onboard your data faster with add-on builder · desk storage email web desktops call records...
TRANSCRIPT
![Page 1: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/1.jpg)
Copyright©2016SplunkInc.
EliasHaddadSr.ProductManager,SplunkGordonWangSr.SoCwareEngineer,Splunk
OnboardyourdatafasterwithAdd-onBuilder
![Page 2: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/2.jpg)
Disclaimer
2
DuringthecourseofthispresentaMon,wemaymakeforwardlookingstatementsregardingfutureeventsortheexpectedperformanceofthecompany.WecauMonyouthatsuchstatementsreflectourcurrentexpectaMonsandesMmatesbasedonfactorscurrentlyknowntousandthatactualeventsorresultscoulddiffermaterially.Forimportantfactorsthatmaycauseactualresultstodifferfromthosecontainedinourforward-lookingstatements,pleasereviewourfilingswiththeSEC.Theforward-lookingstatementsmadeinthethispresentaMonarebeingmadeasoftheMmeanddateofitslivepresentaMon.IfreviewedaCeritslivepresentaMon,thispresentaMonmaynotcontaincurrentor
accurateinformaMon.WedonotassumeanyobligaMontoupdateanyforwardlookingstatementswemaymake.InaddiMon,anyinformaMonaboutourroadmapoutlinesourgeneralproductdirecMonandis
subjecttochangeatanyMmewithoutnoMce.ItisforinformaMonalpurposesonlyandshallnot,beincorporatedintoanycontractorothercommitment.SplunkundertakesnoobligaMoneithertodevelopthefeaturesorfuncMonalitydescribedortoincludeanysuchfeatureorfuncMonalityinafuturerelease.
![Page 3: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/3.jpg)
Agenda
WhyAdd-onBuilder WhatisAdd-onBuilder FeaturesHighlights What’snewinAdd-onBuilder2.0 Demo Q&A
3
![Page 4: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/4.jpg)
AllDataisRelevant
4
Servers
ServiceDesk
Storage
DesktopsEmail Web
CallRecords
NetworkFlows
DHCP/DNS
HypervisorCustomApps
IndustrialControl
Badges
Databases
Mobile IntrusionDetecMon
Firewall
DataLossPrevenMon
AnM-Malware
VulnerabilityScans
AuthenMcaMon
![Page 5: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/5.jpg)
WhyAdd-onBuilder
5
ExpandtheecosystemofPartners,Vendors,andCustomersbuildingAdd-ons Reducethe2mespentbyengineersbuildingone-offAdd-ons Improveconsistencyandadherencetobestprac2ces EnableDevelopmentPartnerswiththerighttoolstobesuccessful
Acceleratedevelopmentbeyondwhatwecandoalone
![Page 6: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/6.jpg)
Refresher:WhatisanAdd-on?
6
• DataCollecMon–ModularInput• AbstracMonlayer:
- FieldExtracMon- CIM,DomainAdd-onMapping- Indexed-MmeextracMon
• DataEnrichmentusinglookups• ModularAlerts• SavedSearches• Pre-BuiltPanels
![Page 7: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/7.jpg)
WhatisAdd-onBuilderSplunkAdd-onBuilderisanApponSplunkbase:– hdps://splunkbase.splunk.com/app/2962/
ThegoalsoftheSplunkAdd-onBuilderareto:– GuideyouthroughallofthenecessarystepsofcreaMnganadd-on– ReducedevelopmentandtesMngMme– FollowbestpracMcesandnamingconvenMons– MaintainCIMcompliance– Maintainqualityofadd-ons– Validateandtesttheadd-on,helpingyoutoidenMfyanylimitaMonssuchas
compaMbiliMesanddependencies– MaintainaconsistentlookandfeelwhilesMllmakingiteasyforyoutoadd
branding
![Page 8: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/8.jpg)
WhatdoesSplunkAdd-onBuilderdo?
8
ScoreHealthofAdd-on• ValidateforCIMcomplianceandnamingconvenMons(bestpracMces?)• DetectproblemswithfieldextracMon
ExtractandMapfields• Extractfieldsusingautomatedeventanalysis• MapfieldstoCIMwithclickofbudon
Automatecodegenera2on• IntuiMveandprocessdrivenUI• SupportsmulMpleinputtypes,includingshell,REST,andSplunkPythonSDK
CreateAdd-onusingstepbystepprocess
![Page 9: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/9.jpg)
Add-onBuilderFeatureHighlights
• Version2.0.0FeaturesHighlight
![Page 10: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/10.jpg)
UIbasedAdd-oncreaMon
10
UIBasedAdd-oncreaMon MaintainsaconsistentlookandfeelwhilesMllmakingiteasyforyoutoaddbranding
Uploadyouradd-onLogoandpickyourcolortheme
Showviademo
![Page 11: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/11.jpg)
ModularInput
11
ModularInputeaseofcreaMon IfyouhavesimpleRESTAPI:– Wecangeneratethemodinput
foryouwithoutwriMngasinglelineofcode.
