLE
Q&A

MOSTLY FACED SECURITY OPERATIONS NOW
A DAYS

SPLUNK WORK AS
FULLY OPTIMIZED FOR MODERN SECURITY
OPERATIONS

WORKFLOW FOR STREAMLINED INCIDENT
MANAGEMENT
NOTABLE EVENTS FRAMEWORK
Streamline Incident
Management
Consolidated incident
management allows effective
lifecycle management of
security incidents. Make Rapid Decisions
Automatically aligns all
security context together for
fast incident qualification
and provides predefined
analysis paths
Refine Security Management
Investigation management and
customizations to support
complex process integration
requirements.

NOTABLE EVENTS AND INCIDENT REVIEW
Use for Security Operations
“Application” logics are pre-built on
top of Splunk Enterprise as data
platform.
Provide graphically oriented user
experience supporting the security
operations workflow
Intuitive User Interface Optimized for
Security
Operations
Security operational tasks designed
into user interface versus search bar
interface.
Key relevant information
automatically presented as summary
of incident.

CONSOLIDATED INCIDENT MANAGEMENT
INTERFACE

ASSET AND IDENTITY FRAMEWORK
Automatically maps asset and identity context to incidents
Fast Incident
Qualification
By automating
context enrichment,
SecOps can qualify
more incidents
quickly
Extended Situation Based
Insights
Rich enrichment allows
more accurate assessment
of situational aspect of
incidents

ASSET AND IDENTITY FRAMEWORK : ASSET
DATABASE

ASSET AND IDENTITY FRAMEWORK : IDENTITY
DATABASE

ASSET AND IDENTITY FRAMEWORK :
ENRICHMENT

REPRESENTATIVE LIST OF ASSETS AND
IDENTITIES

RISK FRAMEWORK
Quantitative metrics are applied to distinguish
importance

THREAT INTELLIGENCE FRAMEWORK
Finding hidden IOCs using comprehensive threat intelligence mappings

WHY DESH CYBER ?
• HIGHLY EXPERIENCED TECHNICAL TEAM .
• BEST COMPETITIVE PRICE WITH BEST SERVICE.
• FIRST BANGLADESHI COMPANY TO ASSOCIATE PARTNER WITH SPLUNK .
• WE WILL PROVIDE TRAINING TO YOUR ORGANIZATIONS .
• DESH CYBER WILL PROVIDE 24/7 MONITORING TO YOUR ORGANIZATIONS .

WE ALSO PROVIDE ….
PHISHING AWARNESS TRAING
(KNOWBE4)
EMAIL THREAT SOLUTIONS
(VAILMAIL)
CISCO UMBRELLA
& MANY OTHER SECURITY
TOOLS AND SERVICES

Microsoft Sentinel is a cloud-native security information and event management (SIEM) solution powered by AI and automation. It collects security data from various sources at cloud scale, uses machine learning to analyze the data and detect threats, provides visualizations to investigate incidents and related entities, and enables automating common security tasks and workflows through automation rules and playbooks. This increases security operations efficiency and helps organizations accelerate response to security threats.

Exploring Frameworks of Splunk Enterprise SecuritySplunk

This document discusses Splunk Enterprise Security and its frameworks for addressing security operations challenges. It provides an overview of Splunk's security portfolio and how it can help with issues like slow investigations, limited data ingestion, and inflexible deployments faced by legacy SIEMs. Key frameworks covered include the Notable Events framework for streamlining incident management across the entire lifecycle from detection to remediation. It also discusses the Asset and Identity framework for automatically enriching incidents with relevant context to help with rapid qualification and situational awareness.

QRadar, ArcSight and Splunk M sharifi

The document provides a review and comparison of the QRadar, ArcSight, and Splunk SIEM platforms. It summarizes their key capabilities and components. For each solution, it outlines strengths such as integrated monitoring, analytics features, and scalability. It also notes weaknesses such as complexity, customization limitations, and high data volume licensing costs. The comparison finds QRadar well-suited for smaller deployments, ArcSight for medium-large organizations, and notes Splunk's log collection strengths but limited out-of-the-box correlations compared to competitors. Gartner assessments for each platform cover visibility trends, deployment challenges, and roadmap monitoring advice.

Splunk Enterprise SecuritySplunk

This document discusses Splunk Enterprise Security and its frameworks for analyzing security data. It provides an overview of Splunk's security portfolio and how it addresses challenges with legacy SIEM solutions. Key frameworks covered include Notable Events for streamlining incident management, Asset and Identity for enriching incidents with contextual data, Risk Analysis for prioritizing incidents based on quantitative risk scores, and Threat Intelligence for detecting indicators of compromise in machine data. Interactive dashboards and incident review interfaces are highlighted as ways to investigate threats and monitor the security posture.

