>> We're on Module 2 talking about Splunk products,
understanding popular Splunk products is important.
If you're going to claim any kind of Splunk knowledge,
you need to be able to understand
how the products interact,
and work with each other, and
know where to start for making
recommendations on what products
that companies should look to purchase.
Splunk does regularly make changes,
and add new features, and products,
so check their site for the latest information.
Like we talked about in Module 1,
when people refer to Splunk,
they typically mean the core Splunk platform
or they may just be referring to
what they're used to working with.
There are currently four different
Splunk platforms to choose from,
these all aggregate process,
and help you use data,
which one you pick typically has to
do with your data appetite, and budget.
A small company with a few users,
and limited data may choose Splunk light,
whereas most large companies will
pick Splunk Enterprise or splint Cloud.
There are some differences between these platforms,
such as for Splunk light,
you don't have the option of clustering,
and high availability or single sign on options.
Splunk Enterprise is
the most popular platform I've seen,
on the surface the main difference
between Splunk Enterprise,
and Splunk Cloud as if you want
an on-prem solution where you're
managing your own servers
or if you want a hosted environment in the Cloud,
there are other considerations,
but companies will usually
start with one of these four options,
and then build out from there.
Pricing is determined by how much data
is indexed on a daily basis.
There are many different options for licensing.
So if you're seriously looking to make a purchase,
you should talk with Splunk about
what would be best for your company.
Before even looking to make
a purchase it maybe a good idea to quantify,
and prioritize the data you think you'll need.
Splunk has a lot of solutions
targeted towards specific industries,
that typically work as
paid apps added to an existing platform.
A common environment might exist of
a Splunk enterprise environment
or Splunk Enterprise Security,
often referred to as ES for Enterprise Security,
and Splunk user behavior analytics added to it.
Splunk Enterprise Security adds features like
making it easier for analysts to pivot between events,
conduct threat hunting, and just
intelligence, and identify risk.
Splunk UEBA or User Behavior Analytics,
then adds machine learning,
and helps identify anomalies in the environment,
and pick out things like insider threats or
compromises that might otherwise have been missed.
While Enterprise Security,
and UEBA are heavily marketed together,
you can't have one or the other
with your Splunk enterprise platform.
Other solutions to add to your platform
include things like insights for infrastructure,
Splunk helps you baseline your environment,
and identify potential problems.
Two of Splunk recent acquisition target other areas,
Splunk Phantom is an orchestration,
and automation tool that lets you
kick off automated chains of events.
For example, you can have
Splunk Enterprise send over a malware event,
have Phantom, look up the hash, and Virus Total,
and then tell another tool to
isolate the machine that has the malware,
and then tell your ticketing system to open a ticket
with the event information in
Virus Total results, it's pretty cool.
VictorOps is primarily used to
manage on call schedules, and create notifications,
such as by sending push notifications to your phone,
giving you a call,
or send me an email when an event comes in.
An example scenario would be say
you have high CPU alert for a critical machine trigger,
and Splunk Enterprise,
and then Splunk since the event over to
VictorOps where it then
calls the system owner to take a look at the machine.
For our review time,
can you identify which
of the following is not a Splunk platform?
The answer is C,
Splunk Enterprise Security can be added to
a Splunk platform to give
additional tools for your company to use.
As a review, you have your Splunk platform,
Splunk Enterprise, Splunk Clouds,
Splunk light, and Splunk free.
This may be enough for your company,
plenty are able to accomplish
everything they need to with one of these, however,
Splunk has a lot of other specialized solution
that can optimize the use of your data,
such as Splunk User Behavior Analytics,
Splunk insights for ransomware, and others.
Phantom can be used to automate tasks in your company,
and VictorOps can alert you when something
happens, and with that,
you've made it through Module 2,
and Module 3,
we'll finally get our hands on Splunk.