Maturing and scaling your security operations rests on your ability to process and analyze huge volumes of often unrelated data in real time. But today's tools notoriously overwhelm SOC analysts with the sheer number of alerts and high percent of false positives, resulting in confusion about what tools to use for investigation and response. In this session, members of Splunk's Security Research Team will discuss the next generation of Enterprise Security Content Updates that they developed, which integrate the entire Splunk for Security product suite to create a robust end-to-end defense—detection, investigation, and response. We will go over how to use these security guides, which will leverage Splunk Enterprise Security, Splunk Phantom, and Splunk User Behavior Analytics. We'll also highlight the Run Story feature we built to operationalize ESCU Analytics stories and share tools and techniques customers can use to write and test their own use cases.

Speaker(s)
Bhavin Patel, Security Software Engineer, Splunk
Jose Hernandez, Security Researcher, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1775.pdf?podcast=1577146258

Are you drowning in a sea of data that expands daily? Overwhelmed by 1000s of events and alarms? Tasked with tracking a dynamic, ever-morphing infrastructure? Expected to resolve requests, incidents, and performance issues in seconds, not days… without adding any more headcount to your team? You’re not alone.Enter Automation, AIOps, and machine learning (ML). It’s finally IT’s turn to harness these powerful technologies to improve operational efficiency, reduce MTTR, eliminate alarm noise, streamline service requests, increase performance without lifting a finger, and tame the beast of IT complexity. Join our session as we explore practical applications for these technologies today and in the future to transform the way you approach IT operations. Get real world examples from other IT professionals and see how you can maximize your investments in Splunk, ITSM, monitoring tools, and more by bringing AI, ML, and automation to the mix.​

Speaker(s)
Rob Kelsall, VP, Global Sales Engineering, Resolve Systems

Slides PDF link - https://conf.splunk.com/files/2019/slides/ITS2752.pdf?podcast=1577146258

If we hear a nearby gunshot, we instinctively react. A mechanic often knows their machine's sound so well that they can diagnose issues by sound alone. While machines can be given analytical capabilities with machine learning (ML), sensing human inputs - like auditory or other sensory data - in a form that machines can understand is challenging. In Splunk, we have been all about making machine data accessible to humans, but what if we flip that and make human data accessible to machines? I take audio captured from live and recorded sources and using Fast Fourier transform feed it into Splunk's Machine Learning Toolkit (MLTK) for classification and anomaly detection. Can we use Splunk to detect gunshots? Can we learn a machine’s normal sounds to detect pending failures? This presentation uses Splunk to apply superhuman ML detection and learning capabilities to human data to show that the MLTK contains accessible tools you can apply to your IT and security problems.

Speaker(s)
Joshua Marsh, Senior Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/IoT1560.pdf?podcast=1577146258

Aflac measures risk to provide financial protection to more than 50 million people worldwide. Join this session to learn how Aflac mitigates fraud by using Splunk's Machine Learning Toolkit (MLTK) to find outliers and cluster events. Using Splunk and the MLTK reduced the time needed to conduct necessary analyses (e.g. link analysis) from weeks and months to just minutes—we will share with you how we use Splunk's MLTK to iterate quickly, develop new anomaly detection techniques, and improve our overall fraud mitigation perfomance.

Speaker(s)
Matthew Harper, Director, Cyber Crime Prevention, Aflac

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1904.pdf?podcast=1577146258

Learn how to build powerful apps with the Splunk Developer Cloud. 

Speaker(s)
Tedd Hellmann, Sr. Product Manager, Splunk
Eric Cheng, Senior Software Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/DEV1476.pdf?podcast=1577146257

So you have a SIEM with security data, e.g. firewalls, proxy, endpoint data, etc. Now what? How do you effectively operationalize your investment? This session provides recipes, principles, patterns, and strategies for using Splunk and data-driven analytics to move your security monitoring and compliance effectiveness up the maturity curve. This session will cover how to identify key mixes of data sources, core OOTB content to use, and how to layer capabilities aligned with your maturity. We will help you go beyond the endless alerts and investigations and start creating value by reducing the impact of potential security events. We're excited to show you that there's no need for a PhD in security assurance and operations—just Splunk and a solid plan.