All Presentations during CXL Forum at Flash Memory Summit 22Memory Fabric Forum

The document summarizes a full-day forum hosted by the CXL Consortium and MemVerge on CXL. The morning agenda includes presentations on CXL from representatives of Google, Intel, PCI-SIG, Marvell, Samsung, and Micron. The afternoon agenda includes panels on CXL usage models from Meta, OCP, Anthropic, and MemVerge. A keynote presentation provides an update on the CXL Consortium and the recently released CXL 3.0 specification, including its expanded fabric capabilities and management features. The specification is aimed at enabling new usage models for memory sharing and expansion to address industry trends toward increased data processing demands.

SOC and SIEM.pptxSandeshUprety4

SOC and SIEM systems can help organizations detect and respond to security incidents and threats in a timely manner. A SOC acts as a security operations center to monitor, analyze, and respond to cybersecurity incidents. SIEM provides real-time analysis of security alerts and events to help identify potential threats. Implementing SOC and SIEM solutions can improve an organization's security posture through early threat detection, compliance with regulations, and reduced breach impact.

A visual introduction to Apache KafkaPaul Brebner

Crowdstrike .pptxuthayakumar174828

This document provides an overview of CrowdStrike's endpoint security solutions. It describes CrowdStrike as a cloud-based software as a service solution that provides next-generation antivirus, endpoint detection and response via machine learning. The document outlines CrowdStrike's features, including Falcon Prevent for NGAV, Falcon Insight for EDR/XDR, Falcon Overwatch for threat hunting, Falcon Discover for IT hygiene, and Falcon Spotlight for vulnerability management. It emphasizes how CrowdStrike solutions can improve security, reduce complexity and provide better protection against cyber threats.

Splunk-Presentation PrasadThorat23

The document provides an overview of the Splunk data platform. It discusses how Splunk helps organizations overcome challenges in turning real-time data into action. Splunk provides a single platform to investigate, monitor, and take action on any type of machine data from any source. It enables multiple use cases across IT, security, and business domains. The document highlights some of Splunk's products, capabilities, and customer benefits.

SOC Architecture Workshop - Part 1Priyanka Aash

The document discusses advanced security operations centers (A-SOCs) and their capabilities. It describes how A-SOCs go beyond traditional SOCs by focusing on threat mitigation, proactive monitoring and intelligence. It outlines key A-SOC capabilities like threat assessment and hunting, threat intelligence, situational awareness, and security analytics. The document also provides examples of A-SOC architecture, frameworks, technologies, queries, organization structure, and processes. It proposes a maturity model for advanced SOC services and provides an example use case for the Carbanak attack.

Splunk OverviewSplunk

The document appears to be a presentation by Splunk Inc. discussing their data platform. Some key points: 1. Splunk's platform allows customers to investigate, monitor, analyze and act on data from any source in real-time. 2. It addresses challenges of collecting and making sense of massive amounts of data from various systems and devices across IT, security, and IoT use cases. 3. Splunk provides solutions and services to help customers accelerate their data journey from initial investigation to taking action.

Next-Gen security operation centerMuhammad Sahputra

Talking about Next-Gen Security Operation Center for IDNIC+APJII as representative from IDSECCONF. People-Centric SOC requires lot of investment on human in terms of quantity and quality, unfortunately, (good) IT security people are getting rare these days. Organisation need to put their investments more on technology, as in Industry 4.0, machines are getting more advanced to support Human on doing continuous and repetitive task. Moving from “traditional” to next-gen SOC require proper plan, thats what this talk was about.

Splunk Phantom SOAR RoundtableSplunk

Splunk for Enterprise Security and User Behavior AnalyticsSplunk

This session will review Splunk’s two premium solutions for information security organizations: Splunk for Enterprise Security (ES) and Splunk User Behavior Analytics (UBA). Splunk ES is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments – allowing you to quickly detect and respond to external and internal attacks, simplifying threat management while decreasing risk. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams. We’ll discuss each solution and see them integrated and in action through detailed demos.

Splunk OverviewSplunk

Splunk provides software that allows users to search, monitor, and analyze machine-generated data. It collects data from websites, applications, servers, networks and other devices and stores large amounts of data. The software provides dashboards, reports and alerts to help users gain operational intelligence and insights. It is used by over 4,400 customers across many industries to solve IT and business challenges.

