Intel is transforming its approach to security by deploying a new Cyber Intelligence Platform (CIP) based on Splunk, Kafka, and other leading-edge technologies. Our new platform ingests data from hundreds of data sources and security tools, providing context-rich visibility and a common work surface, and improving the efficiency of our entire information security organization. This session will address how we partnered with Splunk architects to deploy and realize benefits from this solution in just five weeks. We will detail how our solution uses real-time data, streams processing, machine learning tools and consistent data models to decrease time to detect and respond to sophisticated threats. This session will cover everything from our platform's business value to its solution architecture.

Speaker(s)
Jac Noel, Security Solutions Architect, Intel
Aubrey Sharwarko, Data Scientist, Intel
Jerome Swanson, Security Data Scientist, Intel

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2253.pdf?podcast=1576909560

Product: Splunk Enterprise Security

Level: Good for all skill levels

In the new Splunk Cloud Platform, we’re reimagining the way we enable monitoring and alerting. Configure triggers to identify changes and anomalies in your data as they occur and determine the right action(s) that should be taken as a result – email, Slack, VictorOps, etc. Leverage machine learning to bring your attention to the right insights and roll that back into your core monitoring strategy.  Come to this session to learn more about both the long-term vision and what’s immediately available.

Speaker(s)
Miranda Luna, Product Management, Splunk
Declan Shanaghy, Architect Developer Platform, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/DEV2518.pdf?podcast=1576909560

Product:

Level:

We now live in a Cloud Native world where we build and deploy software very differently from the previous generation. Large, centralized systems are being decoupled and distributed to address scalability needs and to allow companies to deliver value faster. Compared to monolithic applications, microservice architectures introduce complexity in network communication, feature much shorter life cycles, and require resiliency in dynamic environments. As companies began to build or migrate to microservice architectures they often run into operational complexity and struggle to efficiently monitor their environments. These challenges have highlighted the need to observe systems differently and lead to the rise of Observability. In this session, we will discuss OpenTelemetry and how it provides visibility into both distributed traces and metrics. We will walk through the architecture including client libraries and collection as well as cover key concepts including annotations, sampling policies and more. Live demos and coding examples will be presented through the talk. By the end of the session, you will know what OpenTelemetry is, why it is important, how you can get started and how you can get involved.

Speaker(s)
Steve Flanders, Director of Product Management, Splunk
Constance Caramanolis, Senior Software Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/IT2950.pdf?podcast=1576909560

Product: SignalFx

Level:

Does your IT environment look like a huge bowl of spaghetti? Is it even possible to untangle that vast, complex, and diverse ecosystem? Is moving from reactive to proactive even a possibility? Join us to learn how United Health Group is using Splunk IT Service Intelligence to provide end-to-end visibility and proactive incident response to its critical business applications. We’ll show you how mapping service dependencies and defining meaningful key performance indicators from the front end all the way back to the mainframe is providing value to the DevOps teams and the businesses they support.

Speaker(s)
Ben Nolan, Splunk IT Service Intelligence Administrator, Optum
Jacob Edelen, Splunk ITSI Administrator, Optum

Slides PDF link - https://conf.splunk.com/files/2019/slides/IT2139.pdf?podcast=1576909560

Product: Splunk Enterprise, Splunk IT Service Intelligence

Level: Intermediate

Seeking guidance to help create amazing Splunk dashboards? Want to wow your team as well as your execs and become THE dashboard master? Come learn about Splunk's new dashboarding capabilities, and experience rich dashboard examples as well as the art of the possible. We will demo a variety of dashboards, and we’ll share tips and tricks, tutorials and templates to ensure you can build your own. Attend this session and you’ll be on the path to becoming a Splunk dashboard ninja in no time. 

Speaker(s)
Stephen Luedtke, Sr. Data Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1933.pdf?podcast=1576909560

Product: Splunk Enterprise, Splunk Cloud, Splunk IT Service Intelligence

Level: Good for all skill levels

Deception, automation, and real-time data exploitation help security organizations go on offense vs attackers. In this session we will discuss how to use a variety of deception techniques to gather threat intelligence, how to create an automated response, and how to test response playbooks to validate that responses work as expected.

Speaker(s)
Vincent Urias, Researcher, Sandia National Laboratories
Will Stout, Researcher, Sandia National Laboratories

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2203.pdf?podcast=1576909560

Product: Splunk Enterprise Security, Splunk Machine Learning Toolkit, Phantom, AI/ML

Level: Intermediate

Most of us have had (or still have) nightmares about an alert that someone's exfltrating data from our organization. We've lived that nightmare at Harris, and we've learned from it. In this session, we'll discuss how we used red and purple teaming to improve our security posture post-breach. Learn from our experience so that you can strengthen your team's alerting, staff comptency, and policies, and reduce the risk of a breach at your company.

Speaker(s)
Nate Piquette, Sr. Detection & Response Engineer, L3Harris Technologies
Adam Parsons, Sr. Detection & Response Engineer, L3Harris Technologies

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1375.pdf?podcast=1576909560

Product: Splunk Enterprise, Splunk Enterprise Security

Level: Good for all skill levels

Paychex’s goal of providing the best user experience for our clients has led to a significant investment in performance testing and monitoring of our applications. Currently all Paychex applications record the execution time for every task and subtask to logs. These are indexed by Splunk, allowing us to identifying areas where changes to code and database queries will have a positive impact on the overall user experience. This presentation will focus on combining this user experience data with client demographic data (such as the number of active employees) and using the Splunk Machine Learning Toolkit to build predictive models of user experience based on client demographic data.

Speaker(s)
Ken Tupper, Lead Performance Engineer, Paychex

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1631.pdf?podcast=1576909560

Product: Splunk Machine Learning Toolkit, AI/ML

Level: Intermediate

Obtaining data to develop defenses against threats is a constant challenge for security analysts. To that end, Splunk's Security Research team developed the Splunk SIEMulator, a framework modeled after Chris Long's DetectionLab that allows a defender to replay attack scenarios using AttackIQ in a simulated environment. SIEMulator’s Attack Range environments are all configured with Splunk forwarders and the apps necessary to create and store data in CIM data models. We'll show you how to use the SIEMulator to produce shareable data that can help security analysts replicate scenarios and effectively detect, investigate, and respond to threats.

Speaker(s)
Phil Royer, Research Engineer, Splunk
Rod Soto, Principal Security Research Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1671.pdf?podcast=1576909560

Product: Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom

Level: Advanced

Finding anomalies in network data is no easy task, especially when you have terabytes of logs per day to analyze. But have no fear, we’re going to teach you how. In this session we will perform a technical deep dive into how a global content delivery network provider is using Splunk’s Machine Learning Toolkit to discover anomalies in network traffic. We’ll take you on a data science journey and show you how we tested multiple anomaly detection techniques, overcame challenges, fine-tuned detections, and ultimately arrived at meaningful alerts based on machine learning.

Speaker(s)
Jim Goodrich, Senior Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1390.pdf?podcast=1576909560

Product: Splunk Machine Learning Toolkit, AI/ML

Level: Good for all skill levels