This document discusses how organizations can use big data and operational analytics to transform IT operations. It outlines how taking a data-driven approach that combines machine data and wire data can provide real-time visibility across networks, applications, databases and other systems. This approach overcomes limitations of using individual monitoring tools by silo. The document also covers key considerations for implementing IT big data solutions such as data gravity, improving the signal-to-noise ratio, and understanding when data needs to be accessed in real-time. It provides an example of how healthcare company McKesson used network traffic analysis to improve Citrix application performance and reduce IT costs.

1. How to Use Big Data to
Transform IT Operations
Jesse Rothstein, CEO, ExtraHop
Doug McMartin, Director of Product Development Standards, McKesson

2. Introduction
Doug McMartin
Director of Product Development Standards
Jesse Rothstein
CEO
Data Gravity
Signal-to-Noise
Motion of Data

3. Agenda
• The next-generation IT Big Data approach
• Moving toward real-time observational
data
• Key considerations for IT Big Data
• IT Big Data use cases
• Q&A

4. A Tool-Centric Approach = IT Silos
Network
Administrators
Virtualization
Team
Database
Administrators
VDI
Administrators
Application
Owners
Business
Analysts
Storage
Administrators
Security
Operations

5. A Tool-Centric Approach = IT Silos
Network
Administrators
Virtualization
Team
Database
Administrators
VDI
Administrators
Application
Owners
Business
Analysts
Storage
Administrators
Security
Operations
Big Data
for IT

6. Data-Driven Ops: “See with Data”
BUSINESS &
OPERATIONS
ANALYTICS
OPTIMIZATION &
CONTINUOUS
IMPROVEMENT
PROACTIVE
MONITORING &
REMEDIATION
PERVASIVE SECURITY
MONITORING &
COMPLIANCE

7. Tapping New Sources of Visibility
Driven by
Big Data
Technology
Machine Data
Wire Data

8. Wire Data
• All communication
on the network from
packets to payload
• 1000 x bigger
than machine data
• Definitive
source of truth
• Data you
already have

9. Wire Data: Real-Time Observational
Analysis
A small sample of what wire data contains…
All L2-L7
communication
on the network
From Unstructured Packets
To Structured Wire Data
Extracting real-time
insight from all
communication and
data streams
Business Data
Product ID
Customer ID
Shopping Cart ID
Cart Items
Cart Values
Discounts
Order ID
Abandoned?
Application Data
POST Content
AJAX Data
Section
Sub-Section
Page Title
Session Cookie
Proxied IP Address
Error Message
Availability Data
HTTP status codes
Application errors
Connection resets
Heartbeats
SSL certificate validity
Synthetic pingers
SNMP traps
Authentication errors
Capacity Data
Throughput
Transactions
Dropped packets
Application stalls
Application slowdowns
Geolocation/
IP mapping
Storage Access
(reads/writes)
SSL Offload
Security Data
Command and Control
Shadow IT
(SaaS, cloud)
Network traversal
Unauthorized outbound
connections & protocols
Storage/DB access
Blacklisted traffic
Brute force attacks
Surreptitious tunneling
Performance Metrics
Caching Behavior
Compression Behavior
Base HTML Load Time
Round Trip Time
Client Request Time
Server Reply Time
Server Send Time
Total Time Taken

10. Self Reporting + Observation =
Insight
• Self-reported data
(machine data)
– “What are your symptoms?”
– “When did this start?”
– “Does this hurt?”
• Observational data
(wire data)
– MRI
– Blood tests
– Heart rate, pupil dilation,
appearance, etc.

11. IT Operations Analytics Survey
ExtraHop and TechValidate partnered to survey 88 respondents from
65 organizations that use the ExtraHop platform.
• 65% of respondents are combining data sources for ITOA now, or plan to do so
within one year
• 54% of respondents are currently integrating wire data and machine data in
some manner
• 67% of respondents saw ITOA capabilities as important for IT security

12. Key Considerations for IT Big Data
Moving data around can
be expensive
Data Gravity
Pull out more of the
signal, filter out more of
the noise
Signal-to-Noise
Understand when real-
time access to data is
important
Motion of Data

13. Data Gravity
DATA

14. Signal-to-Noise Ratio
Signal
• Garbage in; garbage out
• Examples of data
sources with poor quality
– Threat detection
– Verbose logging
• Time is required to
separate signal from
noise

15. Motion of Data
Data at Rest
(Batch processing)
Example: MapReduce
in Hadoop
Data in Motion
(Stream processing)
Example: Apache Spark,
ExtraHop
DB
DB
DB
Data
mart
user
report
query
source
source
source
Batch 1Batch 2
user

16. SOLUTION
CHALLENGE
McKesson Managed Services
BACKGROUND
“ ExtraHop enables us to solve
incredibly complex problems in a
matter of hours. Extrapolated
across our business, we’re saving
at least $400,000 annually in
terms of time spent
troubleshooting.”
─ Scott Checkoway,
Director of Application Hosting
• Citrix application launch times dropped 75% (40 to 12 sec)
• Staff optimization: from 2.6 to 1 engineer for every 4
hospitals - $260,000 savings in first year
• Reduced MSFT SQL licenses - $200,000 savings annually
• Understand the impact of application updates
• Complex: Hospitals’ and McKesson’s IT environments
• Equip IT generalists; lessen reliance on specialists
• High coordination costs, slow troubleshooting processes
• Operational costs increased while user satisfaction
decreased
• Hosted healthcare applications for hospitals
• 7x24x365 mission critical operations
• Rapidly growing customer base
• Stringent and costly performance-based SLAs

17. Citrix Environments Are Complex!
• Is there latency between the user and web server?
• Slow Active Directory server?
• Network issues in the Citrix cluster?
• Contention in the SAN?

18. See across
Citrix, web,
database,
storage, LDAP,
DNS, etc.
Visibility on the Wire
Correlate activity across all tiers with wire data
Monitor SLAs in
real time.
Drill into critical
KPIs (launch,
load times, etc.)
per user.

19. Visibility Into Citrix Application
Delivery
McKesson improved Citrix
application launch times by
75% with ExtraHop.
McKesson avoided more than
$260,000 in staffing costs in
its first year with ExtraHop.

20. Understand the Impact of Application
Updates
• Improved user
experience
• Fewer surprises for IT
Ops
• Faster feedback for
app teams
BENEFIT
Drill down to see
how SQL queries
are performing.
Compare performance
across versions and
across time periods.

21. Identify Active/Inactive Databases
Saved $200,000
annually in reduced
database license costs.
BENEFIT
See all database
transactions.
Show all activity by
every database and
degree of usage.

22. Operations Analytics: Real-Time Patient
Tracking Observe admittance, discharge, and
transfers (ADTs) in real time.
Who and how many are being
admitted right now? Do we need to
adjust staff?
Track admissions by location and
gender.
Why are so many males being
admitted in Kent? Is it an epidemic?
• Optimize processes and staffing
for improved patient quality.
• Identify potential epidemics.
BENEFIT

23. Questions?
Explore the Power of
Real-Time Operational
Intelligence
www.extrahop.com/demo