SOC presentation- Building a Security Operations CenterMichael Nickle

From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash

You own a SIEM, but to be secure, you need a Security Operations Center! How do you cross the chasm? Do you hire staff or outsource? And what skills are needed? Mike Ostrowski, a cybersecurity industry veteran, will review common pitfalls experienced through the journey from SIEM to SOC, the pros and cons of an all in-house SOC vs. outsourcing, and the benefits of a hybrid SOC model. Learning Objectives: 1: You own a SIEM, but to be secure, you need a SOC. How do you cross the chasm? 2: What are the pros and cons of in-house, fully managed and hybrid security? 3: What considerations go into deciding whether to employ a hybrid strategy? (Source: RSA Conference USA 2018)

Security Information and Event Management (SIEM)k33a

This document provides an overview of security information and event management (SIEM). It defines SIEM as software and services that combine security information management (SIM) and security event management (SEM). The key objectives of SIEM are to identify threats and breaches, collect audit logs for security and compliance, and conduct investigations. SIEM solutions centralize log collection, correlate events in real-time, generate reports, and provide log retention, forensics and compliance reporting capabilities. The document discusses typical SIEM features, architecture, deployment options, and reasons for SIEM implementation failures.

Security Operations Center (SOC) Essentials for the SMEAlienVault

Closing the gaps in security controls, systems, people and processes is not an easy feat, particularly for IT practitioners in smaller organizations with limited budgets and few (if any) dedicated security staff. So, what are the essential security capabilities needed to establish a security operations center and start closing those gaps? Join Javvad Malik of 451 Research and Patrick Bedwell, VP of Product Marketing at AlienVault for this session covering: *Developments in the threat landscape driving a shift from preventative to detective controls *Essential security controls needed to defend against modern threats *Fundamentals for evaluating a security approach that will work for you, not against you *How a unified approach to security visibility can help you get from install to insight more quickly

Building Security Operation CenterS.E. CTS CERT-GOV-MD

The document discusses building a security operations center (SOC) and provides information on why an organization would build a SOC, how to establish the necessary skills and processes, and technology solutions like HP ArcSight that can be used. It describes how HP consultants have experience building SOCs for major companies and can help customers establish an effective SOC to monitor for security events, ensure compliance, and protect the organization. It provides details on how to structure a SOC, including defining roles and processes, implementing a security information and event management (SIEM) system, and establishing performance metrics to improve over time.

Getting started with SplunkSplunk

This document provides an overview and getting started guide for Splunk. It discusses what Splunk is for exploring machine data, how to install and start Splunk, add sample data, perform basic searches, create saved searches, alerts and dashboards. It also covers deployment and integration topics like scaling Splunk, distributing searches across data centers, forwarding data to Splunk, and enriching data with lookups. The document recommends resources like the Splunk community for support.

Getting Started with Splunk (Hands-On) Splunk

Here’s your chance to get hands-on with Splunk for the first time! Bring your modern Mac, Windows, or Linux laptop and we’ll go through a simple install of Splunk. Then, we’ll load some sample data, and see Splunk in action – we’ll cover searching, pivot, reporting, alerting, and dashboard creation. At the end of this session you’ll have a hands-on understanding of the pieces that make up the Splunk Platform, how it works, and how it fits in the landscape of Big Data. You’ll experience practical examples that differentiate Splunk while demonstrating how to gain quick time to value.

PPT-Splunk-LegacySIEM-101_FINALRisi Avila

This document discusses replacing a legacy security information and event management (SIEM) system with Splunk Enterprise. It outlines 10 common problems with legacy SIEMs, such as an inability to ingest and analyze all relevant log and machine data. Customer case studies show how Splunk can help organizations replace aging SIEMs in a few months to gain scalability, faster security investigations, and the ability to ensure compliance. The presentation covers Splunk's security monitoring and analytics capabilities and migration options from legacy SIEMs to Splunk. Attendees are invited to sign up for a SIEM replacement workshop to discuss their specific needs.

Empower Your Security Practitioners with Elastic SIEMElasticsearch

DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh

This document discusses building a cyber security operations center (CSOC). It covers the need for a CSOC, its core components including security information and event management (SIEM), and integrating components like monitoring, alerting, and reporting. Key aspects that are important for a successful CSOC are people, processes, and technology. The roles and skills required for people in the CSOC and training needs are outlined. Developing standardized processes, procedures and workflows that align with frameworks like ISO are also discussed.

