2. Director of Security Services
Hurricane Labs
Managed Security Provider
Cleveland, OH
Avid Cleveland sports cynic
•
•
•
Matt Yonchak

3. What Hurricane Labs Does
Security Monitoring and
Analysis
Performance Monitoring
Vulnerability Management
Splunk MSSP
•
•
•
•

4. Security Monitoring and Analysis

5. Typical Security Data
IPS
Proxy
Firewall
WAF
•
•
•
•

6. Non-Typical Data
(but still relevant to security)
Web Application Data
Voice and
Communication
Email
Performance Monitoring
ID Management
External Data Sources
•
•
•
•
•
•

7. Performance
Monitoring
Comprised of different areas:
System Resources Up / Down Monitoring System Processes Bandwidth Utilization

8. Performance monitoring

9. Vulnerability Management
Penetration testing
and lots of it

10. More frequent = more data.
Clients given a score
Splunk pulls in pen test data.
•
•
•
Vulnerability Management

11. Hurricane Labs
Big Data Problem

12. Our Big Data
Problem
Statistics on
HL big data

13. Icinga
Cacti
Pentest results
Tickets
Changelogs
IDS/IPS events
HIDS
Vulnerability
Scanners
Port Scanners
Event Logs
Syslogs
Firewall events
Audit events
PCI events
What Goes Into the HD
portal Splunk Instance?
(It's ALOT)

14. How we filter down so many events
to provide security intelligence:
Making 246 Million Events
Work For You
Proper tuning
(not just turning stuff off)

15. Gives a broader security picture
Correlation across clients
Warn of industry attack trends
•
•
•
Capabilities that Splunk
Provides to the HD Services

16. Capabilities that Splunk
Provides to the HD Portal
Flexible Reporting Searchable Log Data Correlation

17. Digital interface with
our clients
How we show
transparency
Allows our clients to
interact with their big
data
A way to see the
service side vs. the
technical side
•
•
•
•
Hurricane Defense Portal

18. What makes the HD portal tick?

19. Why the Splunk
SDK Is So Great
"Makes things more Pythonic" – yes that's a quote
Allows for faster development times and faster version
releases of the portal
Helped us to develop a custom UI
•
•

20. Splunk Driven
Dashboard Data Reports Monitoring Trends

21. Splunk Helped Tame
Our Big Data

22. In Closing

23. Questions?
Contact Me:
Call @ 888-276-4106 x106
E-mail @ matt@hurricanelabs.com
Thank you for your time!