Autodesk is strengthening its operations with Splunk and AWS by using CloudTrail to log API calls across its AWS accounts and sending the logs to Splunk. This provides Autodesk with a single view of activity across all accounts for security monitoring, compliance auditing, and troubleshooting. Specifically, Autodesk can search logs to investigate incidents, identify compromised hosts, and monitor sign-in locations for security. For compliance, Autodesk can set alerts on sensitive API calls and user creations. Using CloudTrail and Splunk provides Autodesk with a scalable, cost-effective logging solution.

1. Learn how Autodesk is strengthening its operations with
Splunk and AWS
Big Data Solution Showcase
Watch on demand webinar: https://connect.awswebcasts.com/p2u35o8z8ir/

2. Introductions
• Praveen Rangnath
– Director of Cloud Product Marketing, Splunk
• Alan Williams
– Principal Engineer, Autodesk
• Rahul Bhartia
– Solution Architect, Amazon Web Services

3. Agenda
• AWS Cloud
• Splunk: Overview
• Machine Data and Splunk
• Autodesk: Splunk & AWS CloudTrail
• Summary
• Q&A

4. Big Data
Technologies and techniques for working
productively with data, at any scale.

5. Big data Cloud computing
Big data and AWS Cloud computing
• Variety, volume, and velocity
requiring new tools
• Potentially massive datasets
• Iterative, experimental style of data
manipulation and analysis
• Frequently not steady-state
workload; peaks and valleys
• Variety of compute, storage, and
networking options
• Massive, virtually unlimited capacity
• Iterative, experimental style of
infrastructure deployment/usage
• Elasticity for highly variable
workloads

6. AWS Data Services
S3 RDS Redshift DynamoDB EMR Kinesis
Data
Velocity
Variety
Volume
Structured, Unstructured, Text, Binary
Gigabytes, Terabytes, Petabytes
Millisecond, Second, Minute, Hour, Day
Data Pipeline Elasticache

7. Customer segmentation
Marketing spend optimization
Financial modeling & forecasting
Ad targeting & real time bidding
Clickstream analysis
Security and Compliance
Use Cases

8. AWS CloudTrail – Security at scale
Increase your visibility of what
happened in your AWS
environment – who did what and
when, from where
• Record access to API calls and save logs in your S3 buckets
• Be notified of log file delivery using the AWS Simple Notification Service
• Many AWS services including EC2, EBS, VPC, RDS, IAM, STS and Redshift
• Aggregate log information into a single S3 bucket

9. AWS CloudTrail logs use cases
Security Analysis - Perform security
analysis and to detect user behavior
patterns
Track Changes – Monitor creation,
modification, and deletion of AWS
resources
Compliance Aid - Ensure compliance with
internal policies and regulatory standards
by providing AWS API call history
Troubleshoot Operational Issues -
Quickly identify the most recent changes
made to resources in your environment

10. http://aws.amazon.com/mar
ketplace
Big Data Case Studies
Learn from other AWS customers
aws.amazon.com/solutions/case-studies/big-data

12. Splunk –Company Overview
Company (NASDAQ: SPLK)
Founded 2004, first software release in 2006
HQ: San Francisco / Regional HQ: London, Hong Kong
Over 1,000 employees, based in 12 countries
FY 2014 Revenue: $302M (YoY+52%)
Business Model / Products
Free download / AMI / Online Sandbox
Splunk Enterprise, Splunk Cloud
Hunk: Splunk Analytics for Hadoop
7,900+ Customers
Customers in over 100 countries
More than 2/3 of the Fortune 100
Largest license: Over 100 Terabytes per day
Mission: Make machine data accessible, usable, and valuable to everyone
12

13. What is Machine Data?
Volume | Velocity| Variety | Variability
GPS,
RFID,
Hypervisor,
Web Servers,
Email, Messaging,
Clickstreams, Mobile,
Telephony, IVR, Databases,
Sensors, Telematics, Storage,
Servers, Security Devices, AWS CloudTrail
Machinedatais the fastest growing, most complex, most valuable area of big data

14. What Does Machine Data Look Like?
14
Sources
Twitter
Care IVR
Middleware Error
Order Processing

15. Machine Data Contains Critical Insights
15
Customer ID
Order ID
Customer’s Tweet
Time Waiting On Hold
Twitter ID
Product ID
Company’s Twitter ID
Sources
Twitter
Care IVR
Middleware Error
Order Processing
Customer ID
Order ID
Customer ID

16. Machine Data Contains Critical Insights
16
Order ID
Customer’s Tweet
Time Waiting On Hold
Product ID
Company’s Twitter ID
Sources
Twitter
Care IVR
Middleware Error
Order Processing
Order ID
Customer ID
Twitter ID
Customer ID
Customer ID