Siem pptkmehul

SIEM Primer:Anton Chuvakin

SIEM stands for Security Information and Event Management. It involves collecting, aggregating, normalizing and retaining logs and other security-related data from across an organization. SIEM performs analysis on this data through correlation, prioritization and notification/alerting. It also provides reporting and workflow capabilities for security teams. While SIEM promises improved security through these functions, it requires careful planning, scoping, requirements development and ongoing focus to avoid failures and ensure value.

Building a Next-Generation Security Operations Center (SOC)Sqrrl

So, you need to build a Security Operations Center (SOC)? What does that mean? What does the modern SOC need to do? Learn from Dr. Terry Brugger, who has been doing information security work for over 15 years, including building out a SOC for a large Federal agency and consulting for numerous large enterprises on their security operations. Watch the presentation with audio here: http://info.sqrrl.com/sqrrl-october-webinar-next-generation-soc

LIFT OFF 2017: Transforming SecurityRobert Herjavec

This document discusses how Splunk is transforming security through their security platform and solutions. It provides an overview of Splunk's security analytics, awareness and response capabilities including machine learning, risk scoring, threat intelligence and more. It also outlines Splunk's security framework and how their solutions integrate with various security data sources and tools to provide end-to-end security visibility across on-premise, cloud, and hybrid environments.

Splunk Discovery Day Dubai 2017 - Security KeynoteSplunk

This document discusses Splunk's security vision, strategy, and platform. It outlines Splunk's positioning as a leader in security information and event management. It describes Splunk's security portfolio and how the platform can be used to prevent, detect, respond to and predict security threats. It also provides examples of how Splunk has helped customers in various industries improve their security operations and gain insights from security and other machine data.

More Related Content

What's hot (20)

Splunk-Presentation PrasadThorat23

SOC Architecture Workshop - Part 1Priyanka Aash

Splunk OverviewSplunk

Next-Gen security operation centerMuhammad Sahputra

Splunk Phantom SOAR RoundtableSplunk

Splunk for Enterprise Security and User Behavior AnalyticsSplunk

Splunk OverviewSplunk

SOC presentation- Building a Security Operations CenterMichael Nickle

From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash

Security Information and Event Management (SIEM)k33a

Security Operations Center (SOC) Essentials for the SMEAlienVault

Building Security Operation CenterS.E. CTS CERT-GOV-MD

Getting started with SplunkSplunk

Getting Started with Splunk (Hands-On) Splunk

PPT-Splunk-LegacySIEM-101_FINALRisi Avila

Empower Your Security Practitioners with Elastic SIEMElasticsearch

DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh

Siem pptkmehul

SIEM Primer:Anton Chuvakin

Building a Next-Generation Security Operations Center (SOC)Sqrrl

Splunk-Presentation PrasadThorat23

SOC Architecture Workshop - Part 1Priyanka Aash

Splunk OverviewSplunk

Next-Gen security operation centerMuhammad Sahputra

Splunk Phantom SOAR RoundtableSplunk

Splunk for Enterprise Security and User Behavior AnalyticsSplunk

Splunk OverviewSplunk

SOC presentation- Building a Security Operations CenterMichael Nickle

From SIEM to SOC: Crossing the Cybersecurity ChasmPriyanka Aash

Security Information and Event Management (SIEM)k33a

Security Operations Center (SOC) Essentials for the SMEAlienVault

Building Security Operation CenterS.E. CTS CERT-GOV-MD

Getting started with SplunkSplunk

Getting Started with Splunk (Hands-On) Splunk

PPT-Splunk-LegacySIEM-101_FINALRisi Avila

Empower Your Security Practitioners with Elastic SIEMElasticsearch

DTS Solution - Building a SOC (Security Operations Center)Shah Sheikh

Siem pptkmehul

SIEM Primer:Anton Chuvakin

Building a Next-Generation Security Operations Center (SOC)Sqrrl

Similar to Splunk Enterprise Security (20)

LIFT OFF 2017: Transforming SecurityRobert Herjavec

Splunk Discovery Day Dubai 2017 - Security KeynoteSplunk

SplunkLive! Paris 2018: Use Splunk for Incident Response, Orchestration and A...Splunk

Automating your AWS Security OperationsEvident.io

This document discusses automating security operations on AWS. It begins by noting the large costs of data breaches and intellectual property theft for businesses. It then discusses how AWS can provide more security than an on-premises environment through features like automated logging and monitoring, simplified access controls, and encryption. The document emphasizes that security is a shared responsibility between AWS and the customer, with AWS securing the underlying cloud infrastructure and customers securing their applications and data. It provides examples of AWS security certifications and programs. Finally, it discusses how security automation is key to keeping up with the scale of cloud infrastructure and software delivery.

