Splunk Discovery Köln - 17-01-2020 - Accelerate Incident Response
Download as PPTX, PDF0 likes233 views
The document discusses Splunk Incident Response, orchestration and automation capabilities. It notes that incident response currently takes significant time, from months for detection to days for containment and remediation. Splunk aims to accelerate this process through automation, orchestration and its security operations platform to integrate tools, streamline workflows and automate repetitive tasks. The presentation demonstrates Splunk's Phantom security orchestration product and how it can automate security tasks like malware investigations to reduce response times.
Splunk Discovery Köln - 17-01-2020 - Accelerate Incident Response
- 1. © 2019 SPLUNK INC. Splunk Incident Response, Orchestrierung und Automation Splunk Discovery Köln 17. Januar 2020
- 2. During the course of this presentation, we may make forward‐looking statements regarding future events or plans of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results may differ materially. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, it may not contain current or accurate information. We do not assume any obligation to update any forward‐looking statements made herein. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release. Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2019 Splunk Inc. All rights reserved. Forward- Looking Statements © 2019 SPLUNK INC.
- 3. © 2019 SPLUNK INC. Beate Passul Senior Sales Engineer
- 4. © 2019 SPLUNK INC. Security Operations Practices Need to Change • Too Many Alerts • Not Enough Insights • Too Many • No Integration • Attracting • Training • Retaining Incident Response Tools Skills • Orchestration & Automation • Horizontal & Vertical Scale
- 5. © 2019 SPLUNK INC. Incident Response Challenge
- 6. © 2019 SPLUNK INC. Incident Response Takes Significant Time Source: SANS 2017 Incident Response Survey 1-3 months 2–7 days Time from Compromise To Detection Time from Detection To Containment Time from Containment To Remediation
- 7. © 2019 SPLUNK INC. Where Does Your Time Go? When working an incident, which phase generally takes the longest to complete in your organization? Day in the life of a security professional survey © 2016 EMA, Inc.
- 8. © 2019 SPLUNK INC. Time-to-Contain + Time-to-Remediate = 86% When working an incident, which phase generally takes the longest to complete in your organization? Day in the life of a security professional survey © 2016 EMA, Inc.
- 9. © 2019 SPLUNK INC. Tools
- 10. © 2019 SPLUNK INC. Poll #1 How many security tools and technologies does your company use? • < 10 • 10–25 • 26–50 • 51–75+
- 11. © 2019 SPLUNK INC. Tools and Technologies Galore TOO MANY TOOLS On average, organizations are using between 25 and 30 different security technologies and services. Source: CyberSecurity Analytics and Analytics in Transition, ESG, 2017
- 12. © 2019 SPLUNK INC. Skills and Scale Orchestration and Automation
- 13. © 2019 SPLUNK INC. Orchestration vs. Automation Orchestration • Security Orchestration is the machine-based coordination of security actions across tools and technologies. • Brings together or integrates different technologies and tools • Provides the ability to coordinate informed decision making, formalize and automate responsive actions Automation • Security Automation is the machine-based execution of security actions. • Focus is on how to make machines do task-oriented "human work” • Improve repetitive work, with high confidence in the outcome • Allows multiple tasks or "playbooks" to potentially execute numerous tasks
- 14. © 2019 SPLUNK INC. Poll #2 Do you use Security Orchestration Automation and Response (SOAR)?
