Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]

Update: 2019-12-24

Description

Threat hunting is hard, and threat hunting in an enterprise network with thousands of endpoints is even harder. We will demonstrate how we leveraged Splunk Enterprise to build an Advanced Threat Hunting platform designed for large scale threat hunting of 100,000 or more endpoints. Using Splunk Enterprise allows us to combine analytics, data enrichment, and custom workflows to display in one platform the most important data to analysts. Our threat hunting platform addresses the challenges of data retention and collection, high false positive rates, and analyst fatigue, all while lowering the time to detection of malicious incidents and improving the efficiency of enterprise SOC operations.

Speaker(s)
Dan Rossell, Analyst, Booz Allen Hamilton
Ashleigh Moriarty, Lead Technologist, Booz Allen Hamilton

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1071.pdf?podcast=1577146258

Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit

Track: Security, Compliance and Fraud

Level: Intermediate

Comments

In Channel

The New Experiment Experience in the Splunk Machine Learning Toolkit [Splunk Enterprise, Splunk Machine Learning Toolkit, AI/ML]

2019-12-2444:04

The SOC of the Future [Splunk Enterprise, Splunk Enterprise Security, Splunk User Behavior Analytics]

2019-12-2446:36

The Two Most Common Machine Learning Solutions Everyone Needs to Know [Splunk Enterprise, Splunk Machine Learning Toolkit, AI/ML]

2019-12-24--:--

Use Deception, Automated Response and Threat Emulation to Make Your Defense Proactive [Splunk Enterprise Security, Splunk Machine Learning Toolkit, Phantom, AI/ML]

2019-12-24--:--

User Experience Modeling with the Splunk Machine Learning Toolkit [Splunk Machine Learning Toolkit, AI/ML]

2019-12-24--:--

Use Splunk SIEMulator to Generate Data for Automated Detection, Investigation, and Response [Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom]

2019-12-24--:--

Using Machine Learning to Detect Traffic Anomalies [Splunk Machine Learning Toolkit, AI/ML]

2019-12-24--:--

What's New in Splunk for Security [Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom]

2019-12-24--:--

You Only Learn Once (YOLO) [Splunk Enterprise, Splunk Machine Learning Toolkit]

2019-12-24--:--

Introduction to monitoring business operations with Acceleris’ party dashboard [Splunk Enterprise, Splunk IT Service Intelligence, Splunk Machine Learning Toolkit]

2019-12-24--:--

Is it Normal or Suspicious? Detecting Anomalies via Market Basket Analysis [Splunk User Behavior Analytics]

2019-12-24--:--

Just a normal day in the office – Data driven business process improvements for a global supply chain company. [Splunk Cloud, Splunk IT Service Intelligence, Splunk Machine Learning Toolkit]

2019-12-24--:--

Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]

2019-12-24--:--

Lessons Learned From Building a Threat Detection Program [Splunk Enterprise, Splunk Enterprise Security, AI/ML]

2019-12-24--:--

Lessons Learned from Deploying Splunk UBA [Splunk User Behavior Analytics, AI/ML]

2019-12-24--:--

Los Angeles World Airports - Streamlining event management with IT Service Intelligence (ITSI) [Splunk Enterprise, Splunk IT Service Intelligence, Splunk Machine Learning Toolkit]

2019-12-24--:--

Machine Learning & Splunk 2019: The Splunk Machine Learning Toolkit in Action [Splunk Enterprise, Splunk Machine Learning Toolkit, AI/ML]

2019-12-24--:--

Maintaining a state of good repair with predictive analytics [Splunk Enterprise, Splunk Machine Learning Toolkit, AI/ML]

2019-12-24--:--

Marcus by Goldman Sachs: Monitoring an Online Banking Startup with Splunk [Splunk Enterprise, AI/ML]

2019-12-24--:--

Maximizing permissioned blockchain throughput using Samsung SDS Accelerator and Splunk MLTK [Splunk Enterprise, AI/ML]

2019-12-24--:--

00:00

Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]

#box-pro-ellipsis-176665804019274{-webkit-line-clamp:2;}Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]

Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]

Splunk

Large Scale Threat Hunting in Splunk [Splunk Enterprise, Splunk Enterprise Security, Splunk Machine Learning Toolkit]