Partner Exec Summit 2018 - Frankfurt: Analytics-driven Security und SOARSplunk

This document summarizes a presentation about analytics-driven security and security orchestration, automation and response (SOAR). It discusses how Splunk turns machine data into answers by collecting data from various sources and allowing users to ask different questions of the same data. It also describes Splunk's security portfolio including products for data, analytics, and operations. Key releases from the .conf2018 conference are highlighted for Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk Phantom that focus on accelerating investigation, improving threat detection, and enabling faster remediation through automation.

Splunk for Enterprise Security featuring UBA Splunk

This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams

Splunk for Enterprise Security Featuring UBASplunk

This document provides an overview and summary of Splunk's security products, including Enterprise Security and User Behavior Analytics. It discusses the key capabilities and features of these products, such as detecting advanced cyberattacks, identifying insider threats through machine learning, and integrating UBA with SIEM for improved threat detection. New features in recent versions are highlighted, like custom threat modeling and enhanced visibility into user, device, application, and protocol activity. Customer testimonials praise Splunk UBA's data-science approach to finding hidden threats.

Splunk for Enterprise Security featuring UBA Breakout SessionSplunk

Splunk User Behavior Analytics (UBA) 2.2 provides enhanced security analytics and detection capabilities. It uses machine learning to establish baseline behaviors and detect anomalies. UBA analyzes activities across users, hosts, networks, applications and data to identify potential threats. The latest version features expanded visibility metrics, custom threat modeling capabilities, and improved context enrichment through integrations with additional security technologies.

SplunkLive! London 2017 - Building an Analytics Driven Security Operation Cen...Splunk

This document discusses building an analytics-driven security operations center (SOC). It begins with an overview of traditional SOCs and their limitations, such as focusing primarily on alerts. It then discusses emerging trends in security operations that are driving the need for an analytics-driven SOC, such as the focus on detection and response. The document proposes seven enablers for building an analytics-driven SOC using Splunk, including selecting the right sourcing strategy, adopting an adaptive security architecture, optimizing threat intelligence management, deploying advanced analytics like machine learning, enabling proactive threat hunting, promoting automation and efficiency, and driving broader enterprise insights.

Cloudbrew 2019 - Threat hunting with the Microsoft CloudTom Janetscheck

With the release of Azure Sentinel, Microsoft has shifted some features from Azure Security Center to their new threat hunting solution. But how do all the security tools Microsoft offers nowadays integrate with each other? How can you find a way through this security jungle? And how do you make sure to have the right tools in place when it comes to protecting your IT environments and hunting threats? Join cloud security expert and Microsoft MVP Tom Janetscheck for this demo-rich session to get all these questions answered and to learn how to protect your resources easily and efficiently.

.conf Go Zurich 2022 - Security SessionSplunk

The document appears to be a presentation from Splunk on security topics. It includes sections on cyber security resilience, the data-centric modern SOC, application monitoring at scale, threat modeling, security monitoring journeys, self-service Splunk infrastructure, the top 3 CISO priorities of risk based alerting, use case development, a security content repository, security PVP (posture, vision, and planning) and maturity assessment, and concludes with an overview of how Splunk can provide end-to-end visibility across an organization.

Combating Fraud and Intrusion Threats with Event ProcessingTim Bass

Webinar: Neues zur Splunk App for Enterprise SecurityGeorg Knon

Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk

SplunkLive! Frankfurt 2018 - Use Splunk for Incident Response, Orchestration ...Splunk

Data Streaming with Apache Kafka in the Defence and Cybersecurity IndustryKai Wähner

Agenda: 1) Defence, Modern Warfare, and Cybersecurity in 202X 2) Data in Motion with Apache Kafka as Defence Backbone 3) Situational Awareness 4) Threat Intelligence 5) Forensics and AI / Machine Learning 6) Air-Gapped and Zero Trust Environments 7) SIEM / SOAR Modernization Technologies discussed in the presentation include Apache Kafka, Kafka Streams, kqlDB, Kafka Connect, Elasticsearch, Splunk, IBM QRadar, Zeek, Netflow, PCAP, TensorFlow, AWS, Azure, GCP, Sigma, Confluent Cloud,

SplunkLive! Munich 2018: Use Splunk for incident Response, Orchestration and ...Splunk

Splunk for Enterprise Security featuring User Behavior Analytics Splunk

Top 10 cloud security tools to adopt in 2024.pdfSparity1

Prezentare_RSA.pptxAgusNursidik

Centralizing incident response is important to minimize loss from attacks. Tools that provide visibility into logs, packets, endpoints and threat intelligence are essential for detection and response. They allow security teams to spot anomalous activity, investigate incidents, and respond in a timely manner. RSA NetWitness provides a framework to centralize incident response through security operations centers that capture, enrich and analyze data to improve detection and guide investigations. It enables rapid response through data enrichment and analytics.

