Threat Intelligence and SIEM - a guide for resellers

1. THREAT INTELLIGENCE + SIEM:
A FORCE TO BE RECKONED WITH
SOLARWINDS® SECURITY
Mav Turner
Director, Product Strategy
Jerry Schwartz
Director, Product Marketing

2. • Everyone is on mute; use your GoToWebinar console to chat or submit questions
using the Questions section.
• We will do a live Q & A at the end of the webinar.
• Feel free to ask questions throughout the webinar via chat; we
will answer as many questions as possible at the end of the webinar.
• All attendees will be sent their Threat Hunters t-shirts soon!
2
HOUSEKEEPING
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

3. Agenda
» Introduction
» Who is SolarWinds?
» Channel Engagement
» Target Customer & Positioning
» Cross-sell and Upsell Opportunities
» Threat Intelligence
» Submit an Opportunity & Partner Support
» Q&A
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.r e s e l l e r @ s o l a r w i n d s . c o m
Jennifer Baker
Business Development
Manager, Channel
Jerry Schwartz
Director, Product
Marketing
Mav Turner
Director, Product
Strategy

4. If You Take Away One Thing …
E N G A G E U S E A R LY A N D M A X I M I Z E Y O U R R E V E N U E
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
reseller@solarwinds.com
U se Sk ype wo rk di rec tl y wi th yo ur SW I rep!

5. Company background
History 1999 Founded in Tulsa, OK
2005 Professional Investment
2006 Hired Management Team
2009 IPO (NYSE:SWI)
Headquarters Austin, Texas; 1300 employees
worldwide
Customers 425 of US Fortune 500!
Over 200,000 – from SMB to
Fortune 500
Who Is SolarWinds?
M O N I T O R I N G F O R A N Y I T R E S O U R C E , A N Y W H E R E I N T H E I N F R A S T R U C T U R E
Provide IT management
software that is powerful,
easy-to-use and affordable.
Company Background
Timeline 1999 Founded in Tulsa, OK
2005 Professional Investment
2006 Hired Management Team
2009 IPO (NYSE:SWI)
Headquarters Austin, Texas; 1800 Employees
Worldwide
Customers Over 150K – SMB to Fortune
100
425 of US Fortune 500!
r e s e l l e r @ s o l a r w i n d s . c o m © 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

6. Channel Engagement & Support
r e s e l l e r @ s o l a r w i n d s . c o m © 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
» Value to Existing Accounts and Prospects
 Single source for all monitoring and management needs
 Any size, vertical, or environment
» Product – Simple to Use, Vendor Agnostic, Amazing Out-of-the-Box Functionality
 Additional hardware sales
 Add on to existing opportunities
» Large Customer Base
 Easy penetration and cross-selling
 Brand recognition
P R E M I E R V E N D O R F O R I T M O N I T O R I N G A N D M A N A G E M E N T
SolarWinds Sales Organization
Sales Pillar Regional Install Base Channel
Lead Source Website/Marketing Internal Upsell Partner Driven
Channel Margin 5% 5% 20%+

7. What We Offer Today
r e s e l l e r @ s o l a r w i n d s . c o m © 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
» Network Management
 Fault, availability, and performance monitoring for
networks of all sizes.
 Comprehensive bandwidth analysis.
» System Management
 Total application visibility across application and
infrastructure layers.
» Database Management
 Deep visibility into database performance and expert
advice for optimization and tuning.
 Focus on response time, make changes end users will
notice.
» IT Security
 Real-time security intelligence and compliance
automation.
 Centralized configuration, change, and patch
management.
B U I L D I N G T O W A R D O U R V I S I O N

8. Cross-sell and Upsell Opportunities
r e s e l l e r @ s o l a r w i n d s . c o m © 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
When You Hear …
» Network Management/Monitoring
» Server/Application Monitoring
» Security & Compliance
Qualifying Questions to Ask …
» What are you using to monitor:
 Network – switches, routers, firewalls
 Servers & applications
 Database performance (SQL Server®, Oracle®, DB2®, Sybase®)
 Virtual environment
 Backend storage
» Is your current vendor solution giving you everything you need?
» Are you using multiple vendor products to monitor your IT environment?
» Is your IT team reactive v. identifying problems before they occur?
Y O U W I L L N O T H A V E T O L O O K V E R Y F A R …
» Database Performance
» Virtual Infrastructure
» Storage Resource Monitoring

9. 1. Define and discuss why threat intelligence is important
2. Learn about the most common threats today
3. Review best practices for securing an environment from these threats
4. Demo of how threat intelligence can strengthen a SIEM
10
TODAY’S AGENDA
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

10. 1. Define and discuss why threat intelligence is important
2. Learn about the most common threats today
3. Review best practices for securing an environment from these threats
4. Demo of how threat intelligence can strengthen a SIEM
11
TODAY’S AGENDA
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

