Splunk Named a Leader in Gartner SIEM Magic Quadrant for the Fourth Straight Year

Gartner has published the 2016 Magic Quadrant for Security Information and Event Management and Splunk was named a leader for the fourth straight year.

In the report, Gartner placed Splunk in the Leaders quadrant and positioned Splunk furthest overall for completeness of vision.

MQ SIEM FINAL

Our security portfolio, including Splunk® Enterprise and the Splunk Enterprise Security solves basic, advanced and emerging SIEM use cases to dramatically accelerate the detection, investigation of advanced threats and attacks and to rapidly respond and remediate them by providing security intelligence from all security relevant data that is collected across IT, the business, and the cloud.

A growing number of organizations are using Splunk Enterprise Security to augment, replace and go beyond their legacy SIEM deployments.…

» Continue reading

Detecting early signs of compromise by splunking windows sysinternal

Splunk_Power_Banner

OVERVIEW

Traditional way of detecting of compromise in window environment using signature based anti-virus / malware product is very difficult to detect advanced malware or threats.  Most of anti-malware solutions that are signature based relies on known list of signatures :

  • Endpoint protection product, don’t have the perfect list of threats to detect all signatures that exist or known
  • Don’t apply to new type of threats that are executed as new executables at the endpoints because there is no known signature to compare against

This traditional approach is costing organization to constantly deal with security breaches hitting the headlines that ranges from incidents that deal with data exfiltration, service interruptions, ransomwares, etc.  all dealing with inability to protect and detect …

» Continue reading

Secure Splunk Web in Five Minutes Using Let’s Encrypt

Configuring SSL for your public facing Splunk instance is time-consuming, expensive and essential in today’s digital environment. Whether you choose to go with a cloud provider or self-hosting; RTFM-ing how to generate the keys correctly and configuring how Splunk should use them can be quite confusing. Last year, a new certificate authority Let’s Encrypt was born in an effort to streamline the CA process and make SSL encryption more widely available to users (The service is FREE). In this short tutorial, we will cover how to make use of this new CA to secure your Splunk instance and stop using self-signed certs.  Using SSL will help you to secure your Splunk instance against MITM attacks. Let’s Encrypt utilizes all of …

» Continue reading

Splunk for Risk Management Framework

SplunkGov LogoThe term Risk Management Framework (RMF) can mean many things to many people.  As the paper ‘Beyond Compliance —Addressing the Political, Cultural and Technical Dimensions of Applying the Risk Management Framework’ from MITRE Corporation points out it could mean a replacement of DIACAP within the DoD, it could mean a replacement to the C&A process or it could be an evolution from compliance to a more risk based approach.

In 2014, the Department of Defense (DoD) introduced the Risk Management Framework (RMF) to help federal agencies better manage the many risks associated with operating an information system. It is clear that a compliance-only oriented approach is not enough for a robust security posture, especially in the face of …

» Continue reading

Adapting Your Security Strategy in the Ever-Changing Threatscape

event-logo-us16
The modern threat landscape is constantly changing. How can an organization maintain mission and business focus in the presence of an evolving adversary? If we take a business centric approach, technology leaders will tell you that the organizations security posture and capability should evolve to maintain parity with mission and business priorities.

Balancing the demands of the changing threat with demands of the changing business can sometimes appear incompatible. Of course one can’t simply overhaul the security infrastructure every time there is a new class of threats. Ransomware is getting quite a few headlines these days, but that doesn’t mean some of the traditional problems of rogue devices gaining access to your network are going away.

To combat the ever …

» Continue reading

Collaboration is the Key to Government Innovation

I recently participated in a panel while attending the Bloomberg RE/BOOT event in Washington, D.C. The focus of the panel was how to improve partnerships between government and industry. We started by discussing how industry can better partner with government agencies to strengthen cybersecurity in the United States. At Splunk, we solve problems by viewing the overall security solution from an ecosystem lens. Splunk technologies are just one part of that ecosystem. To address challenges in a government environment, we see our operational intelligence platform as the foundation that serves as the nerve center of the security operations ecosystem. No single solution or technology can solve every government problem, but together, industry technology leaders can partner with agencies to tackle …

» Continue reading

SIEM success patterns – How to get it right!

Hello all,

One of the things I love about machine data is that it can be used in so many ways. Interestingly enough over the years I have observed a common pattern in organizations that have been successful with SIEM. The implementation of a cyber defence center should serve to increase security maturity, strengthen cyber security skills and security intelligence, enabling organisations to successfully stop complex attacks (not just malware!) and better protect customer data and the overall business. Yet in the past I have been called in to meet with prospects regarding failed SIEM deployments and it doesn’t matter which traditional vendor it is there are always similar patterns.

 

What are the patterns of a failed SIEM deployment?

trip_hurdles_800_clr_5680The …

» Continue reading

Splunk & the National Defense University: Educating the Security Warriors

200px-National_Defense_UniversityEvery six months, or once a semester if you are academically inclined, our Splunk Public Sector office in Tysons Corner, VA hosts students from the National Defense University (NDU) in Washington, DC to discuss emerging security trends, the evolving threat landscape and adaptive threat response initiatives that make all data crucial to security warriors.

For those who are not familiar, NDU’s mission is to support warfighters by providing rigorous joint professional military education to members of the U.S. Armed Forces and select others to develop leaders who are able to operate and creatively think in an increasingly unpredictable and complex world. The University’s overarching purpose is to educate, develop and inspire national security leaders.

These semiannual meetings consist of the …

» Continue reading

How to Pick a Threat Intelligence Provider (kind of…)

Over my last two years-ish at Spunk I’ve been asked the question “Which threat intelligence feed should I purchase?” and “whats the deal with the viking helmet?” and “whats up with the Star Wars theme at Threatconnect”  (ಠ_ಠ at you @wadebaker) on a more than regular occurrence. And like anyone who is trying to get out of a binary question I would respond with “it depends…” and then I’d mumble something about “threat data”. Finally I’d sigh and say, “All joking aside… it depends”. I just didn’t have a great answer. Don’t get me wrong, I have personal preferences based on my experiences, but I tend to know threat intelligence providers who focus on nation-state adversaries. If you work for an …

» Continue reading

Detecting and Responding to the Accidental Breach

Hello All,

Splunk recently commissioned analyst firm IDC to conduct research in EMEA into how capable organizations are at protecting and responding to hapless user activity. The research questioned 400 organizations across the region, producing some really valuable insights.

header_english

At a time when security breaches are inevitable, one of the primary threat vectors is what IDC calls the hapless user. It isn’t a case of the user being stupid – it’s because attacks are getting far better at tricking users into unintentionally clicking on the wrong link or opening attachments which they shouldn’t.

Why organizations cant deal

In the IDC report you can find out about the threats that companies are most worried about in EMEA, what security technologies they are using and what …

» Continue reading