Splunk [Security, Compliance and Fraud Track] 2019 .conf Videos w/ Slides

As the types of devices and applications used in IT organizations increase exponentially, scaling the analytics-driven SOC becomes even more imperative. In this session Splunk Professional Services will help you learn from its past experiences architecting Splunk Enterprise Security environments for scale into the terabytes per day. We will share technical details on improvements to search technology and Data Model Acceleration in Splunk Enterprise that will help you increase performance and decrease total cost of ownership. We will also take a deep dive under-the-hood into Splunk Enterprise Security Frameworks in which you should make special considerations for high volume.  Finally, we'll share important metrics on how to monitor the ongoing health of your Enterprise Security deployment, ensuring you stay on track over time, even in periods of rapid growth.

Speaker(s)
Marquis Montgomery, Principal Security Architect, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2120.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Intermediate

Organizations today struggle with quickly and consistently applying behavior-based threat intelligence across their security tools. The hours needed to stitch together this information manually leave analysts unprepared to quickly turnaround questions from management about their vulnerability to threats that their management sees in the news. In this session we will demonstrate how to use Splunk Phantom to reduce that time lag by automating your threat hunts. Specifically, we will show you how to use Yet Another Recursive Algorithm (YARA) rules on endpoint and network security tools automatically and simultaneously. We will use a case study to show the benefits achieved from this playbook: better reporting, more robust procedures, faster time to detect malware variants, and generally more efficient and effective threat hunts.

Speaker(s)
Robb Mayeski, Security Automation Magician , EY
Will Burger, Security Automation Consultant, EY
Haris Shawl, EY

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1280.pdf?podcast=1577146216

Product: Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Join this session to learn the do’s and dont’s of rolling an effective cloud security visibility platform for a global organization. We will cover topics such as why we moved away from our previous SIEM provider, deploying and managing a cloud-based SIEM, and effectively using a third party organization to provide tier 1 and 2 event and incident support.

Speaker(s)
Simon O’Brien, Principal Sales Engineer, Splunk
Grant Slender, Chief Information Security Officer, QIC

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1205.pdf?podcast=1577146216

Product: Splunk Cloud, Splunk Enterprise Security, Splunk Machine Learning Toolkit, AI/ML

Track: Security, Compliance and Fraud

Level: Intermediate

Looking to eliminate blind spots across your SAP environment and take proactive action to detect and mitigate attacks before mission-critical ERP applications are compromised? SAP recently teamed with Splunk to help a leading manufacturer build and validate a first-of-it’s-kind bi-directional integration between SAP Enterprise Threat Detection and Splunk. See a demo of how Enterprise Threat Detection’s open, extensible framework enables an exchange of alerts with Splunk to facilitate real-time attack investigations from either platform plus the ability to rapidly take action within the SAP landscape or broader heterogenous infrastructure.SAP Enterprise Threat Detection is a powerful native SAP HANA application that quickly identifies suspicious patterns at the application server and database level. When a potential SAP software-specific threat is identified, Enterprise Threat Detection can send an alert to Splunk to correlate with other application and infrastructure data for deeper investigation or trigger immediate action. Conversely, InfoSec teams using Splunk to rapidly identify anomalies across the broader security infrastructure can send alerts to Enterprise Threat Detection for forensics or to trigger appropriate actions in the SAP environment. The combination of Enterprise Threat Detection and Splunk enables organizations to more effectively combat security issues across the enterprise spanning applications and infrastructure.

Speaker(s)
Claw Clawson, SplunkYoda, Splunk
Carl Yestrau, Director of Architecture for Partners, Splunk
Anne Marie Colombo, Cybersecurity Solution Advisor, SAP

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2856.pdf?podcast=1577146216

Product:

Track: Security, Compliance and Fraud

Level:

Security requires visibility. uberAgent ESA provides just that. Built on top of the existing uberAgent User Experience Monitoring product, uberAgent Endpoint Security Analytics tags risky processes, detects potential threats resulting from configuration changes and provides deep insights into application and even script activity.

