Imagine improving the speed of your searches over 500k times faster and breathe new life into your Splunk environment without more hardware investment.  Learn how to use both time and segmentation with fast subsearches to quickly filter events for fast, advanced data correlation.  Based on the .conf17 talk “Fields, Indexed Tokens, And You"

Speaker(s)
Andrew Landen, Sr Splunk Developer, Chevron

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1407.pdf?podcast=1577146225

Product: Splunk Enterprise

Track: Foundations/Platform

Level: Advanced

Blockchain scalability is one of the main barriers to adoption of this revolutionary new technology. Finance, supply chain, and e-commerce blockchain deployments often have peak throughputs that far exceed their baseline. For example, when tickets for a popular concert go on sale, the peak transaction throughput will result in unacceptable latency for the users. Samsung SDS Accelerator is a layer 2 scaling solution for Hyperledger Fabric that enables up to 10x transaction throughput during this burst of activity. Using Splunk MLTK, we’re able to detect and react to these bursts of activity without compromising the security guarantees of the underlying blockchain.

Speaker(s)
Jeff Wu, Senior Product Manager, Blockchain, Splunk
Ted Kim, Samsung SDS

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN2069.pdf?podcast=1577146225

Product: Splunk Enterprise, AI/ML

Track: Foundations/Platform

Level: Intermediate

To tame an event queue that's ballooning out of control, you need to know first which rules and data sources are generating a disproportionate number of alerts, and second the security value you're getting from those rules and data sources. Any changes made to rules or telemetry analyzed without that knowledge risk making your organization more vulnerable. In this session we'll discuss how Splunk empowers us to perform advanced analytics on everything from alert conversion rates to human time expenditure on alerts so that we can optimize all processes related to alerting. As long as we know what to measure and where to look, Splunk can help us tune our security operations centers to reduce monotony and false positives without diminishing our ability to detect actual threats.

Speaker(s)
Keshia LeVan, Detection Engineer, Red Canary

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2105.pdf?podcast=1577146225

Product: Splunk Cloud, Splunk Machine Learning Toolkit

Track: Security, Compliance and Fraud

Level: Advanced

Splunk’s metric index has changed a lot since we launched it back in Splunk Enterprise 7.0. In this latest iteration, we have upgraded our data model and metric index to natively ingest and store multiple metrics in a single event to further reduce its storage footprint and lower total cost of ownership. This session with provide a deep-dive into our latest metric index layout, its evolution since introduction in Splunk Enterprise 7.0, and how it varies from a log index storage layout.

Speaker(s)
Murugan Kandaswamy, Senior software engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN2268.pdf?podcast=1577146225

Product: Splunk Enterprise, Splunk Cloud

Track: Foundations/Platform

Level: Advanced

Curious about how to efficiently onboard and analyze metric data in Splunk? This talk will teach you the basic design and best practices for Splunk's Metric Indexes. Since they were introduced two years ago, Splunk's metric capabilities have quickly evolved. Now there is support for rollups, richer logs-to-metrics conversion capabilities, and a more efficient data representation formats. We also will discuss planned future enhancements and how you may best prepare for them today.

Speaker(s)
Steve Zhang, Chief Scientist, Splunk
ILAM Siva, Product Management, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1266.pdf?podcast=1577146225

Product: Splunk Enterprise, Splunk Cloud

Track: Foundations/Platform

Level: Beginner

Why is the queue for the women’s restroom always longer than the men’s at a concert or theater? Data is fundamental to the modern world. From business decisions to economic development and public policy, we rely on data to allocate resources and make critical decisions. However, because so much of the data fails to take into account bias, such as gender and race, bias and discrimination are baked into our systems. This results in missed economic opportunities and tremendous costs in time, in money and, in some cases, lives. In this session we will explore examples of data bias based on studies that are eye-opening, informative, and will change the way you look at the world. We will look at the pitfalls that lead to poor data-driven decisions, and their outcomes. We also will explore the steps you can take to inform your own data driven decisions. And, yes, we will answer the question, “Why is the women’s queue is longer than the men’s?”

Speaker(s)
Dipock Das, Senior Director, Product Management, Incubation, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FND1466.pdf?podcast=1577146225

Product: Splunk Enterprise

Track: Foundations/Platform

Level: Good for all skill levels

Join us to see the latest developments with Splunk’s Security Operations Suite. We’ll share background on the underlying architecture as well as a showcase of new features. Learn how your security use cases are solved with scale and performance.

Speaker(s)
Rob Truesdell, Sr Director, Product Management, Splunk
Atom Coffman, Starbucks

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1706.pdf?podcast=1577146225

Product: Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom

Track: Security, Compliance and Fraud

Level: Beginner

Today SOCs are in desperate need of a different alerting approach. Texas Instruments (TI) decided to transform its SOC by using risk-based alerting to generate fewer, higher fidelity alerts, and by aligning to the MITRE ATT&CK™ framework, which provides more situational awareness to analysts. This risk-based approach reduces false positives and the situational numbness associated with the legacy whitelisting process. Splunk and TI will walk you through TI's SOC successes as it transitioned to risk-based alerting. TI will detail a few real-life risk-based rule examples, discuss learning curves to fast track your transition, and discuss how MITRE ATT&CK™ fits in with this approach. After this session, you will have the foundation to embark on your risk-based alerting journey, allowing you to increase detection mechanisms, increase your coverage of the ATT&CK™ techniques, and improve the overall effectiveness of your SOC.

Speaker(s)
Jim Apger, Staff Security Architect, Splunk
Jimi Mills, Security Operations Center Manager, Texas Instruments

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1803.pdf?podcast=1577146225

Product: Splunk Enterprise, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Intermediate

Attendees will see how Splunk Enterprise and Splunk Business Flow are used to monitor the order fulfilment process within an automated warehouse in real time. You also will see how proactive alerts inform the warehouse that a Key Performance Indicator (KPI) is under performing. Then, using process mining to investigate, find the root cause to solve issues before they become problems. This presentation will initially describe the workings of an automated warehouse and the data generated. It then will cover the process of ingesting this data into Splunk and configuring Splunk Business Flow to monitor processes and KPIs. Finally, the session will review the benefits to TGW and its customers from deploying Splunk Enterprise and Splunk Business Flow. Come to the session to see how the monitoring, alerting, and process mining functionality in Splunk Enterprise and Splunk Business Flow provides a deep insight into what is happening inside an automated warehouse.

Speaker(s)
Jamie Frost, Business Improvement Analyst, TGW Limited

Slides PDF link - https://conf.splunk.com/files/2019/slides/BA1593.pdf?podcast=1577146225

Product: Splunk Enterprise, Splunk Business Flow

Track: Business Analytics

Level: Beginner

Siloed IT monitoring for Virtualization struggles to scale as teams use different tools to monitor the same IT environment, increasing complexity and decreasing productivity. Imagine analysts, admins and virtualization teams collaborating and troubleshooting on a single platform. No more finger pointing, no more “my tool says”, no more data disagreements. Use Splunk for centralized infrastructure monitoring of your virtualized environment. 

Speaker(s)
Ian Torbett, Product Manager, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/IT1766.pdf?podcast=1577146225

Product: Splunk Enterprise, Splunk IT Service Intelligence

Track: IT Operations

Level: Good for all skill levels