Splunk Insights Into Windows Environments. Welcome!

Transcription

1 Splunk Insights Int Windws Envirnments Welcme!

2 Yur presenters Rb Silver & Nick Black

3 Agenda 12 midday Intrductin 12:10 Grab lunch 12:15 Tech Talk & dem s * Splunk App fr Micrsft Infrastructure * Splunk App fr Micrsft Exchange * Splunk & Web Analytics * Gemini SBOX 13:30 The bundles 13:45 Questins 14:00 Clse

4 Rapid Deplyment Splunk Bundles fr Micrsft Rapid Insights int Windws Envirnments Rivium is a leader in getting Splunk deplyments right. With experience delivering ver a hundred Splunk engagements Australia wide we knw what a brilliant Splunk envirnment lks like. Our Rapid Deplyment Splunk Bundle fr Micrsft envirnments is a tailred slutin t quickly enable yu t mnitr, audit, secure and analyse yur Windws Infrastructure and wrklads in ne place, in real time.

5 Rapid Deplyment Bundles fr Micrsft Envirnments Sftware, Hardware and Services TECHNOLOGY INFRASTRUCTURE EXPERTISE Splunk ffers the leading platfrm fr peratinal intelligence making machine data accessible, usable and valuable t everyne. Gemini SBOX is a purpse-built appliance that can dramatically reduce the cst t deply Splunk cmpared t cmmdity hardware. Rivium is a Splunk Prfessinal Services partner with extensive experience in deplying Splunk slutins.

6 Splunk App fr Windws Infrastructure Mnitr, audit, secure and analyse yur Windws IT infrastructure and wrklads in ne place, in real time. Avid service degradatins with granular insights int server event data, perfrmance metrics, cnfiguratins, alerts and registry changes in Active Directry including users, grups, machines and grup plicy bjects. Gain realtime visibility int yur service health and perfrmance acrss the entire messaging infrastructure, including diverse message delivery cmpnents and the supprting infrastructure. Events, Perfrmance & System Mnitring Analyse infrmatin n all the critical Windws events: CPU, memry, physical disk, LgicalDisk, netwrk interface, applicatin crashes, applicatin installs and Windws updates. Anmalus Lgns & User Lgn Failures Understand and analyse uncharacteristic usage patterns and failed attempts by users t lg nt a specific dmain. Dmain & DNS Services Mnitring Visualise infrmatin n the health, cnfiguratin and perfrmance f dmains, sites, dmain cntrllers, DNS servers and DNS znes that belng t the Active Directry.

7 Splunk App fr Micrsft Exchange Gain insights int yur messaging infrastructure and nn-exchange devices and services with a unified view f the entire service infrastructure. The Splunk App fr Micrsft Exchange cnsumes lgs frm yur Micrsft Exchange systems t give yu deep visibility int the health and perfrmance f yur Micrsft Exchange envirnment frm Edge and Hub Transprt servers t the Client Access servers and the Mailbx Stre itself. Service-Centric Mnitring Service Analyzer Deep Visibility Reduce dwntime thrugh real-time service health and perfrmance mnitring acrss the entire messaging infrastructure. With granular cmpsite health scres acrss the entire service path yu can analyse critical metrics acrss Exchange service cmpnents, giving yu instant visibility int which service cmpnents are affecting the health f yur service. Prvides yu with deep visibility int the health and perfrmance f yur Micrsft Exchange envirnment; frm Edge and Hub Transprt servers t the Client Access servers and the Mailbx Stre itself.

8 Splunk App fr Web Analytics Organisatins need a deep understanding f custmer interactins and prduct/feature usage t create the best website r mbile user experience. The Splunk App fr Web Analytics prvides an end-t-end view f yur Micrsft IIS envirnment prviding visibility f custmer interactins acrss varius digital channels. Actinable Insights Analyse Custmer Experience Digital Data Visualisatins Create actinable insights that are critical in slving custmer, website/mbile and multi-channel analytics challenges and enrich digital data with CRM r ffline data. Derive unique insights by cmbining client and server side data in real time t analyse and imprve custmer experience. Get meaningful insights and visualisatins with unlimited segmentatin and full data drill dwn n real-time and histrical data.

