© 2017 SPLUNK INC.© 2017 SPLUNK INC.

crawl|walk|run

Splunk for Security

Dimitri McKay | Staff Security Architect | Splunk

© 2017 SPLUNK INC.

During the course of this presentation, we may make forward-looking statements regarding future events or

the expected performance of the company. We caution you that such statements reflect our current

expectations and estimates based on factors currently known to us and that actual events or results could

differ materially. For important factors that may cause actual results to differ from those contained in our

forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live

presentation. If reviewed after its live presentation, this presentation may not contain current or accurate

information. We do not assume any obligation to update any forward-looking statements we may make. In

addition, any information about our roadmap outlines our general product direction and is subject to change

at any time without notice. It is for informational purposes only and shall not be incorporated into any contract

or other commitment. Splunk undertakes no obligation either to develop the features or functionality

described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United

States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

© 2017 SPLUNK INC.

AgendaSplunk Level Set

Intro Maturity Crawl Walk Run Summary

© 2017 SPLUNK INC.

IntroMaturity

Technology

PeopleProcess

3 equal parts make a mature security program

© 2017 SPLUNK INC.

Maturity of a Security Program

Search and

Investigate

Proactive

Monitoring

and Alerting

Security

Situational

Awareness

Real-time

Risk Insight

Proactive

Reactive

- Reactive security

- Limited visibility

- Limited data-sources

- Data spread across

multiple silos

- Specific data-sources

captured

- Realtime monitoring for

specific basic use cases

- Simple correlation alerts

in use

- Monitoring in real-time.

- High fidelity correlation in use.

- Basic automation for

enrichment.

- Threat data plays a heavy role

in security processes.

- Risk framework used to

prioritize activity.

- Automation is used to reduce

noise and threat.

- Breaches identified in real-time

and thwarted before exfil.

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

CrawlHow do I get started?

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

200+ APPS

The Splunk Platform for Security Intelligence

Splunk Enterprise (CORE)

Stream data

Cisco

Security Suite

Windows/ AD/

Exchange

Palo Alto

Networks

FireEye

Bit9

DShield

DNS

OSSEC

Splunk-built AppsSplunk for Security

© 2017 SPLUNK INC.

Step one?

Download Splunk. :)

© 2017 SPLUNK INC.

But, consider starting with these top 5 data sources…

© 2017 SPLUNK INC.

#1 Windows

Splunk Add-on for

Microsoft Windows

© 2017 SPLUNK INC.

► Authentication:

- Success/ Failures

- New account logons

- Unused accounts

- Anomalous logins

► Endpoint changes:

- New applications/ processes

- New ports

- New services

Windows Use Cases

#1 Windows

Splunk Add-on for

Microsoft Windows

© 2017 SPLUNK INC.

#2 Linux

Splunk Add-on for

Unix and Linux

Add-on for Auditd

© 2017 SPLUNK INC.

#2 Linux

Splunk Add-on for

Unix and Linux

Add-on for Auditd

► Authentication:

- Success/ Failures

- New account logons

- Unused accounts

- Anomalous logins

► Endpoint changes:

- New applications/ processes

- New ports

- New services

Linux Use Cases

© 2017 SPLUNK INC.

#3 Firewalls

Splunk Add-on for

Juniper, Cisco,

Palo Alto, etc.

© 2017 SPLUNK INC.

#3 Firewalls

Splunk Add-on for

Juniper, Cisco,

Palo Alto, etc.

► Top categories

► Top apps consuming bandwidth

► Top protocol use

► Top bandwidth consumers

► Top threats by user/host/src

► Top blocked executables

► Top vulnerabilities / vulnerable machines

► Top targets

► Top actions

► Top malware

Firewall Use Cases

© 2017 SPLUNK INC.

#4 AWS + Cloud

ServicesAdoption of Cloud in

the Security space

© 2017 SPLUNK INC.

#4 AWS + Cloud

ServicesAdoption of Cloud in

the Security space

► Network ACLs

► Security groups

► IAM activity

► S3 data events

► VPC activity/traffic/security analysis

► Cloudfront/ELB/S3 Traffic Analysis

► Top user activity

► Top resource activity

AWS/Cloud Use Cases

© 2017 SPLUNK INC.

#5Anti-virus

Symantec and McAfee

antivirus suites

© 2017 SPLUNK INC.

#5Anti-virus

Symantec and McAfee

antivirus suites

► Top risks detected

► Top processes blocked

► Top viruses / spyware detected

► Malware client version reports

► Malware virus definitions version reports

► Host changes / modifications

Anti-virus Use Cases

© 2017 SPLUNK INC.

With these top 5 data sources you manage…

► Detection of Possible Brute Force Attacks

► Detection of Insider Threat

► Expected Host/Log Source Not Reporting

► Unusual Login Behavior

► Unexpected Events Per Second (EPS) from Log Sources

► Detection of Anomalous Ports, Services and Unpatched Devices

► More…

http://resources.infosecinstitute.com/top-6-seim-use-cases/#gref

© 2017 SPLUNK INC.

