Department of State Splunk Factsheet
Total Page：16
File Type：pdf, Size：1020Kb
dsdddd Department of State Splunk Factsheet What is Splunk? • Human Resources (HR Bureau) • International Narcotics and Law Enforcement (INL) Splunk software provides you with an engine • Information Resources Management (IRM) that helps in monitoring, searching, correlating, • Legal Bureau (L) analyzing, and visualizing large amounts of data. • Overseas Building Operations Bureau (OBO) Splunk is an advanced technology which • Office of Inspector General (OIG) searches any machine data captured from any • Bureau of Population and Refugee Management (PRM) system, app, or other data source. The industry • Secretaries Executive Secretariat (S/ES) leader for IT Operations and IT Security, Splunk • Trade Bureau / Non-proliferation has also many mission focused uses and it does • T/ISN not suffer from the same legacy shortcomings of • T/NRRC similar technologies that use SQL or relational databases, manual connectors or limited data What kinds of questions can import controls. Splunk can also be deployed to Splunk help answer? an existing cloud, which makes it highly scalable IT Operations and reliable. How do I provide more transparency around IT Splunk helps the Department mature from operations to customers and better predict reactive to proactive, and eventually to service-level degradation before they impact predictive – eliminating or avoiding issues before mission? they occur and affording managers the Application Performance and DevOps opportunity to better control their time and resources to maximum effect and impact. Is my poor app performance due to code-level errors or infrastructure? Where are the integrations between Which Offices and Divisions Use my app and other centralized IT components (e.g. Splunk? network, Active Directory, etc.) Can Dev team’s debug Code without working with Ops? • Bureau of Administration (A Bureau) • A/ILMS Security and Compliance • A/OPE/RAM How can I augment security investigations to be • Consular Affairs (CA) more efficient and effective and reduce the • CA/CST impact of insider threats? • Charleston Government Financial Services (CGFS) Mission and Overseas Analytics • CGFS/ISSO Can I use data to drive my mission decisions, improve business intelligence, and empower better decision-making. • CGFS/EX • Diplomatic Security (DS) Automation and Orchestration • DS/CTS Where can I leverage out of the box (and custom) playbooks, • DS/CTO runbooks, and other Machine Learning and Artificial Intelligence • DS/ST capabilities to enhance productivity and realize ROI. • 10+ individual embassies • Foreign Assistance (F Bureau) TECH BRIEF What Other Splunk Capabilities Splunk Lantern - A knowledge base lights the Are Available to DOS? way with comprehensive guidance for any Enterprise Security App – Splunk Enterprise use case, any task, and any objective. Search Security is the nerve center of the cybersecurity for help with a specific scenario or ecosystem, giving teams the insight to quickly requirement you are faced with or browse the detect and respond to internal and external attacks, categories below for ideas on how you can simplify threat management minimizing risk. ES benefit from your data. Everyone in your helps teams gain organization-wide visibility and organization from the CEO to a novice security intelligence for continuous monitoring, incident responder, case agent and intel incident response, SOC operations, and providing analyst. executives a window into business risk. IT Service Intelligence App – Leverage machine learning, adaptive thresholds, and mission and business oriented Key Performance Indicators to created service models that visualize an entire tech stack or provide real-time predictive insights into an entire ecosystem. Create a platform for true operational intelligence. Splunk Phantom – A security orchestration, automation and response (SOAR) platform designed to help organizations dramatically scale their security operations. With Phantom, you can automate tasks, orchestrate workflows and support a broad range of SOC functions including event and case management, collaboration and reporting. Splunk User Behavior Analytics (UBA) – A machine learning-driven solution that helps organizations find hidden threats and anomalous behavior across users, devices and applications. Its data science driven approach produces actionable results with risk ratings and supporting evidence, augmenting Special Agents and Intelligence Analysts’ existing techniques. AIOps/Machine Learning – Is the practice of applying analytics and machine learning to big data to automate and improve IT operations. AI can automatically analyze massive amounts of network and machine data to find patterns, both to identify the cause of existing problems and