Upload File

moving*from*datato*wisdom* - splunk

16
Copyright © 2016 Splunk Inc. Mark Runals Lead Security Engineer, The Ohio State University Moving From Data To Wisdom

Upload: others

Post on 02-Nov-2021

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Moving*From*DataTo*Wisdom* - Splunk

Copyright  ©  2016  Splunk  Inc.  

Mark  Runals  Lead  Security  Engineer,  The  Ohio  State  University  

Moving  From  Data  To  Wisdom  

Page 2: Moving*From*DataTo*Wisdom* - Splunk

Disclaimer  

2  

During  the  course  of  this  presentaJon,  we  may  make  forward  looking  statements  regarding  future  events  or  the  expected  performance  of  the  company.  We  cauJon  you  that  such  statements  reflect  our  current  expectaJons  and  esJmates  based  on  factors  currently  known  to  us  and  that  actual  events  or  results  could  differ  materially.  For  important  factors  that  may  cause  actual  results  to  differ  from  those  contained  in  our  forward-­‐looking  statements,  please  review  our  filings  with  the  SEC.  The  forward-­‐looking  statements  made  in  the  this  presentaJon  are  being  made  as  of  the  Jme  and  date  of  its  live  presentaJon.  If  reviewed  aRer  its  live  presentaJon,  this  presentaJon  may  not  contain  current  or  

accurate  informaJon.  We  do  not  assume  any  obligaJon  to  update  any  forward  looking  statements  we  may  make.  In  addiJon,  any  informaJon  about  our  roadmap  outlines  our  general  product  direcJon  and  is  

subject  to  change  at  any  Jme  without  noJce.  It  is  for  informaJonal  purposes  only  and  shall  not,  be  incorporated  into  any  contract  or  other  commitment.  Splunk  undertakes  no  obligaJon  either  to  develop  the  features  or  funcJonality  described  or  to  include  any  such  feature  or  funcJonality  in  a  future  release.  

Page 3: Moving*From*DataTo*Wisdom* - Splunk

Mark  Runals  

  4  yr  Splunk  User  ArcSight  admin  for  3  yrs  

  Worked  in  InfoSec  for  10+  yrs    2015  SplunkTrust  Member  Ø GeZng  data  into  Splunk  isn’t  the  end  game!  

3  

Page 4: Moving*From*DataTo*Wisdom* - Splunk

Outcomes  

  Paradigm  to  rethink  data/analysis  

  Common  framework  for  Admins  &  ‘Management’  

  Deeper  appreciaJon  for  what  Splunk  is  

4  

Page 5: Moving*From*DataTo*Wisdom* - Splunk

DIKW  Pyramid  

5  

Data  

Wisdom  

Knowledge  

InformaJon  

Bits  &  Bytes  

What  the  data  is  

What  the  data  means  

ApplicaJon  /  Applied  knowledge  

Page 6: Moving*From*DataTo*Wisdom* - Splunk

Typical  Business  

6  

Data  

Wisdom  

Knowledge  

InformaJon  

Wisdom  

Knowledge  

Management  

System  Admins  Proxy  

Vuln  Scan  

…..  N++  

Conceptual  Views  Lines  of  Business  Service  Health  

System  Centric  Views  Component  Health  Discreet  SMEs  

Data  Analysis  Gap  

Page 7: Moving*From*DataTo*Wisdom* - Splunk

Typical  Business  

7  

Data  

Wisdom  

Knowledge  

InformaJon  

Wisdom  

Knowledge  

Proxy  

…..  N++  

MicrosoR  Excel  

Vuln  Scan  

Management  

System  Admins  

Conceptual  Views  Lines  of  Business  Service  Health  

System  Centric  Views  Component  Health  Discreet  SMEs  

Page 8: Moving*From*DataTo*Wisdom* - Splunk

What  Splunk  Brings  

8  

Data  

Wisdom  

Knowledge  

InformaJon  

Wisdom  

Knowledge  

Proxy  

…..  N++  

Vuln  Scan  

•  Enrich  data  with  business  context  •  Powerful  analyJc  plaiorm  •  Correlate  data  across  silos  •  Dynamic  query  

Business  insight  from  operaJonally  enriched  data  

Page 9: Moving*From*DataTo*Wisdom* - Splunk

Splunk  Maturity  Model  

9  

Reac%ve  

Search  and  

InvesJgate  

ProacJve  Monitoring  and  AlerJng  

OperaJonal  Visibility  

Proac%ve  Real-­‐Jme    Business    Insight  

Similari'es  to  DIKW….  

Page 10: Moving*From*DataTo*Wisdom* - Splunk

OSU  Mobile  App  -­‐  Data  

10  

Page 11: Moving*From*DataTo*Wisdom* - Splunk

OSU  Mobile  App  -­‐  InformaJon  

11  

Page 12: Moving*From*DataTo*Wisdom* - Splunk

OSU  Mobile  App  -­‐  Knowledge  

12  

Page 13: Moving*From*DataTo*Wisdom* - Splunk

OSU  Mobile  App  -­‐  Wisdom  

13  

Page 14: Moving*From*DataTo*Wisdom* - Splunk

Other  Thoughts  

14  

 •  Leverage  the  Splunk  Common  InformaJon  Model  (CIM)  

Common  ‘language’  across  data  types    

•  Use  Knowledge  Objects  to  bridge  systems  to  services  lookups,  tags,  evennypes    

•  Make  alerts  more  acJonable  –  not  just  What  happened  Incorporate  recipient’s  ‘next’  quesJon  (ie  where,  who)  

I  

D  

K  

W  

Page 15: Moving*From*DataTo*Wisdom* - Splunk

Final  Thoughts  

15  

 •  Understand  the  difference  between  Measurements  and  Metrics  

Metric  =  combinaJon  of  2  or  more  measurements    

•  Administer  Splunk  with  end  state  in  mind  •  What  are  your  use  cases?  •  What  pain  points  are  you  trying  to  address?  

•  Help  bridge  the  InformaJon  and  Knowledge  analyJc  gap  Ø  Key  step  in  leveraging  Splunk  toward  ‘Wisdom’  ends  

I  

D  

K  

W  

Page 16: Moving*From*DataTo*Wisdom* - Splunk

THANK  YOU  


Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk in Rakuten: Splunk as a Service for all

Splunk bsides

The$HOMERUN$Collabora2ve$– Leveraging$datato ...The$HOMERUN$Collabora2ve$– Leveraging$datato$supportcompara2ve$ effec2veness$research$and$catalyze$ healthsysteminnovaon Andrew$D$Auerbach$MD$MPH

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Splunk user group - automating Splunk with Ansible

Datato information5 21-final519pm

インストールマニュアル Splunk Enterprise 6.2docs.splunk.com/images/8/8b/Splunk-6.2.0-ja_JP-Installation.pdf · Splunk Enterprise インストールマニュアルによう

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Deploying Splunk. Arquitetura e dimensionamento do Splunk

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

Splunk Conf2010: Corporate Express presents Splunk with SAP

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*offering*to*mulJple*customers*

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-