Gavin Reid
“Splunk allows us to quickly consolidate and correlate disparate log sources, enabling previously impractical monitoring and response scenarios.”
Gavin Reid, CSIRT Manager
Michael Langhorst
“With Splunk we can complete security investigations in 1.5 hours versus the 1.5 days it used to take to find the log data we needed just to start the investigation.”
Michael Langhorst, Senior Systems Engineer
Peter D. Bassill
“Splunk’s ability to collate and report on any form of log file or data stream is being leveraged for a wide variety of requirements including the need to detect and investigate fraudulent activity.”
Peter D. Bassill, CISSP, Group Information Security Officer
David Jones
“Splunk automated our evidence gathering for SOX compliance, freeing up engineers to work on revenue-generating activities vs. compliance related tasks.”
David Jones, IT Operations Manager
Meno Schnapauff
“It’s easy to centralize our IT data into Splunk, enabling admins, application developers, the monitoring team—anyone in IT to securely access they data they need to solve problems more quickly.”
Meno Schnapauff, System Engineer
“Federal agencies should implement Splunk because it’s the only product out there that can bring all the security information together, correlate and bring a coherent picture of your security posture.”
Bill Hornish, Federal Business Development, Splunk
peter bassill
“We chose Splunk for PCI compliance for its ability to collate and report on any form of log file or data stream. It gives us highly granular logging information and turns any data into a concise management report.”
Peter D. Bassill, CISSP, Group Information Security Officer
suky bal
“We can generate ad-hoc reports to track any transaction or user activity QSA auditors want to see and easily show we are PCI compliant in minutes. I've decreed Splunk will be a part of all data center build-outs going forward.”
Suky Bal, Director of IT
David Hazekamp
“Splunk’s ROI was less than a week. We witnessed a tremendous increase in productivity.”
David Hazekamp, Former Senior Security Analyst

信息安全总览

传统方法:过载的资料阻碍事件的响应能力

您的组织或许像大部分的组织一样,已部署各种不同的安全性技术,例如「深层防护」、防火墙、网页代理服务器、访问控制系统等多重的IDS系统。这些技术皆会产生大量的数据,可说是幸,也是不幸。

创新思维:所有数据皆相互关联而集中于一处

您可从单一位置实时搜索、警示及报告任何用户、网络、系统或应用程序活动、状态变更,以及其他IT数据。此外,您也能从单一位置免除设置多重控制台的需要,并追查到攻击者的行踪。现在您可执行更深入的分析,并快速而彻底地予以回应,降低您暴露的危险程度。让您拥有您一直冀求却从未想过能真正达成的完整可见性。

优势

  • 加速事件的响应能力
  • 降低危险曝露程度及风险
  • 在发生曝露情况前,就找出未预料到的潜在威胁
  • 持续观察不断变化的威胁趋势
  • 消除主动错误讯息
  • 让您的员工更聪明且更有效率

Splunk可运用于:

事件响应
在您接获任何可疑活动的警示或报告时,Splunk将会是您第一个处理的窗口。

安全性监控
让您轻易地跨越IT障碍,监控安全性事件,并搜索路由器及防火墙日志文件中的数据流违反情况、寻找服务器及应用程序上的违反情况,或是寻找未经授权或不安全的组态变更。

诈欺侦测
Splunk让您拥有侦测精密诈欺的能力。

内部威胁
让您的组织具备必需的弹性分析能力,以侦测出所有类型的内部威胁。

安全性报告
Splunk可跨越您所有的IT基础结构及技术,让您从单一位置即能产生报告。