Long Term Reporting with Savvius and Splunk

20
© SAVVIUS, INC | www.savvius.com Show us your tweets! Use today’s event hashtag: #savvius_splunk with any questions, comments, or feedback. Follow us @SavviusInc Chris Bloom Technology Evangelist, Savvius Inc [email protected] Follow me @spacepacket Long Term Reporting with Savvius and Splunk June 24, 2015

TAGS:

Transcript of Long Term Reporting with Savvius and Splunk

Page 1: Long Term Reporting with Savvius and Splunk

© S A V V I U S , I N C | w w w . s a v v i u s . c o m

Show us your tweets!Use today’s event hashtag: #savvius_splunk

with any questions, comments, or feedback.

Follow us @SavviusInc

C h r i s B l o o m

Technology Evangelist, Savvius Inc

[email protected]

Follow me @spacepacket

Long Term Reporting with Savvius and Splunk

June 24, 2015

Page 2: Long Term Reporting with Savvius and Splunk

© S A V V I U S , I N C#savvius_splunk Long Term Reporting with Savvius and Splunk

Administration

• The session is intended to be hands on – not always easy on Webex

• All attendees are on mute- If you have problems, please let us know via the Webex Chat window

• Please ask questions!- Feel free to type a question at any time- A Savvius moderator will be constantly looking for questions so they can

be answered at the end of the session

Page 3: Long Term Reporting with Savvius and Splunk

© S A V V I U S , I N C#savvius_splunk Long Term Reporting with Savvius and Splunk

Agenda

• Introduction to Savvius

• Data Acquisition

• Long term reporting with Savvius + Splunk

• Benefits

• Architecture

• Dashboards

• Demo

• Questions and Answers

3

Page 4: Long Term Reporting with Savvius and Splunk

Product Use Traffic Environment Storage

Omnipliance Packet Capture for Troubleshooting

Up to 16.5 Gbps

Data centers, remote offices

4-128 TB

OmniplianceWiFi

WLAN troubleshooting including 802.11ac

Up to 3.8 Gbps Enterprise WLAN 8TB

Savvius VigilLong-term packet

storage for security investigations

IDS performance up to 9 Gbps

Cybersecurity infrastructure

64 or128 TB

OmniPeek Professional

Software for Analytics and Troubleshooting

Platform Dependent

Portable Network Analysis

N/A

OmniPeek Enterprise

High performancesoftware for Analytics and Troubleshooting

Platform Dependent

Network Analysis N/A

Capture EngineFor OmniPeek

Software for remote troubleshootingand analysis

Platform Dependent

DistributedPlatform Dependent

USB WiFi Adapter for OmniPeek

WLAN adapter for portable analysis

200Mbps Portable N/A

Savvius Solutions

Page 5: Long Term Reporting with Savvius and Splunk

Corporate Overview

Actionable Insight+

Page 6: Long Term Reporting with Savvius and Splunk

Corporate Overview

• Omnipliances analyze network traffic• Splunk aggregates the Omnipliance analytics• Savvius Splunk App provides analysis dashboards

Long-term Reporting Solution

Page 7: Long Term Reporting with Savvius and Splunk

Corporate Overview 7

Omnipliance + Splunk:• Provides long term reporting and alerting• Leverages Savvius extensive analysis capabilities• Integrates analytics from multiple Omnipliances

Big Data benefits:• Operational Intelligence• Actionable insights• Business Analytics

Benefits

Page 8: Long Term Reporting with Savvius and Splunk

Corporate Overview 8

The Platform• Scalability• Analytics• Cloud

The Ecosystem• Ubiquitous• Over 600 Apps• Passionate

The Applications• Web based• Dashboards• Customizable

Page 9: Long Term Reporting with Savvius and Splunk

Corporate Overview 9

Select any time range

Select any Omnipliance

Long Term Reporting and Aggregation

Page 10: Long Term Reporting with Savvius and Splunk

Corporate Overview 10

Architecture Diagram

Page 11: Long Term Reporting with Savvius and Splunk

Corporate Overview 11

Network Dashboards

Top Talkers

Latency

Flows

Protocols

Events

Summary Statistics

Page 12: Long Term Reporting with Savvius and Splunk

Corporate Overview 12WildPackets Splunk App

Security Dashboards

Page 13: Long Term Reporting with Savvius and Splunk

Corporate Overview 13

VOIP Dashboards

Call Volume

Open Calls

Call Duration

MOS Scores

Jitter

Codecs

Page 14: Long Term Reporting with Savvius and Splunk

Corporate Overview 14

Where is the traffic coming from?

Location Dashboards

Page 15: Long Term Reporting with Savvius and Splunk

Corporate Overview 15WildPackets Splunk App

Baseline Dashboards

Compare any time to any other time

Page 16: Long Term Reporting with Savvius and Splunk

Corporate Overview 16

Forecast trends into the future

Predictive Analytics

Page 17: Long Term Reporting with Savvius and Splunk

Corporate Overview 17

Alert on virtually anything!

Alerting, Alarming, and Notifications

Page 18: Long Term Reporting with Savvius and Splunk

Corporate Overview 18

It’s Mobile!

Page 19: Long Term Reporting with Savvius and Splunk

Corporate Overview

Page 20: Long Term Reporting with Savvius and Splunk

Corporate Overview

Network insight for performance and security

Thank you!


Introducing Savvius Vigil

Introducing Savvius Vigil

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

How can Savvius help your organization?

How can Savvius help your organization?

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

CANARIE free eLearning registration 20170331...• Searching and Reporting with Splunk (eLearning) • Creating Splunk Knowledge Objects (eLearning) • Splunk Infrastructure Overview

CANARIE free eLearning registration 20170331...• Searching and Reporting with Splunk (eLearning) • Creating Splunk Knowledge Objects (eLearning) • Splunk Infrastructure Overview

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Splunk - riversafe.co.uk · • Application of Splunk best practices • Splunk ES / ITSI / PCI / Exchange optimisation REPORTING: • Report on the findings along with recommendations

Splunk - riversafe.co.uk · • Application of Splunk best practices • Splunk ES / ITSI / PCI / Exchange optimisation REPORTING: • Report on the findings along with recommendations

Savvius is Integrated with ELK · Web viewFor remote locations, Savvius Insight provides a host of network troubleshooting capabilities and benefits tailored to the needs of highly-distributed

Savvius is Integrated with ELK · Web viewFor remote locations, Savvius Insight provides a host of network troubleshooting capabilities and benefits tailored to the needs of highly-distributed

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Cisco Web Security Appliance Advanced Reporting ... · Set Cisco WSA Advanced Reporting as the default app for all users/roles. docs.splunk.com (Optional) Enable SSL within Splunk.

Cisco Web Security Appliance Advanced Reporting ... · Set Cisco WSA Advanced Reporting as the default app for all users/roles. docs.splunk.com (Optional) Enable SSL within Splunk.

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers.

Splunk Validated Architectures · Splunk Engineers Responsible for managing the Splunk lifecycle. Managed Service Providers Entities that deploy and run Splunk as a service for customers.

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for