9 Gemini SBOX Splunk Appliance Gemini SBOX makes it easy t scale and manage yur big data deplyment. Gemini allws yu t manage a Splunk appliance frm a single interface and seamlessly delivers turn key slutins frm leading rganisatins via the Gemini Integratin Center. SBOX integrates high-perfrmance strage, an ptimised and security hardened perating system, and an easy t use GUI that simplifies the deplyment and day t day peratins f big data sftware. Ease f Management Rapid Prvisining Security Hardened Centralised management f Gemini sbx appliances and platfrms makes it easy t tweak netwrk cnfiguratins, rchestrate tasks, schedule activities and even visualise yur tplgy. All in ne intuitive, easy-t-use interface. An intuitive setup wizard allw easy custmisatin and ptimisatin fr yur needs, minimizing the burden n IT peratins. Includes direct attached high perfrmance disks, ptimizing IO peratins and eliminating the need fr expensive SAN strage. Designed frm the grund up t minimize attack surfaces and vulnerability. Cntains prprietary, purpse-built OS extensins ptimised fr security and a streamlined perating envirnment that eliminates unnecessary services.

10 Tech Talks

11 Splunking Windws

12 Active Directry mnitring Netwrk errrs DB cnnectin issues Exchange - - Messages nt being received - Capacity planning - Message tracking - Behaviur anmlies - Mailbx DB size issues - Exchange sync issues Systems verview Perfrmance mnitring Cmmn Windws Pain Pints Cmputer audits Grup plicy changes Print peratins Security Overview App crashes Sil d systems Event errrs Many helpdesk jbs Windws Update failures Lcked ut accunts

13 Splunking Windws Sample Deplyment Diagram Data flw Splunk App fr Micrsft Exchange Splunk Add-ns fr Micrsft Exchange Splunk Add-ns fr Active Directry/DNS Windws Hsts ( ) Splunk Supprting Add-n fr Active Directry Splunk Add-n fr Windws AD Dmain Cntrller Send t Indexer Windws DNS Exchange Server Databases Clud services Deplyment Clients Indexers Search Head

14 Splunking Windws The Need Exchange SLA s Change Management Cmpliance One platfrm that supprts everyne Server Management

15 15 Splunking WIndws Cmmn Splunk Apps & Add-ns Apps Add-ns Splunk App fr Micrsft Windws Infrastructure Splunk App fr Micrsft Exchange * DB Cnnect 3 Splunk Enterprise Security * uberagent * Splunk App fr Web Analytics Splunk Add-n fr Micrsft Clud Services Splunk Add-ns fr Micrsft Exchange Splunk Add On fr Active Directry Splunk Add-n fr DNS Splunk Add-n fr Windws

16 Splunk App fr Micrsft Windws Infrastructure

17 Splunk App fr Windws Infrastructure Why? Identify infrastructure prblems, such as nn-running services and lad issues Mnitr the perfrmance f all servers thrughut yur Windws envirnment Mnitr security events, such as virus utbreaks and anmalus lgns Track administrative changes t the envirnment Plan fr capacity expansin

18 Splunk App fr Windws Infrastructure What data? Perfrmance Mnitr Lgs Active Directry Lgs (via Splunk Add-n fr Windws and/r Splunk Add-n fr Active Directry suite) Windws Infrmatin (Netwrk, Hst, Print Mnitring) (via the Splunk Add-n fr windws) perfmn, windws, msad, wineventlg indexes Windws Event Lgs (Security & Applicatin) (via the Splunk Add-n fr windws)

19 Splunk App fr Windws Infrastructure Mnitring Areas Windws Windws Events Perfrmance Mnitring Applicatins & Updates Hst/Print/Netwrk Mnitring Active Directry Active Directry Dmains DC s DNS Users Cmputers Grups Grup Plicy OU

20 Splunk App fr Windws Infrastructure DEMO

21 Splunk App fr Micrsft Exchange Premium Splunk App

22 Splunk App fr Micrsft Exchange Why? Identify infrastructure prblems, such as nn-running services and lad issues Mnitr the perfrmance f all servers thrughut yur Exchange envirnment Track messages thrughut yur messaging envirnment Mnitr client usage, including mbility usage via ActiveSync r Outlk Anywhere Mnitr security events, such as virus utbreaks and anmalus lgns Track administrative changes t the envirnment Analyze lng-term mail peratins trends Plan fr capacity expansin Mnitr yur rganizatin's utbund sender reputatin

