WEBVTT

00:00.000 --> 00:03.405
>> We're on Module 2 talking
about Splunk products,

00:03.405 --> 00:06.675
understanding popular Splunk
products is important.

00:06.675 --> 00:09.195
If you're going to claim any
kind of Splunk knowledge,

00:09.195 --> 00:10.860
you need to be
able to understand

00:10.860 --> 00:12.150
how the products interact,

00:12.150 --> 00:13.530
and work with each other, and

00:13.530 --> 00:14.670
know where to start for making

00:14.670 --> 00:17.220
recommendations on what products

00:17.220 --> 00:18.870
that companies should
look to purchase.

00:18.870 --> 00:21.090
Splunk does regularly
make changes,

00:21.090 --> 00:22.350
and add new features,
and products,

00:22.350 --> 00:25.229
so check their site for
the latest information.

00:25.229 --> 00:27.630
Like we talked
about in Module 1,

00:27.630 --> 00:29.685
when people refer to Splunk,

00:29.685 --> 00:32.340
they typically mean the
core Splunk platform

00:32.340 --> 00:33.990
or they may just be referring to

00:33.990 --> 00:35.985
what they're used
to working with.

00:35.985 --> 00:37.890
There are currently
four different

00:37.890 --> 00:39.960
Splunk platforms to choose from,

00:39.960 --> 00:41.790
these all aggregate process,

00:41.790 --> 00:43.140
and help you use data,

00:43.140 --> 00:45.320
which one you pick
typically has to

00:45.320 --> 00:47.675
do with your data
appetite, and budget.

00:47.675 --> 00:49.880
A small company
with a few users,

00:49.880 --> 00:52.160
and limited data may
choose Splunk light,

00:52.160 --> 00:53.900
whereas most large
companies will

00:53.900 --> 00:56.135
pick Splunk Enterprise
or splint Cloud.

00:56.135 --> 00:58.610
There are some differences
between these platforms,

00:58.610 --> 01:00.095
such as for Splunk light,

01:00.095 --> 01:01.730
you don't have the
option of clustering,

01:01.730 --> 01:05.015
and high availability or
single sign on options.

01:05.015 --> 01:06.320
Splunk Enterprise is

01:06.320 --> 01:08.375
the most popular
platform I've seen,

01:08.375 --> 01:10.145
on the surface the
main difference

01:10.145 --> 01:11.480
between Splunk Enterprise,

01:11.480 --> 01:12.800
and Splunk Cloud as if you want

01:12.800 --> 01:14.720
an on-prem solution where you're

01:14.720 --> 01:16.400
managing your own servers

01:16.400 --> 01:19.300
or if you want a hosted
environment in the Cloud,

01:19.300 --> 01:21.605
there are other considerations,

01:21.605 --> 01:22.790
but companies will usually

01:22.790 --> 01:24.290
start with one of
these four options,

01:24.290 --> 01:26.500
and then build out from there.

01:26.500 --> 01:29.555
Pricing is determined
by how much data

01:29.555 --> 01:32.240
is indexed on a daily basis.

01:32.240 --> 01:34.610
There are many different
options for licensing.

01:34.610 --> 01:36.680
So if you're seriously
looking to make a purchase,

01:36.680 --> 01:37.970
you should talk
with Splunk about

01:37.970 --> 01:39.760
what would be best
for your company.

01:39.760 --> 01:41.480
Before even looking to make

01:41.480 --> 01:43.580
a purchase it maybe a
good idea to quantify,

01:43.580 --> 01:46.640
and prioritize the data
you think you'll need.

01:46.640 --> 01:49.010
Splunk has a lot of solutions

01:49.010 --> 01:51.560
targeted towards
specific industries,

01:51.560 --> 01:52.700
that typically work as

01:52.700 --> 01:55.295
paid apps added to an
existing platform.

01:55.295 --> 01:57.590
A common environment
might exist of

01:57.590 --> 01:59.300
a Splunk enterprise environment

01:59.300 --> 02:01.145
or Splunk Enterprise Security,

02:01.145 --> 02:04.500
often referred to as ES
for Enterprise Security,

02:04.500 --> 02:08.270
and Splunk user behavior
analytics added to it.

02:08.270 --> 02:10.970
Splunk Enterprise Security
adds features like

02:10.970 --> 02:14.045
making it easier for analysts
to pivot between events,

02:14.045 --> 02:15.710
conduct threat hunting, and just

02:15.710 --> 02:17.795
intelligence, and identify risk.

