This document provides an overview and agenda for a Splunk security presentation. It introduces the speaker, Nick Crofts, and his background. It then provides legal notices about forward-looking statements and disclaimers. The agenda covers a Splunk security update, an overview of Enterprise Security 4.2, and an overview of User Behavior Analytics 2.3. It also briefly discusses data breaches in Australia and the cost of data breaches. Finally, it promotes the upcoming Splunk conference in September 2016.

1. Copyright © 2016 Splunk Inc.
Enterprise Security &
UBA Overview
SplunkLive Melbourne 2016
Nick Crofts, Sr SE
Security Splunk Guy

2. 2
2
> Nick Crofts ncrofts@splunk.com
• < 1 year at Splunk
• Senior SE (Security SME)
• 14+ years in IT and security
• CISSP – passed the test.
whoami

3. 3
LEGAL NOTICES
During the course of this presentation, we may make forward-looking statements regarding future
events or the expected performance of the company. We caution you that such statements reflect our
current expectations and estimates based on factors currently known to us and that actual events or
results could differ materially. For important factors that may cause actual results to differ from those
contained in our forward-looking statements, please review our filings with the SEC. The forward-
looking statements made in this presentation are being made as of the time and date of its live
presentation. If reviewed after its live presentation, this presentation may not contain current or
accurate information. We do not assume any obligation to update any forward-looking statements
we may make. In addition, any information about our roadmap outlines our general product direction
and is subject to change at any time without notice. It is for informational purposes only and shall
not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to
develop the features or functionality described or to include any such feature or functionality in a
future release.

4. 4
Agenda
Splunk Security Update
Enterprise Security 4.2
User Behavior Analytics 2.3

5. 5
Data Breaches in Australia

6. 6
2016 Cost of Data Breach Study
The cost of a data breach continues to rise: $158 per record
The largest component of the total cost of a data breach is lost business
“Time to Identify” and “Time to Contain” a data breach is critical
Average total cost of data breach in Australia is $2.64 million
Key factor to reduce the cost of a data breach is enabling incident response
Source: June 2016

7. Machine data contains a definitive record
of all interactions
Splunk is a very effective platform to collect,
store, and analyze all of that data
Human Machine
Machine Machine

8. 8
App
Servers
Network
Threat Intelligence
Firewall
Web Proxy
Internal Network
Security
Endpoints
Splunk as the Security Nerve Center
Identity

9. 9
Splunk Solutions
VMware
Platform for Machine Data
Exchange PCISecurity
Across Data Sources, Use Cases and Consumption Models
IT Svc Int
Splunk Premium Solutions Ecosystem of Apps
ITSI UBA
UBA
Mainframe
Data
Relational
Databases
MobileForwarders Syslog/TCP IoT
Devices
Network
Wire Data
Hadoop
& NoSQL

10. 10
Splunk for Security
DETECTION OF
CYBERATTACKS
INVESTIGATION
OF THREATS AND
INCIDENTS
OPTIMIZED
INCIDENT
RESPONSE AND
BREACH ANALYSIS
DETECTION OF
INSIDER THREATS
SECURITY &
COMPLIANCE
REPORTING
SPLUNK UBA SPLUNK ES

11. Threat Intelligence Identity and CloudEndpointNetwork
Splunk Security Ecosystem

12. What is Splunk ES?

13. Platform for Machine Data
Splunk Enterprise Security
Advancing analytics-driven security
Security and
Compliance Reporting
Monitor and
Detect
Investigate Threats
and Incidents
Analyze and
Optimize Response

14. What’s New
Splunk Enterprise Security v4

15. 15
Attack and Investigation Timelines
Adding content to timeline:
15
Action History
Actions :
• Search Run
• Dashboard Viewed
• Panel Filtered
• Notable Status Change
• Notable Event
Suppressed
Investigator Memo
Memo :
- Investigator’s memos
inserted in desired timeline
Incident Review
Incident :
- Notable events from
Incident Review
Analyst /
Investigator

16. 16
Prioritize and Speed Investigations
Centralized incident review combining risk and
quick search
Use the new risk scores and quick searches to
determine the impact of an incident quickly
Use risk scores to generate actionable alerts to
respond on matters that require immediate
attention.
ES 4.1

17. 17
Expanded Threat Intelligence ES 4.1
Supports Facebook ThreatExchange
An additional threat intelligence
feed that provides following threat
indicators -domain names, IPs and
hashes
Use with ad hoc searches and
investigations
Extends Splunk’s Threat Intelligence Framework

18. ES Demo

19. What is Splunk UBA?

20. 20
WHAT IS THE COMPROMISED / MISUSED
CREDENTIALS OR DEVICES
LACK OF RESOURCES
(SECURITY EXPERTISE)
LACK OF ALERT PRIORITIZATION &
EXCESSIVE FALSE POSITIVES
PROBLEM?