23 Splunk App fr Micrsft Exchange What data? Perfrmance mnitring data IIS Lgs Active Directry Lgs (via Splunk Add-n fr Windws and/r Splunk Add-n fr Active Directry suite) Windws Infrmatin (Netwrk, Hst, Print Mnitring) (via the Splunk Add-n fr windws) msexchange, perfmn indexes Windws Event Lgs (Security & Applicatin) (via the Splunk Add-n fr windws)

24 Splunk App fr Micrsft Exchange Mnitring Areas Service Analyzer At a glace states f all Exchange services within yur Exchange deplyment Exchange Perfrmance & Thrttling Hsts & Mailbx Databases Message Activity User Behaviur Usage and Capacity Planning Administrative Reprts

25 Splunk App fr Micrsft Exchange DEMO

26 Splunk & Website Analytics

27 Web analytics is the measurement, cllectin, analysis and reprting f web data fr purpses f understanding and ptimizing web usage What can we d in Splunk t help with this?

28 Splunk & Web Analytics What can Splunk ffer? Real-time visibility search, crrelate and mnitr live events in real time as they ccur acrss yur nline ecsystem. High-perfrmance search and navigatin find what yu re lking fr anywhere in yur envirnment quickly and easily. Search acrss billins f events in secnds n a single cmmdity server. Splunk scales t the largest f data vlumes. Pwerful histrical analytics analyze imprtant trends, statistics and metrics abut nearly any aspect f behavir. Custm dashbards help yu t analyze the behavir f yur custmers, users, transactins, applicatins, web servers, app servers and netwrks.

29 Splunk & Web Analytics Use Cases? Optimizing User Experience Cmprehensive Web Analytics Trending Analysis End-t-end Visibility

30 Splunk & Web Analytics DEMO

31 Other Ntable Apps

32 Other Windws Apps uberagent Tells yu exactly abut everything relevant t user experience Helps yu identify trends that therwise wuld have gne unnticed Simplifies trubleshting by shwing yu what yu need t knw in ne place Shws yu which applicatins are used when Makes help desk and IT peratins mre effective Supprts IT prs with infrmatin they need fr deep trubleshting Makes physical and virtual envirnments (VDI) cmparable Prvides rich infrmatin vital fr infrmatin security

33 Other Windws Apps Splunk DB Cnnect 3 Allws yu t imprt tables, rws, and clumns frm a database directly int Splunk Enables yu t utput data frm Splunk Enterprise back t yur relatinal database Perfrms database lkups allws yu t directly use SQL in yur Splunk searches and dashbards

34 Splunk and SBOX

35 SBOX Purpse SBOX delivers an ptimized, secured Splunk Appliance that is simple t manage easy t cnfigure and fast t deply.

36 SBOX Current Splunk Infrastructure Challenges Incnsistent Hardware Envirnments Can t Standardize Time Cnsuming and resurce intensive build. Increased Time t Value Varying OS patch and security requirements Inefficient & Unsecure Standardized envirnments make deplyment, supprt and Develpment Infinitely easier

37 SBOX Even Mre Challenges I need t use 3 rd party Versining tls Mre Bench Time Learning New Prducts Every Custmer has a different envirnment Supprt and Maintenance Is Time Cnsuming and Cstly Patching and updates are manual Time Wasted Managing And Tracking 3 rd Party Updates Time Spent Managing and Learning Diverse Envirnments is Time That Culd Have been Spent Implementing and Using Splunk

38 SBOX Cmmdity Hardware 1) Purchase servers 2) Purchase OS licenses 3) Cnfigure and secure servers 4) Patch and update their OS 5) Attach servers t nt quite as fast as I thught SAN 6) Get Security t apprve their cnfiguratin 7).and (finally) install Splunk.

39 > > > Enter Gemini SBOX

40 Rapid Deplyment Deply big data platfrms in minutes, nt weeks. Optimized fr n prem r clud deplyments. Simplified Management Fcus n Security and Operatinal Intelligence instead f infrastructure management. Easily manage cmplex clusters f ndes and cnfiguratins. Faster Time T Value Purpse-built big data appliance reduces ttal cst f wnership and integrated slutins make yur team mre efficient.

