AGENDA OPTIONAL PRE-CONFERENCE INTRODUCTION TO PALANTIR 8:30-9:30 PALANTIR 101 New to Palantir? This special pre-conference session will SALON cover the basics. Additionally, please see page 6 for the on- site training schedule. MAIN SESSIONS 10:00 WELCOME AND INTRODUCTION SALON Dr. Alex Karp, CEO, Palantir 10:10 HUNTING ADVANCED PERSISTENT THREATS IN CYBERSPACE SALON Rafal Rohozinski, Principal and CEO, SecDev Group Nart Villeneuve, Chief Security Officer, SecDev Group 10:50 USING PALANTIR TO ANALYZE IRANIAN GLOBAL INFLUENCE SALON Doug Philippone, Palantir 11:30 SIGINT & PALANTIR: THE FUSION OF TARGET DATA, REPORTING AND TRAFFIC SALON Trae Stephens, Forward Deployed Engineer, Palantir 12:00-13:00 LUNCH & DEMOS FOYER 13:15 USING PALANTIR WITH OPEN SOURCE DATA: FINDING AND PREVENTING FRAUD IN STIMULUS SPENDING SALON Douglas R. Hassebrock, Assistant Director, Investigations, Recovery Accountability and Transparency Board Alex Fishman, Forward Deployed Engineer, Palantir 13:45 WHAT’S NEW IN PALANTIR GOVERNMENT 2.4 SALON Bob McGrew, Director of Engineering, Palantir 14:15 ATTACK THE NETWORK SALON Bruce Parkman, CEO, NEK Advanced Securities Group 14:45-15:00 COFFEE BREAK FOYER 4 AGENDA CHOOSE YOUR NEXT SESSION - PART ONE 15:00-15:40 CYBER SECURITY ANALYSIS IN PALANTIR SALON Geoffrey Stowe, Forward Deployed Engineer, Palantir 15:00-15:40 PROTECTING PRIVACY AND CIVIL LIBERTIES WITH COMMERCIALLY AVAILABLE TECHNOLOGY PLAZA Bryan Cunningham, Senior Counsel and Advisory Board Member, Palantir 15:00-15:40 MANAGING A COMPLEX DISTRIBUTED SYSTEM: MADE SIMPLE IN PALANTIR COLONNADE Frank-Robert Kline, Software Engineer, Palantir Khan Tasinga, Software Engineer, Palantir CHOOSE YOUR NEXT SESSION - PART TWO 15:50-16:30 PROJECT HORIZON: EXPLORING BIG DATA SALON John Garrod, Software Engineer, Palantir Will Barley, Forward Deployed Engineer, Palantir 15:50-16:30 ICD 501: MULTI-LEVEL SECURITY ENABLED BY PALANTIR PLAZA Asher Sinensky, PhD, Palantir 15:50-16:30 PALANTIR EXTENSIBILITY: USING CUSTOM INTEGRATIONS TO ENRICH ANALYTIC WORKFLOWS COLONNADE Lawrence Jesper, Forward Deployed Engineer, Palantir Bryan Knight, Developer Support Engineer, Palantir Robin Lim, Forward Deployed Engineer, Palantir COCKTAIL HOUR 16:30-18:00 COCKTAIL HOUR SPONSORED BY NEK FOYER Please join us for drinks and appetizers in the foyer. 5 ON-SITE TRAINING SCHEDULE 8:30-9:45 INTRO TO PALANTIR WORKSPACE ATTACHÉ (PRE-CONFERENCE) 8:30-9:45 INTRO TO PALANTIR WORKSPACE CONSULATE (PRE-CONFERENCE) 10:15–11:30 INTRO TO PALANTIR WORKSPACE ATTACHÉ 10:15–11:30 USING PALANTIR FOR GEOSPATIAL ANALYSIS CONSULATE 12:30– 13:45 INTRO TO PALANTIR WORKSPACE ATTACHÉ 12:30– 13:45 ENTITY EXTRACTION AND TAGGING CONSULATE USING PALANTIR 14:15– 15:30 USING PALANTIR FOR GEOSPATIAL ATTACHÉ ANALYSIS 14:15– 15:30 ENTITY EXTRACTION AND TAGGING CONSULATE USING PALANTIR AMBASSADOR LOUNGE We invite you to relax and enjoy complimentary snacks and refreshments throughout the day in the Ambassador Lounge on the 6th floor. 6 CONFERENCE MAP RITZ-CARLTON - 5TH FLOOR REGISTRATION ELEVATORS SALON RITZ-CARLTON - 6TH FLOOR AMBASSADOR COLONNADE PLAZA CONSULATE ATTACHÉ 7 SESSION TOPICS NEW TO PALANTIR? PALANTIR PLATFORM 101 Saad Abdali, Forward Deployed Engineer, Palantir For those who are completely new to the Palantir platform or could simply use a refresher, this talk will start from scratch and provide a broad overview of Palantir's origins and mission. A live demonstration of the product will help to familiarize newcomers with Palantir's intuitive graphical interface and revolutionary analytical functionality while highlighting the major engineering innovations that make it all possible. HUNTING ADVANCED PERSISTENT THREATS IN CYBERSPACE Rafal Rohozinski, Principal and CEO, SecDev Group Nart Villeneuve, Chief Security Officer, SecDev Group Successful cyber investigations require an ability to piece together disparate technical and contextual datasources to develop a comprehensive picture of an adversary and their methods of attack. In this session, a complex and recent high profile investigation will be walked through, from within Palantir, and in the process present some insights into the state of the art of hunting and killing advanced persistent threats in the cyber domain. USING PALANTIR TO ANALYZE IRANIAN GLOBAL INFLUENCE Doug Philippone, Palantir Iran poses a unique challenge to our national defense, they are actively involved as an adversary to United States interests at the tactical, operational, strategic, and political levels. Iran is expanding its influence into Iraq, Afghanistan, Latin America, has aspirations to become a Nuclear power while sponsoring global terrorism through its surrogate, Hezbollah. In light of these issues, Palantir has worked closely with researchers and open source