8 Splunk Security Solutions and How to Secure Splunk Data

8 Splunk Security Solutions

1. Splunk Security Cloud

Splunk Security Cloud is a security information and event management (SIEM) solution offered as a managed cloud service. It is offered in two editions:

• Security Cloud Standard—ingests data from any source, and provides guidance on how to achieve security outcomes. The solution maps data sources and provides built-in Splunk searches that can address many security use cases.

• Security Cloud Plus—provides advanced SIEM and security analytics features that enable visibility and threat detection for cloud environments. The solution creates alerts mapped to industry standards, and integrates with threat intelligence.

You can add Security Orchestration, Automation, and Response (SOAR) capabilities to either edition of Splunk Security Cloud (see below).

Related content: Read our guide to Splunk Cloud

2. Splunk SOAR

Splunk SOAR can improve productivity for security analysts and reduce response time to security incidents, with the following capabilities:

• Automates repetitive tasks

• Automatically detects and triages security incidents

• Orchestrates complex workflows across teams and tools

• Event and case management

• Integrated threat intelligence

• Reporting and collaboration

Related content: Read our guide to Splunk Phantom (renamed to Splunk SOAR)

3. Splunk Enterprise Security

Splunk Enterprise Security (Splunk ES) is a security information and event management (SIEM) solution that collects data from all security tools and IT systems, enabling security teams to detect, triage, and respond to security incidents. It powers the Splunk Security Cloud service, and can also be deployed on-premises as a standalone application.

Common use cases of Splunk ES include:

• Continuous monitoring of hybrid environments

• Incident detection and response

• Central data repository for a security operation center (SOC)

• Reporting to stakeholders on security incidents and remediation efforts

Related content: Read our guide to Splunk Enterprise Security

4. Splunk Infrastructure Monitoring

Splunk Infrastructure Monitoring auto-discovers the IT stack and integrates with hundreds of platforms and solutions to ingest operational data. It supports hybrid cloud and multi-cloud, and enables real-time monitoring of large scale environments.

Key features include:

• Real-time streaming analytics—ingests, analyzes, and alerts on issues as they happen, leveraging a streaming architecture (unlike traditional analytics systems that process data in batches).

• Full-stack observability—correlates between cloud systems and the applications and microservices that run on them. The solution provides visibility into application-level issues and infrastructure-level issues (such as problems with VMs or containers), and provides direct access to logs to enable troubleshooting.

5. Splunk Mission Control

Splunk Mission Control is a platform that enables management of security operations efforts. It is a SaaS-based solution that lets security teams detect, manage, hunt, and mitigate threats from one interface. It is fully integrated with Splunk Enterprise Security.

Key features include:

• Unified interface—enables detecting and responding to incidents without switching between multiple tools. The solution supports security data visualization, advanced analytics and security operations in one platform.

• Plug-in framework—lets you plug in existing security tools, enabling security teams to operate and orchestrate them from the Mission Control interface.

6. Splunk Application Performance Monitoring (Splunk APM)

Splunk APM provides performance monitoring and troubleshooting for cloud native applications. It provides high fidelity tracing based on 100% of data, and enables real-time alerting via the Splunk streaming architecture.

Key features include:

• AI-driven detection and alerts—performs automated analysis of trace metrics such as latency and error rate to detect anomalies and provide accurate service-level alerts.

• Data links—enables construction of workflows that use metrics, traces, and logs to troubleshoot performance issues.

• Dashboards—enable visualization of metrics and traces, drawing data from Splunk’s log analytics solution.

• Auto-instrumentation—automatically enables monitoring for code written in popular languages including Java, Python, Node.js, and PHP.

• Root cause error mapping—automatically indicates whether errors originate from microservices or downstream services, using AI-driven troubleshooting.

7. Splunk IT Service Intelligence (Splunk ITSI)

Splunk IT Service Intelligence (ITSI) collects data from IT services and predicts incidents before they happen. It performs real-time predictive analytics on operational data based on machine learning.

Key features include:

• Service analyzer dashboard—shows tile or tree views of IT services to visualize the environment, enabling drill down to identify root causes directly from the dashboard.

• Predictive Analytics—predicts incidents 30 minutes before they happen using historical service health data, and shows the top five service metrics contributing to the problem to assist with troubleshooting.

• Anomaly detection—learns patterns on an ongoing basis and uses them to identify unexpected behavior.

• Intelligent event management—allows teams to collect events from multiple sources and correlate them into one incident, using event correlation and automated noise reduction.

• Fixed and adaptive thresholding—enables alerting on behavior that goes above a fixed or automatically adapting threshold, determined by machine learning algorithms.

8. Splunk User Behavior Analytics (UBA)

Splunk UBA can discover hidden threats by establishing behavioral baselines for users, devices, and applications, and identifying anomalies even if they don’t meet any known threat pattern.

Key features include:

• Insider threat detection using purpose-built, extensive unsupervised machine learning algorithms

• Adding context to alerts using anomaly correlation and “stitching” of multiple anomalies to construct an attack timeline.

• Prioritizing threats by ranking alerts by severity and providing supporting evidence for fast triage.

• Bi-directional integration with Splunk Enterprise and Splunk ES enables data ingestion and correlation, workflow management, and response automation.

How to Secure Splunk Data

Another aspect of Splunk security is securing the Splunk platform itself. Splunk manages and accesses huge volumes of potentially sensitive data. Here are a few ways you can secure the platform and the data it stores:

• Preventing unauthorized access—Splunk provides role-based access control (RBAC), data encryption, and obfuscation of credentials to combat account takeover.

• SSL encryption—Splunk offers secure channels for configurations, data ingestion points, data storage, Splunk Web connections, and internal Splunk communications.

• Hardening Splunk instances—ensure that Splunk instances are physically secure, credentials are not stored in plaintext, and RBAC is set up.

• Auditing—leverage audit events to track what is changing in a Splunk system’s configuration. Use audit events to identify who made a change, where, and when. Regular auditing makes it possible to discover security issues early and respond, and is also useful for meeting compliance requirements.