to predict and prevent future ones. DOS Enterprise Splunk Factsheet 2 TECH BRIEF DOS ELA Products and Services Products & Services Description Notes Splunk Enterprise (Core) w/ Standard 50,000 GB / Day, Term 5-Term Years Support Entitlements Splunk Enterprise Security (ES) 15,000 GB / Day, Term 5-Term Years Splunk IT Service Intelligence (ITSI) 10,000 GB / Day, Term 5-Term Years Splunk User Behavior Analytics 120k entities, Term 5-Term Years Splunk Phantom Automation and Unlimited, Term 5-Term Years Orchestration Splunk Fundamentals Part 1 and Instruction On Demand Free Training Part 2 (through 9/30/2021) (IOD) Subscription, One Splunk Fundamentals 1: year, once class per https://www.splunk.com/en_us/ student (30-days) training/courses/splunk-fundamentals-1.html Splunk Fundamentals 2: https://www.splunk. com/en_us/training/courses/splunk- fundamentals-2.html Splunk Success Program Description Splunk Dedicated Customer Dedicated agency advocate and business advisor, responsible for helping Success Manager customers define use cases, drive adoption, realize value, and overcome obstacles with Splunk Splunk OnDemand Services 39 credits / quarter. Remote consultative services to support platform or specialty IT Ops, IT Security needs. Splunk Adoption Services Tailored professional services focused on Customer Success / Adoption .conf Event Passes Passes for .conf Event & Splunk University Splunk Professional Services Descriptions DOS Enterprise Splunk Factsheet 3 TECH BRIEF Splunk EDU Services and Recommend Classes SKU Class Name Duration N/A Fundamentals 1 Self-paced EDU-FUN2* Fundamentals 2 Four 4.5-hour days 1) Power User EDU-CDSH Creating Dashboards Two 4.5-hour days EDU-ADSRPT-1 Advanced SearchinG and ReportinG Three 4.5-hour days EDU-SADM Splunk Enterprise System Admin Two 4.5 hour days 2) Admin and Users EDU-DADM Splunk Enterprise Data Admin Three 4.5-hour days EDU-DEPL ArchitectinG Splunk Enterprise Deployments Two 4.5-hour days EDU-ICESS-1 AdministerinG Enterprise Security Deployments Three 4.5-hour days Specialists EDU-UESS-1 UsinG Splunk Enterprise Security Three 4.5-hour days and EDU-ITSI ImplementinG Splunk ITSI Four 4.5-hour days Premium App EDU-UITSI UsinG Splunk ITSI One 4.5-hour days coming soon AdministerinG Phantom Two 4.5-hour days EDU-DPHT DevelopinG Phantom Playbooks Two 4.5-hour days N/A Splunk UBA Self-paced EDU-CLDADM Splunk Cloud Administration Three 4.5-hour days *Fundamentals II Class Subscription is available to all DOS Users DOS Splunk FAQs How do I start using Splunk? Using Splunk is dependent on whether or not your program wants to stand up their own Splunk instance or take advantage of an existing or enterprise Splunk environment. For example, if your program wants to take advantage of an existing Splunk instance - IRM has developed an enterprise platform: IRM Splunk Data Analytics for IT Operations (DAFI). IRM Splunk is available to those in the Department who wants to use Splunk on the enterprise unclassified SBU network - OpenNet. Classified Splunk is part of the roadmap for the future. As IRM matures their enterprise instance of Splunk, that platform will serve any customers that choose to take advantage of the service, allowing bureaus or programs to send data (e.g. application logs) and benefit from integration with enterprise datasets (e.g. network and active directory) while IRM would also deliver the Splunk ‘platform’ (to include administering and maintaining the Splunk server and storage environment). DOS Enterprise Splunk Factsheet 4 TECH BRIEF If a program wants to leverage the IRM Splunk, how will IRM support requests for specific program dashboards, additional Splunk apps, assistance with Splunk searches, and data ingestion issues? In the short term, the best way to accomplish this goal would be for a given program to purchase their own Splunk professional services. IRM will have a small team who will be working these types of requests and issues based on priority, but they will be primarily focused on enterprise data sets and dashboards (especially at the beginning). Additional details on obtaining Splunk professional services via the Splunk PS BPA can be found below. How much does Splunk cost? Example costs associated with operating an individual Splunk instance include Splunk software license, infrastructure (physical or virtual machines, or cloud IaaS), and trained resources who can admin and operate the Splunk platform. In FY19 the Department signed an Enterprise License Agreement for Splunk license. This ELA provides anyone in the Department a single acquisitions vehicle for procuring Splunk software licenses and benefits all with discounts through bulk purchasing economies of scale. More details on the ELA (including a cost calculator to obtain your own Splunk license for your own Splunk instance) can