21. Splunk User Behavioral Analytics
Automated Detection of INSIDER THREATS AND CYBER ATTACKS
Platform for Machine Data
Behavior Baselining
& Modelling
Unsupervised
Machine Learning
Real-Time & Big
Data Architecture
Threat & Anomaly
Detection
Security Analytics

22. 22
MULTI-ENTITY BEHAVIORAL MODEL
USER CENTRIC DEVICE CENTRIC
APPLICATION CENTRIC PROTOCOL CENTRIC

23. 23
EVOLUTION
COMPLEXITY
RULES -THRESHOLD
POLICY -THRESHOLD
POLICY -STATISTICS
UNSUPERVISED
MACHINE LEARNING
POLICY -PEER
GROUP STATISTICS
SUPERVISED
MACHINE LEARNING
LARGEST LIBRARY
OF UNSUPERVISED ML ALGORITHMS

24. 24
DESIGNED FOR A
HUNTER
ANALYSTANOMALY DETECTION
APPLYING ML AGAINST
BEHAVIOUR BASELINES

25. 25
DESIGNED FOR A
SOC ANALYST
THREAT DETECTION
ML-DRIVEN AUTOMATED
OR RULES BASED
ANOMALY CORRELATION

26. Web Gateway
Proxy Server
Firewall
Box, Salesforce,
Dropbox, other SaaS
apps
Mobile Devices
Anti-Malware
Threat Intelligence
DATA SOURCES for UBA
26
Active Directory/
Windows
Single Sign-on
HR - Identity
VPN
DNS, DHCP
Identity/Auth SaaS/MobileSecurity
Controls
External Threat
Feeds
Activity
(N-S, E-W)
K E Y OPTIONAL
DLP
AWS CloudTrail
Endpoint
IDS, IPS, AV

27. Splunk UBA and Splunk ES Integration
SIEM, Hadoop
Firewall, AD, DLP
AWS, VM,
Cloud, Mobile
End-point,
App, DB logs
Netflow, PCAP
Threat Feeds
DATA SOURCES
DATA SCIENCE DRIVEN
THREAT DETECTION
99.99% EVENT REDUCTION
UBA
MACHINE LEARNING IN
SIEM WORKFLOW
ANOMALY-BASED CORRELATION
101111101010010001000001
111011111011101111101010
010001000001111011111011

28. What’s New in UBA 2.x

29. 29
Create custom threats using 60+
anomalies.
Create custom threat scenarios on top of anomalies
detected by machine learning.
Helps with real-time threat detection and leverage to
detect threats on historical data.
Analysts can create many combinations and
permutations of threat detection scenarios along with
automated threat detection.
Detection : Custom Threat Modeling Framework UBA 2.2

30. 30
Detection : Enhanced Security Analytics
Visibility and
baseline metrics
around user,
device, application
and protocol
30+
new metrics
USER CENTRIC DEVICE CENTRIC
APPLICATION CENTRIC PROTOCOL CENTRIC
Detailed Visibility, Understand Normal Behavior
UBA 2.2

31. 31
Behavioral Analytics in the SIEM Workflow
• All UBA anomalies now available in ES
• SOC Manager: UBA Reporting within ES
• SOC analyst: UBA anomaly data available for enhanced correlation
• Hunter/Investigator: Ad-hoc searching/pivoting
31
Detect and Investigate faster using ML integrated with SIEM

32. 32
USER CENTRIC
Top-N users by number of transactions
Top-N users by login/logout activity
Login/Logout activity over time
Average daily/weekly/monthly/yearly login/logout count
Number of failed logins (global)
Top-N users for failed logins
Failed logins over time
Average daily/weekly/monthly/yearly failed login counts
Top-N users by data transfer
Average daily/weekly/monthly/yearly data transfer for users
Top-N users by session count
Top-N users by session length
Average session duration of users
DEVICE CENTRIC
APPLICATION / SESSION CENTRICPROTOCOL CENTRIC
Top-N servers by activity (number of transactions )
Top-N servers by login/logout activity
Top-N servers for failed logins
Failed logins over time
Top-N destination devices by data transfer
Top-N servers by data transfer
Average daily/weekly/monthly/yearly data
transfer for servers
Top-N source devices by session count
Total sessions count
Total sessions count over time
Total sessions count by device-type (AD, VPN, SSH)
Average sessions count daily, weekly, monthly, yearly)
Average global session duration
Average sessions duration over time (daily, weekly,
monthly , yearly)
HTTP Traffic by application-type (Protocol)
Top-N domains by traffic
Top-N domains by activity (number of events)
Top-N client machines by traffic
HTTP traffic over time (day, week, month, year)
Average daily, weekly, monthly, yearly http traffic

33. UBA Demo

34. 34
SEPT 26-29, 2016
WALT DISNEY WORLD, ORLANDO
SWAN AND DOLPHIN RESORTS
• 5000+ IT & Business Professionals
• 3 days of technical content
• 165+ sessions
• 80+ Customer Speakers
• 35+ Apps in Splunk Apps Showcase
• 75+ Technology Partners
• 1:1 networking: Ask The Experts and Security
Experts, Birds of a Feather and Chalk Talks
• NEW hands-on labs!
• Expanded show floor, Dashboards Control
Room & Clinic, and MORE!
The 7th Annual Splunk Worldwide Users’ Conference
PLUS Splunk University
• Three days: Sept 24-26, 2016
• Get Splunk Certified for FREE!
• Get CPE credits for CISSP, CAP, SSCP
• Save thousands on Splunk education!

35. Thank You!