Speaker(s)
Helge Klein, Managing director, vast limits GmbH

Slides PDF link - https://conf.splunk.com/files/2019/slides/SECS2534.pdf?podcast=1577146216

Product: Splunk Enterprise

Track: Security, Compliance and Fraud

Level: Intermediate

Endpoint security is more than detecting malware.  Most insider threats, however, don’t involve malware, but other security issues associated with the user and endpoint.  Learn how Cisco’s own InfoSec team uses Cisco Endpoint Security Analytics Built on Splunk and Cisco NGFW integration to increase its endpoint security and threat visibility.

Speaker(s)
Scott Pope, Cisco

Slides PDF link - https://conf.splunk.com/files/2019/slides/SECS2899.pdf?podcast=1577146216

Product: Splunk Cloud, Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Initial compromises happen on your endpoints, so why are you not Splunking them? In this edition of Splunking The Endpoint, we will tell you exactly what to configure in Splunk, and where, why, and how to do so in order to get unparalleled visibility into threats targeting your network. Not only will we revisit popular operating system and open-source endpoint data sources like Sysmon and Osquery, but we'll also talk about various popular commercial EDR products and give you best practices for collecting data from them. Lastly, we'll help you address any doubts about scale problems and licensing costs.Please bring your laptop! We will dive through the latest Boss of the SOC (BOTS) endpoint data and demonstrate the detection techniques needed to answer BOTS questions. Everything you learn will be something you can take home and put into production immediately.

Speaker(s)
James Brodsky, Director, Global Security Kittens, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2007.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Business Flow, Splunk Data Fabric Search and Data Stream Processor

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Did you get more staff for heartbleed? How about Shellshock or the OPM breach? Neither did we. The threat landscape is growing faster than ever and we need to cover more bases without more people. Enter Splunk Phantom: automation and integration for the masses. This session will help you understand what you need to build an effective Phantom ecosystem. I will go over initial strategies, real world examples, and use cases, and we will also take a glance at some more robust development projects that show the power of Phantom's extensibility.

Speaker(s)
Mhike Funderburk, Senior Security Engineer, Stage 2 Security
Brandon Robinson, Senior Security Architect, Stage 2 Security
Luke Summers, Cyber Security Engineer, Stage 2 Security

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1949.pdf?podcast=1577146216

Product: Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Whether you have just SSE or all of Splunk's Premium Products, you can benefit from the ton of Security Content that Splunk produces. We'll start this session by setting a quick baseline on all of the fantastic detections that Security Essentials has had in the past, and then jump into the new prescriptive guides, MITRE ATT&CK™ integration, Auto-Dashboard-Magic, and all the related functionality that will help you plan your usage of any/all of Splunk's security products. We'll present all this information through the lens of helping you get the best possible detections deployed with the least amount of effort.

Speaker(s)
David Veuve, Principal Security Strategist, Splunk
Johan Bjerke, Principal Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2013.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security, Splunk User Behavior Analytics

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Maturing and scaling your security operations rests on your ability to process and analyze huge volumes of often unrelated data in real time. But today's tools notoriously overwhelm SOC analysts with the sheer number of alerts and high percent of false positives, resulting in confusion about what tools to use for investigation and response. In this session, members of Splunk's Security Research Team will discuss the next generation of Enterprise Security Content Updates that they developed, which integrate the entire Splunk for Security product suite to create a robust end-to-end defense—detection, investigation, and response. We will go over how to use these security guides, which will leverage Splunk Enterprise Security, Splunk Phantom, and Splunk User Behavior Analytics. We'll also highlight the Run Story feature we built to operationalize ESCU Analytics stories and share tools and techniques customers can use to write and test their own use cases.

Speaker(s)
Bhavin Patel, Security Software Engineer, Splunk
Jose Hernandez, Security Researcher, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1775.pdf?podcast=1577146216

Product: Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels