Upload File

what’s new in machine learning across the splunk s new in machine learning across the splunk...

  • Home
  • Documents
  • What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product
31
What’s new in Machine Learning across the Splunk Portfolio Manish Sainani | Director, Product Management Bob Pratt | Sr. Director, Product Management September 2017

Upload: buianh

Post on 17-Mar-2018

228 views

Category:

Documents


4 download

Report

TRANSCRIPT

Page 1: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

What’s new in Machine Learning across the Splunk PortfolioManish Sainani | Director, Product ManagementBob Pratt | Sr. Director, Product Management

September 2017

Page 2: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

Page 3: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Machine Learning Overview ▶ Splunk Machine Learning Toolkit (MLTK) Overview▶ What’s New in Machine Learning Toolkit?▶ What’s new in IT Service Intelligence ML?▶ Splunk User Behavior Analytics (UBA) Overview▶ What’s new in UBA 4.0?

Agenda

Page 4: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Machine Learning Overview

Page 5: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ A process for generalizing from examples▶ Examples

• A, B, … → # (regression)

• A, B, ... → a (classification)

• Xpast → Xfuture (forecasting)

• like with like (clustering)

• |Xpredicted – Xactual| >> 0 (anomaly detection)

Machine Learning

Page 6: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

How Machine Learning is surfaced across the Splunk Portfolio

CORE PLATFORM SEARCH + Smarter

SplunkPACKAGED PREMIUM

SOLUTIONS – ITSI, UBAMACHINE LEARNING

TOOLKIT

Platform for Operational Intelligence

Page 7: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Evaluate

Deploy Clean / Transform

Explore / Visualize

Model

Collect DataMachine Learning Process

Page 8: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Machine Learning Process with Splunk

Pivot, Table UI, SPL

props.conf,transforms.conf,Datamodels,Splunkbase

Splunk Machine Learning Toolkit

Alerts,Dashboards,Reports

Collect Data

Clean / Transform

Explore / Visualize

Model

Evaluate

Deploy

Page 9: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Splunk Machine Learning Toolkit

platform extensions and guided modeling dashboards

Page 10: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Assistants: Guide model building, testing, & deployment for common tasks

▶ Showcase: 25+ interactive examples from IT, security, business, and IoT

▶ Algorithms: 30 standard algorithms plus an extensibility API

▶ SPL ML Commands: New commands to fit, test, and operationalize models

▶ Python for Scientific Computing Library: 300+ open-source algorithms

Splunk Machine Learning Toolkitextends Splunk with new tools and guided modeling

Page 11: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Machine Learning Toolkit Customer Use Cases

Speeding website problem resolution by automatically ranking actions for support engineers

Reducing customer service disruption with early identification of difficult-to-detect network incidents

Minimizing cell tower degradation and downtime with improved issue detection sensitivity

Improving uptime and lowering costs by predicting/preventing cell tower failures and optimizing repair truck rolls

Predicting and averting potential gaming outage conditions with finer-grained detection

Ensuring mobile device security by detecting anomalies in ID authentication

Preventing fraud by Identifying malicious accounts and suspicious activitiesEntertainment Company

Page 12: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

What’s New in MLTK?since last .conf

Page 13: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Detect Numeric Outliers improvements▶ Preprocessing / Data Prep▶ Model Management▶ ML-SPL extensibility API▶ Spark Support (private limited beta)▶ New algorithms:

• ARIMA supported in Forecasting Time Series Assistant• ACF & PACF• Gradient Boosting Classifier & Regressor

▶ Load Existing Settings is per-user▶ Downsampled Line Chart supports drilldown

What’s New(since .conf 2016)

Page 14: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Detect Numeric Outlierssplit-by support

Page 15: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Detect Numeric Outliersdata distribution viz

Page 16: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ In Predict Numeric, Predict Categorical, and Cluster Numeric assistants

Preprocessingbuild a pipeline of data prep

Page 17: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Provides Role Based Access Control to models

▶ Assign permissions to models to control who has what level of access

▶ Manage models via a rich UI interface

Model Management(coming to MLTK 3.0)

Page 18: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Make more algos available to fit / apply• 300+ in PSC• Custom algorithms

▶ Expose new or different parameters▶ Docs include examples

• Correlation Matrix• Agglomerative Clustering• Support Vector Regressor• Savitzky-Golay Filter

▶ Use in your apps / dashboards / etc.!

ML-SPL Extensibility APIfeaturing: primo documentation

Page 19: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Use your existing Spark cluster with MLTK• Distributed fit on massive datasets• Apply MLlib models for supported algos

▶ sfit / sapply▶ Contact [email protected]

• What is your use case (e.g., predicting server downtime)?• Why do you want / need Spark (i.e., why isn’t MLTK sufficient)?

Spark Supportprivate beta open now

Page 20: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Machine Learning Customer Success

Network OptimizationDetect & Prevent Equipment Failure Security / Fraud Prevention

Prioritize Website Issues and Predict Root Cause

Predict Gaming OutagesFraud Prevention

Machine Learning Consulting Services Analytics App built on ML Toolkit

Prevent Cell Tower FailureOptimize Repair Operations

Entertainment Company

Page 21: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

What’s new in ITSI ML ?