11. • Threat intelligence has many definitions and flavors
• Threat intelligence is knowledge that helps you identify security threats and make
informed decisions.
• Common Threat Intelligence Feeds / Indicators of Compromise (IOCs)
• Network, email, and host-based indicators
• You can’t buy it on Amazon.com (yet), but there are many sources of threat
intelligence:
• Commercial, open source, industry, and internal
12© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
EVERYONE IS TALKING ABOUT THREAT
INTELLIGENCE

12. The Stats…
• In 2015, 38% more security incidents
were detected than in 2014.1
• Theft of “hard” intellectual property
increased 56% in 2015. 1
• Sixty-nine percent learned of a breach
from an outside entity. 2
• Attackers had a median of 205 days in
breached environments before being
detected in 2014.2
In The News…
• AdultFriendFinder®
• Anthem®
• AOL®
• AshleyMadison.com ®
• eBay®
• Experian®/T-Mobile®
• JPMorgan Chase®
• Staples®
• TalkTalk®
• Target®
• Twitch TV®
• Uber®
• VTech®
• US Office of Personnel Management
13© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
THREAT INTELLIGENCE IS VITAL TO YOUR
CUSTOMERS …HERE’S WHY:
Source1: PWC & The Global State of Information Security 2016.
Source2: Mandiant, M-Trends 2015: A View From The Front Lines
Source: http://bit.ly/bigdatabreaches

13. 1. Define and discuss why threat intelligence is important
2. Learn about the most common threats today
3. Review best practices for securing an environment from these threats
4. Demo of how threat intelligence can strengthen a SIEM
14
TODAY’S AGENDA
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

14. Findings
• 2015 DBIR identified
just nine incident
classification patterns
• Patterns vary by
industry
• On average, three
patterns cover over
70% of the incidents
in any industry
15© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS
RESERVED.
DETERMINE WHICH THREATS YOUR CUSTOMERS ARE
LIKELY TO SEE
Source: Verizon Data Breach Investigations Report – 2015 (link)
© Verizon 2015

15. • Network Indicators
• IP addresses
• URLs
• Domain names
• Email indicators
• Sender’s email address and email subject
• Attachments and links
• X-Forwarding and X-originating IP address
• Host-Based Indicators
• Filenames and file hashes (e.g. MD5)
• Registry keys
• Dynamic link libraries (DLLs)
• Mutex names
16© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
START WITH COMMON INDICATORS OF
COMPROMISE (IOCS)
Source: Verisign

16. 1. Define and discuss why threat intelligence is important
2. Learn about the most common threats today
3. Review best practices for securing an environment from these threats
4. Demo of how threat intelligence can strengthen a SIEM
17
TODAY’S AGENDA
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

17. 1. Integrate threat intelligence into your
security operations
2. Determine threats that you are most likely
to face
3. Focus on those threats when selecting a
threat intelligence feed
4. Ingest threat intelligence feeds into a SIEM
5. Utilize threat intelligence to help respond to
an incident
6. Share new threat intelligence
18© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
THREAT INTELLIGENCE BEST PRACTICES TO
SHARE WITH YOUR CUSTOMERS

18. • Centralize your logs
• Flag events as a threat
• Monitor privileged users and files
• Detect fraud and malware
• Gain insight to trends
• Faster overall incident response
• More robust compliance reporting
19
HOW A SIEM SOLUTION CAN HELP
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Adding threat intelligence feeds improves detection and incident response

19. 1. Define and discuss why threat intelligence is important
2. Learn about the most common threats today
3. Review best practices for securing an environment from these threats
4. Demo of how threat intelligence can strengthen a SIEM
20
TODAY’S AGENDA
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

20. 21© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
LOG & EVENT MANAGER (LEM) DEMO
• LEM is an affordable, easy-to-use
SIEM solution that helps you detect
and respond to security threats and
demonstrate compliance.
• LEM’s threat intelligence feed will
allow you to be prepared to
recognize and handle already
known and proven threats.
• Automatically evaluate your traffic
against a comprehensive, open
source database of malicious IP
addresses.

21. 1. Defined and discussed why threat intelligence is important
2. Learned about the most common threats today
3. Reviewed best practices for securing an environment from these threats
4. Presented a demo of how threat intelligence can strengthen a SIEM
22
SUMMARY OF TODAY’S WEBINAR
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

22. Use SolarWinds Log & Event Manager to help defend, respond, and investigate web
application security threats.
• http://www.solarwinds.com/lem
• Free online demo
• Free, fully-functional 30-day trial
• Contact us to:
• Speak with someone about pricing & licensing
• Schedule live demonstrations
Email: reseller@solarwinds.com
23© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
LEARN MORE

23. 24© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
QUESTIONS?

24. • Follow-up email will contain a link to the recording of this webcast
• Slides from today’s presentation will also be posted to SlideShare
25
THANK YOU!
© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

25. The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of
SolarWinds Worldwide, LLC and its affiliates, are registered with the U.S. Patent and
Trademark Office, and may be registered or pending registration in other countries. All
other SolarWinds trademarks, service marks, and logos may be common law marks,
registered or pending registration in the United States or in other countries. All other
trademarks mentioned herein are used for identification purposes only and may be or are
trademarks or registered trademarks of their respective companies.
26© 2015 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.