Use Cases + AppsDive into more advanced use cases

© 2017 SPLUNK INC.

Next, Dive Into More Advanced Use CasesSecurity Intelligence Use Cases

Security &

Compliance

Reporting

Real-time

Monitoring of

Known Threats

Root Cause

AnalysisAction

AlertingIncident

Investigations

& Forensics

© 2017 SPLUNK INC.

Splunk Security EssentialsAccess and Network Domain

Access Domain• Authentication Against a New Domain Controller

• First Time Logon to New Server

• Significant Increase in Interactively Logged On

Users

• Geographically Improbable Access (Superman)

• Increase in # of Hosts Logged into

• New AD Domain Detected

• New Interactive Logon from a Service Account

• New Local Admin Account

• New Logon Type for User

• Short Lived Admin Accounts

• Significant Increase in Interactive Logons

Network Domain• Detect Algorithmically Generated Domains

• Remote PowerShell Launches

• Source IPs Communicating with Far More Hosts

Than Normal

• Sources Sending Many DNS Requests

• Sources Sending a High Volume of DNS Traffic

© 2017 SPLUNK INC.

Splunk Security Essentials for Ransomware

The following are the Use Cases included in this app

1. Fake Windows Processes

2. Malicious Command Line Executions

3. Monitor AutoRun Reported Registry Keys

4. Monitoring Successful Backups

5. Monitor Successful Windows Update

6. Monitoring Unsuccessful Backups

7. Monitor Successful Windows Update

8. Ransomware extensions

9. Ransomware Note Files

10. Ransomware Vulnerabilities

11. SMB traffic Allowed

12. Spike in SMB traffic

13. Detect TOR Traffic

© 2017 SPLUNK INC.

CIS Critical Security Controls

The CIS Critical Security Controls app

for Splunk was designed to provide a

consolidated, easily-extensible

framework for baseline security “best-

practices” based on the Top 20 Critical

Security Controls published by the

Center for Internet Security.

Framework for Baseline Security

© 2017 SPLUNK INC.

CrawlHow do I get started?

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

Splunk Enterprise SecurityAnalytics SIEM

Monitoring | Reporting | Alerting

• 50,000 foot view of of the organization’s security

posture

• Out of the box dashboards, reports, correlated

alerts, and incident response workflows

• Significant Increase in Interactively Logged On

Users

• Detect unusual activities by leveraging statistical

analysis, dynamic thresholds, and anomaly

detection.

• Verify privileged access and detect unusual

activity by applying user- and asset-based context

to all Cloud, on-premises and hybrid machine

data to monitor user and asset activities.

Threat | Case Management

• Leverage threat feeds from a broad set of

sources, including free threat intelligence feeds,

third party subscriptions, law enforcement, FS-

ISAC , STIX/TAXII, the Department of Homeland

Security’s (DHS) Automated Indicator Sharing

(AIS), Facebook ThreatExchange, internal and

shared dataRemote PowerShell Launches

• Manage alerts/cases and investigations in one

place, with the ability to pivot between data

sources to decrease remediate and investigation

time, thereby reducing risk.

© 2017 SPLUNK INC.

CrawlHow do I get started?

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

https://github.com/swannman/ircapabilities

https://creativecommons.org/licenses/by/4.0/

© 2017 SPLUNK INC.

Splunk UBA + Enterprise SecurityUnsupervised Machine Learning

Business Risk | Machine Learning

• Detects insider threats using out-of-the-box

purpose-built but extensible unsupervised machine

learning (ML) algorithms

• Provides context around the threat via ML driven

anomaly correlation and visual mapping of stitched

anomalies over various phases of the attack

lifecycle (Kill Chain View)

• Increases SOC efficiency with rank-ordered threats

and supporting evidence

• Prioritize assets and identities based on criticality to

the business, which then prioritizes alerts and case

management as the most important events bubble

to the surface.

High Fidelity Alerting + Orchestration

• By integrating UBA with Enterprise Security, high

fidelity alerts are then fed into a central location for

remediation.

• Alerts are also then actionable, allowing Splunk to

orchestrate and automate a response via a single

common interface for retrieval, sharing, and

response in multi-vendor environments. Examples

of those responses might be segregating a host off

of a network, re-setting a users password, pushing

out antivirus definitions to machines with out of date

updates, or blocking IPs and URLs found in threat

lists.

© 2017 SPLUNK INC.

SummaryIn Conclusion

The Platform

PLATFORM

Analy

tics,

Aw

are

ness &

Action

The Platform

PLATFORM

SOLUTIONS

Analy

tics,

Aw

are

ness &

Action

Vendor Apps | Community Apps | Use Case Apps | Showcase Apps

The PlatformIncident

Investigations

and

Forensics

Security

and

Compliance

Real-Time

Monitoring

Root

Cause

Analysis

Automation

And

Orchestration

Reporting

And

Alerting

PLATFORM

USE CASES

SOLUTIONS

Analy

tics,

Aw

are

ness &

Action

Vendor Apps | Community Apps | Use Case Apps | Showcase Apps

© 2017 SPLUNK INC.

EndThank you!