LIFT OFF 2017: Transforming SecurityRobert Herjavec

Splunk Discovery Day Dubai 2017 - Security KeynoteSplunk

SplunkLive! Paris 2018: Use Splunk for Incident Response, Orchestration and A...Splunk

Automating your AWS Security OperationsEvident.io

Partner Exec Summit 2018 - Frankfurt: Analytics-driven Security und SOARSplunk

Splunk for Enterprise Security featuring UBA Splunk

Splunk for Enterprise Security Featuring UBASplunk

Splunk for Enterprise Security featuring UBA Breakout SessionSplunk

SplunkLive! London 2017 - Building an Analytics Driven Security Operation Cen...Splunk

Cloudbrew 2019 - Threat hunting with the Microsoft CloudTom Janetscheck

.conf Go Zurich 2022 - Security SessionSplunk

Combating Fraud and Intrusion Threats with Event ProcessingTim Bass

Webinar: Neues zur Splunk App for Enterprise SecurityGeorg Knon

Splunk for Enterprise Security featuring User Behavior AnalyticsSplunk

SplunkLive! Frankfurt 2018 - Use Splunk for Incident Response, Orchestration ...Splunk

Data Streaming with Apache Kafka in the Defence and Cybersecurity IndustryKai Wähner

SplunkLive! Munich 2018: Use Splunk for incident Response, Orchestration and ...Splunk

Splunk for Enterprise Security featuring User Behavior Analytics Splunk

Top 10 cloud security tools to adopt in 2024.pdfSparity1

Prezentare_RSA.pptxAgusNursidik

Recently uploaded (20)

"Rebranding for Growth", Anna VelykoivanenkoFwdays

Automation Hour 1/28/2022: Capture User Feedback from AnywhereLynda Kane

Learn the Basics of Agile Development: Your Step-by-Step GuideMarcel David

Role of Data Annotation Services in AI-Powered ManufacturingAndrew Leo

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

Spark is a powerhouse for large datasets, but when it comes to smaller data workloads, its overhead can sometimes slow things down. What if you could achieve high performance and efficiency without the need for Spark? At S&P Global Commodity Insights, having a complete view of global energy and commodities markets enables customers to make data-driven decisions with confidence and create long-term, sustainable value. 🌍 Explore delta-rs + CDC and how these open-source innovations power lightweight, high-performance data applications beyond Spark! 🚀

Procurement Insights Cost To Value Guide.pptxJon Hansen

Image processinglab image processing image processingRaghadHany

Cyber Awareness overview for 2025 month of securityriccardosl1

#AdminHour presents: Hour of Code2018 slide deck from 12/6/2018Lynda Kane

Asthma presentación en inglés abril 2025 pdfVanessaRaudez

Datastucture-Unit 4-Linked List Presentation.pptxkaleeswaric3

tecnologias de las primeras civilizaciones.pdffjgm517

DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock

Building 10x Organizations with Modern Productivity Metrics 10x developers may be a myth, but 10x organizations are very real, as proven by the influential study performed in the 1980s, ‘The Coding War Games.’ Right now, here in early 2025, we seem to be experiencing YAPP (Yet Another Productivity Philosophy), and that philosophy is converging on developer experience. It seems that with every new method we invent for the delivery of products, whether physical or virtual, we reinvent productivity philosophies to go alongside them. But which of these approaches actually work? DORA? SPACE? DevEx? What should we invest in and create urgency behind today, so that we don’t find ourselves having the same discussion again in a decade?

Network Security. Different aspects of Network Security.gregtap1

The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john

Special Meetup Edition - TDX Bengaluru Meetup #52.pptxshyamraj55

SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfPrecisely

Linux Professional Institute LPIC-1 Exam.pdfRHCSA Guru

AI Changes Everything – Talk at Cardiff Metropolitan University, 29th April 2...Alan Dix