information to help understand Iran, its alliances and economic dependencies, military strengths and projects to help better understand this important player on the world stage. SIGINT & PALANTIR: THE FUSION OF TARGET DATA, REPORTING AND TRAFFIC Trae Stephens, Forward Deployed Engineer, Palantir SIGINT analysts are often derided as relying exclusively on the “traffic fairy” – trolling raw traffic databases for new knowledge. However, SIGINT analysts tap into a variety of sources outside of traffic to build their products that are distributed across the community. Potential targets are vetted prior to collection, which involves a significant amount of All-Source persona based analysis. Palantir is the ideal infrastructure for tracking this target development & knowledge and merging this analysis with metadata critical to SIGINT workflows. 9 SESSION TOPICS USING PALANTIR WITH OPEN SOURCE DATA: FINDING AND PREVENTING FRAUD IN STIMULUS SPENDING Douglas R. Hassebrock, Assistant Director, Investigations, Recovery Accountability and Transparency Board Alex Fishman, Forward Deployed Engineer, Palantir The American Recovery and Reinvestment Act (HR.1) established the Recovery Accountability and Transparency Board to prevent and detect fraud, waste and abuse in Stimulus Spending. Analysts use Palantir to carry out their mission by fusing open source and transactional data sets to find anomalous spending patterns. Once anomalous behavior has been discovered analysts link the corporate entities and individuals associated with the fraud to build a target package for investigation and prosecution by the appropriate agencies in the oversight community. The Board captures its analytical experience by building predictive models in Palantir that agencies use to better allocate resources to combat fraud. WHAT'S NEW IN PALANTIR GOVERNMENT 2.4 Bob McGrew, Director of Engineering, Palantir We are pleased to announce the release of Palantir Government version 2.4. In this release we had one major focus – enabling the Palantir community. We did by enabling the analyst through improved data scale, improved collaborative functions and a wide range of usability enhancements. We also did this by enabling the Palantir administrator through the addition of new administrative interfaces and numerous administrative usability enhancements. All these changes were driven directly by user feedback which continues to be the most important way that we prioritize product development. Together we have built the best Palantir iteration yet and we are extremely excited to share it with all of you. ATTACK THE NETWORK Bruce Parkman, CEO, NEK Advanced Securities Group NEK’s “Attack the Network Course” was developed in order to provide analysts, operators and decision makers the tools and training necessary to quickly identify, isolate and destroy enemy networks. NEK understands that in order to gain a comprehensive understanding of one’s operational environment a robust analytical system combined with instructors and mentors possessing relevant training and experience are required. NEK combines the latest software platforms, including Palantir, with up to date TTP’s in the fields of analysis, and tactical/sensitive site exploitation both CONUS and OCONUS in order to 10 SESSION TOPICS provide the timely and accurate information required to conduct effects based operations. NEK’s experience makes us the ideal candidate for supporting a wide array of defense, intelligence and law enforcement requirements across the full spectrum of military and law enforcement operations. CYBER SECURITY ANALYSIS IN PALANTIR Geoffrey Stowe, Forward Deployed Engineer, Palantir Palantir brings the same rich analytic framework designed for all-source intelligence applications to address the knowledge management and data enrichment needs of the CI, CNO, and SOC/CERT communities. This talk will cover ways of modeling network events, open source repositories of cyber data, and analytical best practices. The examples will center around analyzing spear- phishing and detecting malware. PROTECTING PRIVACY AND CIVIL LIBERTIES WITH COMMERCIALLY AVAILABLE TECHNOLOGY Bryan Cunningham, Senior Counsel and Advisory Board member, Palantir. Information Security andPrivacy Lawyer. Privacy and Civil Liberties expert and Markle Foundation Task Force Member Bryan Cunningham will dispel lingering myths of legal and regulatory "barriers" still preventing analysts and operators from fighting terrorism. Bryan will discuss specific laws and regulations often misunderstood to be barriers to collaboration and how commercially available technology can simultaneously enable our operators and analysts to most effectively defeat our adversaries and protect our cherished liberties, both in the bricks and mortar