17. IT
Operations
Security and Compliance
Digital Intelligence
App Devand
App Mgmt.
Developer Platform (REST API, SDKs)
Business Analytics
Industrial Data and Internet of Things
Small Data. Big Data. Huge Data.
Use Cases for Machine Data Analytics
17
Core Use Cases
Emerging Use Cases

18. Industry Leading Platform For Machine Data
Machine Data: Any Location, Type, Volume
Online Services
Web Services
Servers
Security
GPS Location
Storage
Desktops
Networks
Packaged Applications
Custom
Applications
Messaging
Telecoms
Online Shopping Cart
Web Clickstreams
Databases
Energy Meters
Call Detail Records
Smartphones and Devices
RFID
On-
Premises
Private Cloud
Public Cloud
Platform Support (Apps / API / SDKs)
Enterprise Scalability
Universal Indexing
Answer Any Question
DeveloperPlatform
Report and analyze
Custom dashboards
Monitor and alert
Ad hoc search

19. Comprehensive Cloud Solutions
19
Software-as-a-Service Self-managed software
Apps for AWS Integrations
CloudTrail ELB Billing
Amazon Machine Images
Hunk – EMR Integration

20. © 2014 Autodesk
Strengthening Operations with
Splunk and AWS CloudTrail
Alan Williams
alanwillon Twitter & GitHub
Principal Engineer

21. © 2014 Autodesk
Engineer @ Autodesk
Technology Generalist
Background in Infrastructure
AWS for ~4 years
Splunk for ~1 year
Motorcyclist
Soft spot for pit bulls
Who Am I?

22. © 2014 Autodesk
Leader in 3D design, engineering and entertainment software
Introduced AutoCAD in 1982
Empowering the Maker movement
Help our customers imagine, design and create a better world
Who is Autodesk?
http://www.autodesk.com/products/personal-design-and-creativity

23. © 2014 Autodesk
How do we know what’s happening in our accounts?
Malicious activity?
How can we validate that we’re compliant?
Problem

24. © 2014 Autodesk

25. © 2014 Autodesk
+

26. © 2014 Autodesk
Leverage existing investment
Standard log aggregation platform
Splunk App for AWS (http://goo.gl/Xc7XsZ)
Familiar technology
Logging = Splunk
Supports logging REST endpoints
SQS & S3
Single view across all accounts
Why Splunk?

27. © 2014 Autodesk
CloudTrail + Splunk Architecture
SNS Topic
SQS Queue
CloudTrail
S3 Bucket
CloudTrail SNS Topic
1 1
2 2
3 3
4 4
5
Account A Account B
Core Services Account
 Simple to configure
 Scalable to many accounts
 Central logging view across
all accounts

28. © 2014 Autodesk
Incident Response
Operations Troubleshooting
Compliance Auditing
CloudTrailUse Cases

29. © 2014 Autodesk
Something happened in Account X between a certain time window
Has this compromised host made any API calls?
Where have these IAM keys been used?
Incident Response

30. © 2014 Autodesk
Something happened in Account X between a certain time window

31. © 2014 Autodesk
Has this compromised host made any API calls?

32. © 2014 Autodesk
Where have these IAM keys been used?

33. © 2014 Autodesk
Who created this instance?
Where in the world are sign-ins originating?
Operations Troubleshooting

34. © 2014 Autodesk
Who created this instance?

35. © 2014 Autodesk
Where in the world are sign-ins originating?

36. © 2014 Autodesk
Alert if an SG rule is created with 0.0.0.0/0 rule
Frequency of certain events
Alert whenever an IAM user is created
Compliance Auditing

37. © 2014 Autodesk
Alert if an SG rule is created with 0.0.0.0/0 rule

38. © 2014 Autodesk
Alert whenever an IAM user is created

39. © 2014 Autodesk
AWS CloudTrail+ Splunk = Happy Marriage
Scalable to 100s of accounts
Toolset for Operations and Security Teams
Our common use cases with examples
Summary

40. Autodesk is a registered trademark of Autodesk, Inc., and/or its subsidiaries and/or affiliates in the USA and/or other countries. All other brand names, product names, or trademarks belong to their respective holders. Autodesk reserves the right to alter product and services offerings, and specifications and pricingatany time without notice, and is not responsible for typographical or graphical errors that may appear in this document.
© 2014 Autodesk. All rights reserved.
@alanwillalanwill

41. Splunk Demo (5 min)

42. Easy To Get Started
42
Click here

43. Free Download or Online Sandbox
43

44. Thank you!
https://aws.amazon.com/big-data
https://aws.amazon.com/compliance
https://aws.amazon.com/security