Talk at the final event of Data Fusion Dynamics: A Collaborative UK-Saudi Initiative in Cybersecurity and Artificial Intelligence funded by the British Council UK-Saudi Challenge Fund 2024, Cardiff Metropolitan University, 29th April 2025 https://alandix.com/academic/talks/CMet2025-AI-Changes-Everything/ Is AI just another technology, or does it fundamentally change the way we live and think? Every technology has a direct impact with micro-ethical consequences, some good, some bad. However more profound are the ways in which some technologies reshape the very fabric of society with macro-ethical impacts. The invention of the stirrup revolutionised mounted combat, but as a side effect gave rise to the feudal system, which still shapes politics today. The internal combustion engine offers personal freedom and creates pollution, but has also transformed the nature of urban planning and international trade. When we look at AI the micro-ethical issues, such as bias, are most obvious, but the macro-ethical challenges may be greater. At a micro-ethical level AI has the potential to deepen social, ethnic and gender bias, issues I have warned about since the early 1990s! It is also being used increasingly on the battlefield. However, it also offers amazing opportunities in health and educations, as the recent Nobel prizes for the developers of AlphaFold illustrate. More radically, the need to encode ethics acts as a mirror to surface essential ethical problems and conflicts. At the macro-ethical level, by the early 2000s digital technology had already begun to undermine sovereignty (e.g. gambling), market economics (through network effects and emergent monopolies), and the very meaning of money. Modern AI is the child of big data, big computation and ultimately big business, intensifying the inherent tendency of digital technology to concentrate power. AI is already unravelling the fundamentals of the social, political and economic world around us, but this is a world that needs radical reimagining to overcome the global environmental and human challenges that confront us. Our challenge is whether to let the threads fall as they may, or to use them to weave a better future.

Drupalcamp Finland – Measuring Front-end Energy ConsumptionExove

"Rebranding for Growth", Anna VelykoivanenkoFwdays

Automation Hour 1/28/2022: Capture User Feedback from AnywhereLynda Kane

Learn the Basics of Agile Development: Your Step-by-Step GuideMarcel David

Role of Data Annotation Services in AI-Powered ManufacturingAndrew Leo

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

Procurement Insights Cost To Value Guide.pptxJon Hansen

Image processinglab image processing image processingRaghadHany

Cyber Awareness overview for 2025 month of securityriccardosl1

#AdminHour presents: Hour of Code2018 slide deck from 12/6/2018Lynda Kane

Asthma presentación en inglés abril 2025 pdfVanessaRaudez

Datastucture-Unit 4-Linked List Presentation.pptxkaleeswaric3

tecnologias de las primeras civilizaciones.pdffjgm517

DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock

Network Security. Different aspects of Network Security.gregtap1

The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john

Special Meetup Edition - TDX Bengaluru Meetup #52.pptxshyamraj55

SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfPrecisely

Linux Professional Institute LPIC-1 Exam.pdfRHCSA Guru

AI Changes Everything – Talk at Cardiff Metropolitan University, 29th April 2...Alan Dix

Drupalcamp Finland – Measuring Front-end Energy ConsumptionExove

Splunk Enterprise Security

1. Presentation Topics : Splunk Enterprise Security(ES). Presenter : Md Mofijul Haque Business Development Executive [email protected]

2. OUTCOME….  INTRODUCE WITH SPLUNK ENTERPRISE SECURITY(ES) SPLUNK SECURITY PORTFOLIO SPLUNK WORKFLOW & FRAMEWORK FRAMEWORKS ENABLE USE CASES WHY DESH CYBER IS RELIABLE Q&A

3. SPLUNK TURNS MACHINE DATA INTO ANSWERS

4. MOSTLY FACED SECURITY OPERATIONS NOW A DAYS

5. SPLUNK WORK AS FULLY OPTIMIZED FOR MODERN SECURITY OPERATIONS

6. SPLUNK SECURITY PORTFOLIO

7. HOW SPLUNK ETERPRISE SECURITY WORKS

8. SPLUNK ENTERPRISE SECURITY FRAMEWORK

9. WORKFLOW FOR STREAMLINED INCIDENT MANAGEMENT NOTABLE EVENTS FRAMEWORK Streamline Incident Management Consolidated incident management allows effective lifecycle management of security incidents. Make Rapid Decisions Automatically aligns all security context together for fast incident qualification and provides predefined analysis paths Refine Security Management Investigation management and customizations to support complex process integration requirements.

10. NOTABLE EVENTS AND INCIDENT REVIEW Use for Security Operations “Application” logics are pre-built on top of Splunk Enterprise as data platform. Provide graphically oriented user experience supporting the security operations workflow Intuitive User Interface Optimized for Security Operations Security operational tasks designed into user interface versus search bar interface. Key relevant information automatically presented as summary of incident.