02:17.795 --> 02:20.795
Splunk UEBA or User
Behavior Analytics,

02:20.795 --> 02:22.160
then adds machine learning,

02:22.160 --> 02:24.740
and helps identify anomalies
in the environment,

02:24.740 --> 02:26.690
and pick out things
like insider threats or

02:26.690 --> 02:29.840
compromises that might
otherwise have been missed.

02:29.840 --> 02:31.770
While Enterprise Security,

02:31.770 --> 02:34.070
and UEBA are heavily
marketed together,

02:34.070 --> 02:35.540
you can't have one or the other

02:35.540 --> 02:37.900
with your Splunk
enterprise platform.

02:37.900 --> 02:40.280
Other solutions to
add to your platform

02:40.280 --> 02:42.740
include things like insights
for infrastructure,

02:42.740 --> 02:44.870
Splunk helps you baseline
your environment,

02:44.870 --> 02:47.820
and identify potential problems.

02:47.830 --> 02:52.355
Two of Splunk recent
acquisition target other areas,

02:52.355 --> 02:54.590
Splunk Phantom is
an orchestration,

02:54.590 --> 02:56.540
and automation
tool that lets you

02:56.540 --> 02:59.095
kick off automated
chains of events.

02:59.095 --> 03:01.100
For example, you can have

03:01.100 --> 03:03.515
Splunk Enterprise send
over a malware event,

03:03.515 --> 03:07.730
have Phantom, look up the
hash, and Virus Total,

03:07.730 --> 03:09.260
and then tell another tool to

03:09.260 --> 03:11.450
isolate the machine
that has the malware,

03:11.450 --> 03:14.870
and then tell your ticketing
system to open a ticket

03:14.870 --> 03:16.340
with the event information in

03:16.340 --> 03:18.815
Virus Total results,
it's pretty cool.

03:18.815 --> 03:21.920
VictorOps is primarily used to

03:21.920 --> 03:25.070
manage on call schedules,
and create notifications,

03:25.070 --> 03:27.905
such as by sending push
notifications to your phone,

03:27.905 --> 03:29.375
giving you a call,

03:29.375 --> 03:32.015
or send me an email
when an event comes in.

03:32.015 --> 03:35.270
An example scenario would be say

03:35.270 --> 03:38.390
you have high CPU alert for
a critical machine trigger,

03:38.390 --> 03:39.770
and Splunk Enterprise,

03:39.770 --> 03:42.305
and then Splunk since
the event over to

03:42.305 --> 03:44.270
VictorOps where it then

03:44.270 --> 03:47.700
calls the system owner to
take a look at the machine.

03:47.930 --> 03:50.110
For our review time,

03:50.110 --> 03:52.120
can you identify which

03:52.120 --> 03:55.250
of the following is
not a Splunk platform?

03:56.270 --> 03:58.440
The answer is C,

03:58.440 --> 04:01.660
Splunk Enterprise
Security can be added to

04:01.660 --> 04:03.985
a Splunk platform to give

04:03.985 --> 04:08.660
additional tools for
your company to use.

04:08.670 --> 04:12.400
As a review, you have
your Splunk platform,

04:12.400 --> 04:14.830
Splunk Enterprise,
Splunk Clouds,

04:14.830 --> 04:16.285
Splunk light, and Splunk free.

04:16.285 --> 04:18.100
This may be enough
for your company,

04:18.100 --> 04:20.755
plenty are able to accomplish

04:20.755 --> 04:23.390
everything they need to
with one of these, however,

04:23.390 --> 04:26.005
Splunk has a lot of other
specialized solution

04:26.005 --> 04:28.090
that can optimize the
use of your data,

04:28.090 --> 04:30.585
such as Splunk User
Behavior Analytics,

04:30.585 --> 04:33.430
Splunk insights for
ransomware, and others.

04:33.430 --> 04:36.920
Phantom can be used to automate
tasks in your company,

04:36.920 --> 04:38.960
and VictorOps can alert
you when something

04:38.960 --> 04:41.360
happens, and with that,

04:41.360 --> 04:42.995
you've made it through Module 2,

04:42.995 --> 04:44.660
and Module 3,

04:44.660 --> 04:47.520
we'll finally get
our hands on Splunk.