Tag Archive for: Splunk

You are here: / Splunk

Posts

SplunkLive! DC – 7/19 @ The Convention Center

Our friends at Splunk are pleased to announce that Registration is Now Open for SplunkLive! Washington, D.C. on July 19.

  

SpunkLive! Washington D.C

Date: July 19, 2018

Time: 8:00 am – 4:00 pm

Location: Walter E Washington Convention Center 

801 Mount Vernon Place NW

Washington, DC 20001

Registration page: http://live.splunk.com/splunkliveDC-07192018

Keynote Speaker:

Declan Morris, Splunk CIO

Public Sector Luncheon:

Special luncheon, including a panel discussion exclusively for Public Sector (government, Aerospace & Defense, Higher Education) participants

Breakout Sessions & SE Presenters:

The final agenda including the breakout sessions is listed below. 

 

Agenda:

Time Description
8:00am Breakfast and Registration
9:00am Turn Data into Answers with Splunk
Declan Morris, CIO, Splunk
Overview Track IT Ops Track Security Track Industry Track
10:45am Improve Your Velocity With Splunk Cloud Gain Real Time Insights from Your Data Using Splunk and AWS Cloud Solve Your Security Challenges with Splunk Leveraging Continuous Monitoring with Splunk to Support Compliance Requirements
11:45am Lunch
12:45pm Get More from Your Machine Data with Splunk AI Analytics Through DevOps Lifecycle Intro to Security Analytics Methods Enabling Efficient Government with Splunk
2:00pm Getting Data In Predictive, Proactive and Collaborative ML with Splunk ITSI Accelerate Incident Response Using Automation and Orchestration Keeping Agency Operations Humming with Event Analytics
3:00pm Reception — PartnerZone

 

Automated Log Management and Analysis using Splunk for Computer Incident Investigations

I define “Log Analysis” as a process of collecting system logs (syslog) and event data from computer systems, network devices and applications to look for anomalous events that are malicious or are in violation of organizational policies.

Many organizations spend thousands of dollars on equipment deployment, but ignore the system and event logs from those exact systems. Log analysis is one of the most overlooked aspects of operational computer and network security today.

Traditionally, security teams would use outdated methods and inefficient analysis techniques such as command lines and scripts to review log files. Furthermore, the security team has limited access to data, and when that data has to be collected from multiple locations and equipment to be analyzed, that often increases the amount of time necessary to produce a conclusion of an incident.

By introducing Splunk a search engine for log data that supports many log sources such as Apache access logs, mysql database logs, and any log in standard syslog format, we were able to be more productive in our log analysis.

Splunk comes in two versions, basic and professional. The basic version is free as long as you keep the data limited to 500MB a day while the professional version cost is dependent on the amount of data collected as well as some other neat features.

Splunk provides both real-time and historical visibility into all network, application, server and user activity to support investigations, alerting and reporting. It provides that bridge security and computer investigators need to do their jobs right.

For more information on Splunk and log management you can visit:
www.splunk.com