11. INCIDENT REVIEW INTERFACE

12. SEARCH AND NAVIGATION INTERFACE

13. CONSOLIDATED INCIDENT MANAGEMENT INTERFACE

14. WORKFLOW PROCESS 1: EVENT OVERVIEW

15. WORKFLOW PROCESS 2: INCIDENT CONTEXT

16. WORKFLOW PROCESS 3: ANALYSIS ACTIONS

17. WORKFLOW PROCESS 4: REMEDIATION ACTIONS

18. NOTABLE EVENT FRAMEWORK

19. ASSET AND IDENTITY FRAMEWORK Automatically maps asset and identity context to incidents Fast Incident Qualification By automating context enrichment, SecOps can qualify more incidents quickly Extended Situation Based Insights Rich enrichment allows more accurate assessment of situational aspect of incidents

20. SECURITY ENRICHED CONTEXT..

21. ASSET AND IDENTITY FRAMEWORK : ASSET DATABASE

22. ASSET AND IDENTITY FRAMEWORK : IDENTITY DATABASE

23. ASSET AND IDENTITY FRAMEWORK : ENRICHMENT

24. REPRESENTATIVE LIST OF ASSETS AND IDENTITIES

25. ASSET AND IDENTITY FRAMEWORK

26. RISK FRAMEWORK Quantitative metrics are applied to distinguish importance

27. RISK ANALYSIS DASHBOARD

28. RISK ANALYSIS WITH INCIDENT REVIEW

29. RISK FRAMEWORK

30. THREAT INTELLIGENCE FRAMEWORK Finding hidden IOCs using comprehensive threat intelligence mappings

31. THREAT INTEL SUPPORT

32. CONFIGURE THREAT INTELLIGENCE

33. THREAT INTELLIGENCE IN INCIDENT REVIEW

34. THREAT ACTIVITY

35. THREAT INTELLIGENCE FRAMEWORK

36. USE CASE LIBRARY

37. SPLUNK AS THE SECURITY NERVE CENTER

38. ADAPTIVE RESPONSE FRAMEWORK

39. ADAPTIVE RESPONSE FRAMEWORK

40. FRAMEWORKS ENABLE USE CASES

44. REWIND…

45. WHY DESH CYBER ? • HIGHLY EXPERIENCED TECHNICAL TEAM . • BEST COMPETITIVE PRICE WITH BEST SERVICE. • FIRST BANGLADESHI COMPANY TO ASSOCIATE PARTNER WITH SPLUNK . • WE WILL PROVIDE TRAINING TO YOUR ORGANIZATIONS . • DESH CYBER WILL PROVIDE 24/7 MONITORING TO YOUR ORGANIZATIONS .

46. WE ALSO PROVIDE …. PHISHING AWARNESS TRAING (KNOWBE4) EMAIL THREAT SOLUTIONS (VAILMAIL) CISCO UMBRELLA & MANY OTHER SECURITY TOOLS AND SERVICES

47. STAY WITH US .THANKS YOU

48. Q & A ? Reference Credit Goes To Him

Editor's Notes

#4: Make Machine Data Accessible, Usable and Valuable to Everyone. Regardless of your organization's size and industry
#5: Data ingestion is a process by which data is moved from one or more sources to a destination where it can be stored and further analyzed
#6: A petabyte is a measure of memory or data storage capacity that is equal to 2 to the 50th power of bytes. UEBA is able to model the behavior of both humans and also the machines within network. Security Orchestration, Automation and Response (SOAR)
#7: Within a volume of time and space, the perception of an enterprise's security posture and its threat environment; the comprehension/meaning of both taken together (risk); and the projection of their status into the near future.
#10: An incident management process is a set of procedures and actions taken to respond to and resolve critical incidents: how incidents are detected and communicated, who is responsible, what tools are used, and what steps are taken to resolve the incident.
#16: prioritize where action should be taken first. ... This strategy ensures the most effective actions are taken to keep the business running
#32: Threat intelligence is knowledge that allows security teams to prevent or mitigate cyberattacks. pieces of forensic data, such as data found in system log entries or files, that identify potentially malicious activity on a system or network.”
#39: Ad Hoc generally signifies a solution designed for a specific problem or task, non-generalizable, and not intended to be adapted to other purposes
#40: A correlation search is a type of scheduled search. It lets you detect suspicious events and patterns in your data
#42: Mandate is an authoritative command especially
#43: SaaS applications are sometimes called Web-based software, on-demand software, or hosted software. Whatever the name, SaaS applications run on a SaaS provider's servers.

Splunk Enterprise Security

Recommended

More Related Content

What's hot (20)

Similar to Splunk Enterprise Security (20)

Recently uploaded (20)

Splunk Enterprise Security

Editor's Notes