Splunk [Phantom] 2019 .conf Videos w/ Slides

Our security research, engineering and product teams have been hard at work building new capabilities to bolster your Splunk security stack. Find out what they’ve been up to since .conf18, and watch a demonstration of the latest innovations in Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk Phantom. There are other awesome developments that we can’t share now but are excited to share with you at .conf.

Speaker(s)
Kyle Champlin, Senior Product Manager, Splunk
Patriz Regalado, Sr. Product Marketing Manager, Splunk
Rob Truesdell, Sr Director, Product Management, Splunk
Chris Simmons, Director of Product Marketing, Splunk
Koulick Ghosh, Product Manager, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2366.pdf?podcast=1577146240

Does your small team also run a full-featured SOC that supports a global company? In this session we’ll show you how we’ve used Splunk Cloud and Splunk Enterprise Security to bring together all the relevant security intelligence from our technology stack, transforming our security operations from ad hoc and tactical to strategic and compliance-driven. We’ll discuss key takeaways from our journey, such as the benefits of ingesting data properly from the outset so you can reap the rewards as you scale; how we leverage multiple use cases out of single data sources; and how we created easy-to-understand visualizations that convey our firm’s security posture to management.

Speaker(s)
Edward Asiedu, Senior Professional Services Consultant, Splunk
Craig Gilliver, Head Of SecOps, Johnson Matthey

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1511.pdf?podcast=1577146240

Security architectures typically involve many layers of tools and products that are not designed to work together, leaving gaps in how security teams bridge multiple domains to coordinate defense. The Splunk Adaptive Operations Framework (AOF) addresses these gaps by connecting security products and technologies from our partners with Splunk security solutions including Splunk Enterprise Security (ES) and Splunk Phantom. Join this session to learn how the Splunk AOF benefits both users and security technology providers by enabling rich context for all security decisions, collaborative decision-making, and orchestrated actions across diverse security technologies.

Speaker(s)
Alexa Araneta, Product Marketing Manager, Splunk
John Dominguez, Product Marketing Director, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2372.pdf?podcast=1577146239

Join us to see the latest developments with Splunk’s Security Operations Suite. We’ll share background on the underlying architecture as well as a showcase of new features. Learn how your security use cases are solved with scale and performance.

Speaker(s)
Rob Truesdell, Sr Director, Product Management, Splunk
Atom Coffman, Starbucks

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1706.pdf?podcast=1577146239

Learn from our experience implementing Splunk Phantom so that you can speed up your automation journey. We'll examine key decisions we made with our implementation and the good and the bad that resulted. We'll also cover our automation efforts in event triage, incident response and everything in between, with walkthroughs of our top playbooks. Additionally, we'll present how we tackled Splunk alert ingestion and what Phantom could look like in a cloud-first deployment.

Speaker(s)
John Murphy, Security Analyst, NAB
Chris Hanlen, Lead Cyber Security Specialist, NAB

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1506.pdf?podcast=1577146239

Last year, after our outrageously successful talk "Pull Up Your SOCs: A Splunk Primer on Building or Rebuilding your Security Operations", we wanted to revisit this topic to cover changes in Security Operations that have taken place over the last 12 months. Whether you’re starting from scratch or rebuilding your security program, the first twelve months of standing up your security operations is absolutely critical to success.

Speaker(s)
Dimitri McKay, Staff Security Architect | Jedi Master, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2186.pdf?podcast=1577146239

Many government agencies and for-profit companies require that you run Splunk on a network disconnected from the outside Internet. This presents many challenges, including how to cross air gaps and one-way transfers, how to operate indexers in an air-gapped environment, and how to automate backwards. This session will cover lessons learned from a variety of air-gapped deployments.

Speaker(s)
Steve Schohn, Staff Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1190.pdf?podcast=1577146239

Organizations today struggle with quickly and consistently applying behavior-based threat intelligence across their security tools. The hours needed to stitch together this information manually leave analysts unprepared to quickly turnaround questions from management about their vulnerability to threats that their management sees in the news. In this session we will demonstrate how to use Splunk Phantom to reduce that time lag by automating your threat hunts. Specifically, we will show you how to use Yet Another Recursive Algorithm (YARA) rules on endpoint and network security tools automatically and simultaneously. We will use a case study to show the benefits achieved from this playbook: better reporting, more robust procedures, faster time to detect malware variants, and generally more efficient and effective threat hunts.

Speaker(s)
Robb Mayeski, Security Automation Magician , EY
Will Burger, Security Automation Consultant, EY
Haris Shawl, EY

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1280.pdf?podcast=1577146239

Endpoint security is more than detecting malware.  Most insider threats, however, don’t involve malware, but other security issues associated with the user and endpoint.  Learn how Cisco’s own InfoSec team uses Cisco Endpoint Security Analytics Built on Splunk and Cisco NGFW integration to increase its endpoint security and threat visibility.

Speaker(s)
Scott Pope, Cisco

Slides PDF link - https://conf.splunk.com/files/2019/slides/SECS2899.pdf?podcast=1577146239

Site Reliability Engineering: Easy to say, harder to do. It can be especially difficult to make sure that all of tenants of SRE are applied to the services you support in a way that is easy for your engineers to adopt. In this session, we will take a look at how you can use Splunk's ITSI, VictorOps and Phantom platforms to make robust solutions that can help your teams consistently solve complex problems and mature their services.

Speaker(s)
Chris Crocco, Senior Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/IT1046.pdf?podcast=1577146239