Speaker(s)
Paul Davilar, Security Consultant, Splunk
Paul Pelletier, Sr. Security Consultant, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1391.pdf?podcast=1577146257

Production of crystal and gemstones requires high-class, top-quality output and unmatched quality and accuracy in the E2E production line. Based on in-depth experience, our joint client is one of the leading providers of production line machinery, serving its own business units as well as industry customers with precision optical instruments, grinding, sawing, drilling, and dressing tools. The new technical innovations in the area of Industrial Internet of Things (IIoT) offer completely new options to improve smart production lines. Thus Accenture is partnering with Splunk on creating a roadmap to build a fully digital, smart factory that will become a world-leading lighthouse facility. This session will provide insights into how the power of data enabled by Splunk can realize a quantum step in modern production line environments. It also will help you understand the value of data science for predictive quality, digital twin scenarios, reduced lot size, and closed loop R&D processes.

Speaker(s)
Stefan Schroder, Managing Director, Accenture
Ron Perzul, Senior Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/IoT1509.pdf?podcast=1577146257

In this session, we tackle data breaches and information exfiltration from cloud file stores. Beyond the attacks that make headlines and result in millions of stolen personal records, we will also focus on the far less publicized risks related to exposure of intellectual property, infrastructure details or finances. We will share our experience in building a defensive strategy that now detects highly-covert exfiltration attempts.To this end, we first shed a lot of light on how companies use general-purpose file stores, such as Box, Office365 or Google Drive. We cover the types of files that commonly get stored in the cloud, file sharing practices, access properties, as well as uses of cloud stores by various departments. There are a lot of unexpected insights which eventually invalidate common security assumptions.As the boundary between good and bad gets blurred, we will provide you with a peek into how to design an effective data-driven defense. This approach helped us hone our detection to just tens of validly suspicious exfiltration files in a massive cloud store.

Speaker(s)
Stanislav Miskovic, Security Data Science, Splunk
Ignacio Bermudez Corrales, Senior Data Scientist, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2083.pdf?podcast=1577146257

"Did we just lose ALL our knowledge objects? Do you know how much time and energy that was?" After a destructive resync, Paychex lost two months of its knowledge object creations/modifications. We learned to be prepared if it were to ever happen again. How? It's easier than you might think, and you don't have to be an admin. You’ll learn how to proactively save your work (dashboards, reports, data models, MLTK experiments, ITSI glass tables, macros, views, etc.) and audit changes when they occur. You will leave the session knowing how to manage the ever-increasing amount of things you create. You'll also have solutions that can save you time and effort from having to recreate lost/modified objects, including how to restore service faster. You also will come away with peace of mind knowing that you can take control of safeguarding and protecting your work, thereby covering your assets when a disaster happens.

Speaker(s)
Dustin Marling, Splunk App Developer, Paychex
Eric Favreau, Service Health Operations Analyst, Paychex

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1315.pdf?podcast=1577146257

Can Splunk help eliminate environmental risks and save the company money at the same time? The Alabama Department of Environmental Management (ADEM) sets standards defining the amount of Volatile Organic Compounds (VOCs) that can be safely released. Honda Manufacturing of Alabama (HMA) must adhere to those standards and track our compliance within the parameters set forth by the ADEM. Failure to comply with these standards will result in potentially damaging the environment and large fines. HMA uses a Regenerative Thermal Oven (RTO) to burn off pollutants from our paint department, which is controlled by an Allen Bradley Programmable Logic Controller (PLC). Using this PLC and the sensors built into the RTO, we collect individual chamber temperatures, fan speeds, exhaust temperatures, motor winding temperatures, motor vibrations, and fan vibrations. Using these readings and the Splunk Machine Learning Toolkit we try to predict if the temperature will be within the set range.

Speaker(s)
Charlie Studdard, Machine Data Analytics, Honda Manufacturing of Alabama

Slides PDF link - https://conf.splunk.com/files/2019/slides/IOT1629.pdf?podcast=1577146257