41 Big Data Appliance Engineered t simplify the deplyment and daily peratins f big data platfrms such as Splunk and Hadp. Designed frm the grund up t prvide a secure, rbust perating envirnment based n industry best-practices and years f practical experience. Secure, hardened OS Easy Intuitive web based administratin fr all appliance functins (strage, netwrk, NTP, updates) Fast Time t Value: simple t install and cnfigure Lwer Ttal Cst f Ownership: cmpared t cmmdity hardware High Perfrmance: Appliances are tuned t deliver the ptimal Splunk (and Hadp) perfrmance Deply n prem r in the clud.

42 SBOX SBOX appliances

43 SBOX Why d we recmmend SBOX? Get Splunk Implemented faster withut having t surce apprpriate hardware Remve IT ps frm the equatin. N need t cnfigure an OS r Strage. SBOX are easy t wrk with and can have direct cnversatins with yu and/r yur custmers. Peace f Mind! SBOX design their hardware specifically with Splunk in mind and can prvide 4 hur nsite fix r replace supprt fr SBOX hardware.

44 SBOX DEMO

45 The Bundles

46 Optins fr On-Premise Splunk SBOX Rapid Deplyment Optins What yur envirnment includes: Splunk Enterprise Subscriptin Splunk App fr Exchange Subscriptin Splunk App fr Windws Infrastructure Splunk App fr Web Analytics Splunk App fr Micrsft SQL Splunk Add-n fr Windws DHCP Splunk Add-n fr Windws DNS Splunk Add-n fr Active Directry Tw additinal surce types and Apps SMALL MEDIUM LARGE $5,356 per mnth including GST 3 Year Cntract $8,572 per mnth including GST 3 Year Cntract $14,146 per mnth including GST 3 Year Cntract SBOX Appliance Small envirnment includes the A240 Appliance and the M1000 Management Appliance. 10GB per day (2GB Exchange Data) 12 mnth data retentin 20GB per day (5GB Exchange Data) 12 mnth data retentin 50GB per day (10GB Exchange Data) 12 mnth data retentin Medium envirnment includes the A240 Appliance, S1000 Search Head, and M1000 Management Appliance. 1 Pwer User Training 2 Pwer User Training 2 Pwer User Training Large envirnment includes A540 Appliance, S1000 Search Head, M1000 Management Appliance. Includes Implementatin Includes Implementatin Includes Implementatin Pricing des nt include the nging management f yur Splunk envirnment and may be subject t change based n currency fluctuatins.

47 Optins fr Clud Splunk Clud Rapid Deplyment Optins What yur envirnment includes: Splunk Enterprise Subscriptin Splunk App fr Exchange Subscriptin Splunk App fr Windws Infrastructure Splunk App fr Web Analytics Splunk App fr Micrsft SQL Splunk Add-n fr Windws DHCP Splunk Add-n fr Windws DNS Splunk Add-n fr Active Directry Tw additinal surce types and Apps SMALL MEDIUM LARGE $5,709 per mnth including GST 3 Year Cntract $8,259 per mnth including GST 3 Year Cntract $13,945 per mnth including GST 3 Year Cntract SBOX Appliance All envirnments includes the F1000 Frwarder Appliance and the M1000 Management Appliance. 10GB per day (2GB Exchange Data) 90 day data retentin 20GB per day (5GB Exchange Data) 90 day data retentin 50GB per day (10GB Exchange Data) 90 day data retentin 1 Pwer User Training 2 Pwer User Training 2 Pwer User Training Includes Implementatin Includes Implementatin Includes Implementatin Pricing des nt include the nging management f yur Splunk envirnment and may be subject t change based n currency fluctuatins.

48 Splunk is licensed by data vlume ingested per day What size is right fr me? Every custmer is different, and there are many factrs that can influence the amunt f data yur envirnment will generate per day. With Rivium s experience with the deplyment f many Splunk envirnments, we have fund that the fllwing metrics can be useful as a guide. 10GB 20GB 50GB Number f staff Windws Servers IIS Servers Database Servers Exchange Hsts Active Directry Hsts Fr mre accurate guidance n the right size fr yur rganisatin, Rivium will undertake a data surce assessment t prvide recmmentatins n the mst apprpraie rapid deplyment bundle fr yur envirnment.

49 xxx A: Level 14, 380 St Kilda Rad, Melburne VIC 3004 T: W: E:

50 Q&A

51 Thanks fr yur time!