– Canbetokenized
Ifyouhaveshellcommandorscript– Wewillgeneratethemodinput
foryou– Canbetokenized
RealMmecodevalidaMon
Showviademo
![Page 12: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/12.jpg)
Add-onSetup
12
Allowsyoutogenerateandbuildsetuppagewithouthavingtodealwithsetup.xml.
Createyousetupparametersorselectdefaultones.
SupportmulM-account InteracMve Outoftheboxproxysupport,passwordencrypMon,logging
Showviademo
![Page 13: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/13.jpg)
AdvancedModularInput
13
IfyouhavemoreadvanceddatacollecMonlogic
RealMmecodevalidaMon Includeslibrary:– CheckpoinMng– Readingencryptedpassword
fromstorage/passwordendpoint
– Proxy– Accessingparametervalues
fromsetuppage
Showviademo
![Page 14: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/14.jpg)
FieldExtracMon
14
SupportvariousformatincludingUnstructured,KV,tabularandJSON
Leveragesmachinelearningclusteringalgorithmtogroupeventsbasedonformatsimilarity
AutomaMcallygenerateregexforfieldextracMon
Showviademo
![Page 15: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/15.jpg)
CIMMapping
15
UIbasedCIMmapping MapyourAdd-onfieldstotheCommoninformaMonmodelinaclickofabudon
Showviademo
![Page 16: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/16.jpg)
HealthValidaMon
16
ValidateyouAdd-onfor:– BestpracMces– CIMcompliance
DetectanyfieldextracMonproblems
Detectanyproblemswithyoumodularinputs
CerMficaMonreadinessonroadmap
Showviademo
![Page 17: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/17.jpg)
WhatsnewinAdd-onBuilder2.0
• Version2.0.0FeaturesHighlight
![Page 18: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/18.jpg)
CerMficaMoncheck
18
Getpre-cerMfiedwithaclickofabudon
ReliesonbackendonlinecerMficaMonservicestoruncheck
Add-onBuilderpushestheAdd-onpackagetotheserviceandwaitsforresultstobereturned.
ResultsaredisplayedonvalidaMonstepinAdd-onBuilder.
Showviademo
![Page 19: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/19.jpg)
AlertAcMon
19
AlertAcMonallowsSplunkadminstotakeautomaMcacMonsfromSplunkalert
ExampleofexisMngCustomAlertacMonsonSplunkbase:ServiceNowIncidentcreaMon,HipchatnoMficaMons
Add-onBuilderallowsyoutobuildtestandvalidateCustomAlertAcMoninasimpleUIbasedworkflow.
Showviademo
![Page 20: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/20.jpg)
AlertAcMon–AdapMveResponse
20
SplunkEnterpriseSecuritydevelopedtheAdapMveResponseiniMaMvetoconnectSplunkwiththirdpartsecuritysystems
AdapMveResponseisbuiltontopofacMonalerttodefinetheinteracMonsbetweenEnterpriseSecurityUIandtheundelyingacMonalert.
SupportsadhocacMonsandalerts/automated
Showviademo
![Page 21: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/21.jpg)
QuesMons
• Version2.0.0FeaturesHighlight
![Page 22: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/22.jpg)
THANKYOU
![Page 23: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/23.jpg)
WherecanIdownloadthisapp?
23
hAps://splunkbase.splunk.com/app/2962/#/overview
![Page 24: Onboard your data faster with Add-on Builder · Desk Storage Email Web Desktops Call Records Network Flows DHCP/ DNS Hypervisor Custom Apps ... Relies on backend online cerMficaon](https://reader033.vdocuments.site/reader033/viewer/2022050403/5f80db002de7be474739fc5a/html5/thumbnails/24.jpg)
DatamodelscoveredbyCIM• Alerts• ApplicaMonState• AuthenMcaMon• ChangeAnalysis• Databases• Email• InterprocessMessaging• IntrusionDetecMon/PrevenMon
• Inventory24
• JavaVirtualMachines• Malware• NetworkSessions• NetworkTraffic• Performance• SplunkAuditLogs• VulnerabiliMes• Web