Speaker0 session7874 1
0 likes15 views
AI tools and machine learning can help security teams address challenges around escalating alert volumes, resource shortages, and slow detection and response times. Splunk's AI-powered User Behavior Analytics (UBA) uses unsupervised machine learning to detect unknown threats and anomalous user behavior across devices and applications. It analyzes data from various sources and classifies anomalies and threats to help security teams solve advanced use cases and stay ahead of insider and external attacks. Splunk's security orchestration, automation and response (SOAR) tool, Phantom, further helps teams respond faster by automating incident response workflows and reducing manual tasks.
Speaker0 session7874 1
- 1. © 2018 SPLUNK INC. © 2018 SPLUNK INC. AI Tools Deliver Faster, Better Decisions for Defense and Offense Ray Cruciata, GMON – Security Specialist
- 2. © 2018 SPLUNK INC. Security Operations Problems Escalating volume of security alerts Resource shortage of 1 million security professionals Endless assembly line of point products Static independent controls with no orchestration Speed of detection, triage, & response time must improve Costs continue to increase Alerts Resources Products Static Speed Costs
- 3. © 2018 SPLUNK INC. Typical Security Team
- 4. © 2018 SPLUNK INC. © 2018 SPLUNK INC. Tier 1 Tier 2 Tier 3 Tier 1 Tier 2 Tier 3
- 5. © 2018 SPLUNK INC. How an AI tool can deliver • Automate detection and response to threats • Have machine learning capabilities to help detect anomalies • Orchestrate interaction with point security solutions (SOAR tool) • But also still have a way to keep human in the loop
- 6. © 2018 SPLUNK INC. AI
- 7. © 2018 SPLUNK INC. Detect and Investigate
- 8. © 2018 SPLUNK INC. Beyond the Known COMMAND CENTER ANALYZE INVESTIGATE REMEDIATE KNOWN BAD GOOD Driven by rules and correlation UNKNOWN ??? Driven by machine learning Alerts Insights
- 9. © 2018 SPLUNK INC. What is Splunk UBA? critical and actionable unknown threats Splunk UBA provides advanced and insider threat detection using unsupervised machine learning helping organizations find unknown threats and anomalous user behavior across devices and applications.
- 10. © 2018 SPLUNK INC. How Does Splunk UBA Work? 65+ ANOMALY CLASSIFICATIONS 25+ THREAT CLASSIFICATIONS Machine Learning Suspicious Data Movement Unusual Machine Access Flight Risk User Unusual Network Activity Machine Generated Beacon Lateral Movement Suspicious Behavior Compromised User Account Data Exfiltration Malware Activity Application logs Network logs Endpoint logs Server logs Identity logs Machine Learning DATA SOURCES 7 USE CASES
- 11. © 2018 SPLUNK INC. Stay Ahead of Advanced and Insider Threats Solve more advanced use cases powered by ML in Splunk UBA Compromised User Account Lateral Movement Account Misuse Compromised & Infected Machine (Malware) Suspicious Behavior & Unknown Threat Data Exfiltration Contextual Intelligence External Attack
- 12. © 2018 SPLUNK INC. Security Orchestration Automation and Response (SOAR)
- 13. © 2018 SPLUNK INC. D A T A P L A T F O R M A N A L Y T I C S O P E R A T I O N S Security Vision How does Phantom help Splunk’s Nerve Center security vision? • Advance cyber defense and reduce risk using an analytics-driven approach • Respond faster by accelerating incident response • Work smarter and reduce staffing and skills challenges
- 14. © 2018 SPLUNK INC. Decision Making Acting SIEM THREAT INTEL PLATFORM HADOOP GRC AUTOMATED MANUAL (TODAY) FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION TIER 1 TIER 2 TIER 3 Observe Point Products Orient Analytics SOAR for Security Operations Faster execution through the loop yields better security
- 15. © 2018 SPLUNK INC. Decision Making Acting SIEM THREAT INTEL PLATFORM HADOOP GRC AUTOMATED AUTOMATED WITH PHANTOM FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION FIREWALL IDS / IPS ENDPOINT WAF ADVANCED MALWARE FORENSICS MALWARE DETONATION TIER 1 TIER 2 TIER 3 Observe Point Products Orient Analytics SOAR for Security Operations Faster execution through the loop yields better security ACTION RESULTS / FEEDBACK LOOP
- 16. © 2018 SPLUNK INC. Q & A
- 17. © 2018 SPLUNK INC. © 2018 SPLUNK INC. Thank You