Page 22: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

▶ Uses the Splunk “Reverse Pyramid Clustering” Algorithm to reduce noise in IT event data

▶ The algorithm extracts categorical and textual similarity from events and uses them in combination with a Service context to correlate events.

▶ Provides a UI based configuration editor that allows users to tweak parameters and tune configuration without a data scientist

▶ Not a black box – explainability is built right in. All event groups created by the algorithm provide an explanation as to why events were grouped together.

ITSI Smart ModeEvent Co-relation and Clustering for Event Data

Page 23: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Splunk User Behavior Analytics

Machine Learning-based Threat Detection

Page 24: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Splunk User Behavior Analytics

Anomalous Behavior Unknown ThreatsRisky Users

An out-of-the-box solution that helps organizations find

with the use of machine learning

Page 25: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Splunk User Behavioral Analytics PillarsFive Foundational Pillars

Behavior Baseline & Modelling

Unsupervised Machine Learning

Real-Time & Big Data Architecture

Anomaly Detection

Threat Detection

Platform for Machine Data

Page 26: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

How Does Splunk UBA Work?

45+ ANOMALY CLASSIFICATIONS

20+ THREAT CLASSIFICATIONS

MachineLearning

Suspicious Data Movement

Unusual Machine Access

Flight Risk User

Unusual Network Activity

Machine Generated Beacon

MachineLearning

Lateral Movement

Suspicious Behavior

Compromised Account

Data Exfiltration

Malware ActivityApplication logs

Network logs

Endpoint logs

Server logs

Identity logs

Page 27: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

How does UBA integrate with Splunk Enterprise and ES?

Splunk Enterprise Investigate

Known Threats

Splunk UBADetect

Unknown Threats

• Rules• Correlations• Statistics

• MachineLearning• BehaviorAnalysis• Risk-levelScoring

Human-driven ML-driven

Splunk ESDetect, Investigate & Respond

Page 28: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

What’s New in UBA 4.0?

Announced here at .conf

Page 29: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

UBA SDK – now available

CustomML models(s)

Custom Anomalies

UBA Threat Models

UBA Threat(s)

Traditional logs

Proprietary logs

Output from other UBA

models

Custom Threat Models

Custom Threat(s)Implement custom machine learning models to generate new anomalies and threats

Page 30: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

PII Masking – also shipping now

Obfuscate user details during investigation or hunting

Page 31: What’s new in Machine Learning across the Splunk s new in Machine Learning across the Splunk Portfolio Manish Sainani| Director, Product Management Bob Pratt | Sr. Director, Product

Q&AManish Sainani | Director, Product Management

Bob Pratt | Sr. Director, Product Management


データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Splunk For IT Operational Intelligenceuploads.integrity360.com/1425903243-Splunk-for-IT-Operations.pdf · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

ReversingLabs Explainable Threat Intelligence Enriches ... Data Sheets/RL-Splunk...sent to Splunk. • In Splunk, the TitaniumScale report is correlated with other available Splunk

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk conf2014 - Onboarding Data Into Splunk

SPLUNK Capabilities Overview - GTRI · Overview GTRI is the only ELITE Splunk integrator with certified Splunk architects and engineers on staff. In addition to ... SPLUNK-Overview

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

PosiBoning*the*Business* Value*of*Splunk*Across* …€¦ · INNOVATE*BUSINESS* SERVICES*FASTER 3 › Fewer developer disruptions › Continuous development / innovation › Faster

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Using Splunk for CDM and CMaaS · able to integrate all the tools across CDM functional areas, ... By monitoring use of credentials across multiple ... Using Splunk for CDM and CMaaS

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Splunk 教學 - Splunk Documentationdocs.splunk.com/images/d/db/Tutorial_zh_TW_502.pdf · 簡介 歡迎使用 Splunk 教學！ Splunk 是什麼？ Splunk 是一個可從構成您

Splunk Conf2010: Corporate Express presents Splunk with SAP

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Netfilter Iptables for Splunk Documentation - Read the Docs · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Deploying Splunk. Arquitetura e dimensionamento do Splunk

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

External Guide Mr. Abhishek Sainani DBA at Capital IQ,Hyderabad

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk in Rakuten: Splunk as a Service for all

Splunk Enterprise 6.5.0 Splunk Enterprise 보안

インストールマニュアル Splunk Enterprise 6.2docs.splunk.com/images/8/8b/Splunk-6.2.0-ja_JP-Installation.pdf · Splunk Enterprise インストールマニュアルによう

Agency Chargeback Models to Enable Enterprise Splunk ......Workshops: Get Splunk Hands -on Experience Attend a Splunk Workshop Upcoming Schedule December 1: Introduction to Splunk

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

データ分析プラットフォーム「Splunk」eww.gp-club.panasonic.co.jp/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Industrial Data Internet of Things splunk (REST API, SDKs) splunk . TESCO splunk 500 Y—Jt1-3— 41328 . SHANON 1/5 splunk . htt . (500MB/B) s lunk splunk . Created Date:

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Splunk App for Microsoft Exchange · The Splunk App for Microsoft Exchange provides insights from across your entire messaging infrastructure. This includes critical dependencies—such