- 15. © 2019 SPLUNK INC. SOAR Maestro App actions App actions App actions App actions App actions App actions App actions App actions App actions App actions Playbook
- 16. © 2019 SPLUNK INC. Automation & Orchestration Adoption Growing Source: CyberSecurity Analytics and Analytics in Transition, ESG, 2017
- 17. © 2019 SPLUNK INC. Security Nerve Center Overview
- 18. © 2019 SPLUNK INC. Security Nerve Center Orient Observe Decide Act Network Identity & Access Threat Intelligence Mobile EndpointsCloud Security WAF & App Security Web Proxy Firewall Analytics Orchestration
- 19. © 2019 SPLUNK INC. Splunk Security Portfolio DATA PLATFORM ANALYTICS OPERATIONS Platform for Machine Data
- 20. © 2019 SPLUNK INC. Adaptive Operations Framework Mission • Deeply integrate with the best security technologies to improve cyber defenses and maximize operational efficiency. Approach • Gather, analyze, share, and take action using end-to-end context across across multiple security domains. Partner ecosystem enables the Security Nerve Center Network Identity & Access Threat Intelligence EndpointsCloud Security WAF & App Security Web Proxy Firewall Operations Data / Analytics Splunk Phantom Apps & Playbooks Splunk Enterprise Security Adaptive Response Actions Splunkbase Apps & Add-Ons 240+ Integrations / 1,200+ APIs
- 21. © 2019 SPLUNK INC. Phantom Security Operations
- 22. © 2019 SPLUNK INC. Operationalizing Security Integrate your team, processes, and tools together. • Work smarter by automating repetitive tasks allowing analysts to focus on more mission-critical tasks. • Respond faster and reduce dwell times with automated detection, investigation, and response. • Strengthen defenses by integrating existing security infrastructure together so that each part is an active participant. With Phantom Automation Event Management
- 23. © 2019 SPLUNK INC. Automation • Automate repetitive tasks to force multiply team efforts. • Execute automated actions in seconds versus hours. • Pre-fetch intelligence to support decision making. Automation Event Management
- 24. © 2019 SPLUNK INC. Orchestration • Coordinate complex workflows across your SOC. • 200+ Apps & growing • 1000+ API’s Automation Event Management
- 25. © 2019 SPLUNK INC. Case Management • Create case templates that replicate your SOPs. • Manage your response to threats with precision. • Embed automation within a case task. Automation Event Management
- 26. © 2019 SPLUNK INC. How it Works Automated Malware Investigation • “Automation with Phantom enables us to process malware email alerts in about 40 seconds vs. 30 minutes or more.” — Adam Fletcher, CISO A Phantom Case Study SANDBOX QUERY RECIPIENTS USER PROFILE HUNT FILE HUNT FILE FILE REPUTATION FILE ASSESSMENT RUN PLAYBOOK “REMEDIATE" EMAIL ALERT
- 27. © 2019 SPLUNK INC. Demo
- 28. © 2019 SPLUNK INC.
- 29. © 2019 SPLUNK INC.
- 30. © 2019 SPLUNK INC.
- 31. © 2019 SPLUNK INC.
- 32. © 2019 SPLUNK INC.
- 33. © 2019 SPLUNK INC.
- 34. © 2019 SPLUNK INC.
- 35. © 2 0 1 9 S P L U N K I N C . Splunk Phantom on your mobile device • Phantom on Splunk Mobile brings the power of Phantom security orchestration, automation, and response (SOAR) capabilities to your mobile device. • No need to open your laptop. Orchestrate security operations from the palm of your hand. • Respond faster than ever before, because you’re reachable from anywhere. • Run playbooks, triage events, and collaborate with colleagues – all on-the-go.
- 36. © 2019 SPLUNK INC. Key Takeaways Splunk offers options to accelerate incident response with orchestration and automation 1) Use Phantom with Splunk or Splunk Enterprise Security to accelerate Incident Investigation and Response 2) Use Adaptive Operations Framework to realize your security nerve center 3) Splunk offers market proven, comprehensive solutions for Incident Response 4) Use with all Security domains and related IT domains to solve incident response use cases and more
- 37. © 2019 SPLUNK INC. Join our community get access to playbooks and app integrations https://my.phantom.us
- 38. © 2019 SPLUNK INC. Agenda Splunk Discovery Köln 17. Januar 2020 09:00–10:30 Keynote und Demo – Die Data-to-Everything Plattform 10:30–11:00 Pause Tech Track (Jupiter I+II) Business Track (Saturn I+II) 11:00–11:45 Mit der Splunk Plattform Daten in Mehrwert umwandeln ROI in Datenprojekten (in English) 11:45–12:30 Abenteuer bei Monitoring und Troubleshooting Kunden Use Cases 12:30–13:30 Mittagessen 13:30–14:15 Security Analytics Methoden Die Zukunft von Security Operations 14:15–15:00 Splunk Incident Response, Orchestrierung und Automation Die Zukunft von ITOA – von Monitoring zu Observability 15:00–15:30 Pause 15:30–16:15 Kunden Use Case: TÜV Trust IT 16:15–17:00 Networking Drinks
- 39. Thank You © 2019 SPLUNK INC.