Powering the SOC of the Future | The Six Five Summit

Hi, I wanna welcome all of our viewers to the six five Summit. Uh, we're in the cybersecurity track, and I have the pleasure of speaking with Splunk. And, um, from my perspective, the landscape is, is ever evolving when it comes to cybersecurity and defenders.

Bad actors are becoming more sophisticated. They're leaning into tools like generative ai, uh, to become more sophisticated in their attacks. Also, iot is expanding threat surfaces tremendously.

And with that in mind, um, I'm gonna be spending time with, with David. David, it's great to see you. Thanks for taking the time.

No, thank you so much. Uh, this is something that I've been dealing with and working with for many years, so, um, I was happy to jump in and help with. That's great.

So let's start off with the whole notion of your vision for the, the evolution of the soc. And I know in speaking with you, this has been a decades long process and really started with the sort of the future of the soc, but really where it's moving is to more resiliency. So can you speak to that and what Splunk is doing to address that?

Yeah, definitely. Like, you know, my past, I started out in federal government and, uh, before SOCs were really a thing, um, and help, you know, really think about what is that next generation for soc. And so, um, I helped build it for Department of Homeland Security.

I helped build it for CBP, I helped build it, uh, for ice. And, um, as I've been growing, it's always been the next gen, right? And so, you know, I really thought back on what is that next gen?

And, and to me, uh, into Splunk, it's really about resiliency. It's really about building the next resilient sock, right? Being able to recover faster.

As you know, the detectors are coming in, they're constantly changing tactics. And so we have to be able to, to respond to it faster. And, and so the interesting thing is, it's things that we've been doing forever now, just really bringing 'em in to like A-T-L-D-R, uh, standpoint.

You know, bringing in the machine learning, bringing in the AI with AI assistance, bringing in, you know, automation and being a part of that and not going full bore, you know, where you're going in and are meeting everything through automation or through ai, but bringing it in back to the analyst and helping them, right? The, we all know that, uh, the, the staffing and the, the workforce for cybersecurity is, is really low. Like, and it's getting harder and harder to staff there.

It's needing more and more skills. And now we're responsible, right, personally responsible if things are happening. And so it's getting harder and harder.

And so that's where Splunk's really coming in, is we're really trying to make sure we're bringing in constant detections. We're bring with Talos, we're bringing in now free, uh, threat intel into eos. We're bringing in automation through soar.

We're bringing in machine learning through MLTK and then AI assistance as well. Um, so that's kind of our approach is really going and helping and building those analysts to make it more resilient. It makes perfect sense, you know, and, and one of the superpowers that I see with generative AI is the ability to, to leverage gen AI to, to onboard these analysts even much more quickly, right?

Uh, to your point, there's still a huge deficit of talent. I mean, universities are focused on curriculum in grade schools, they're, they're focused on grooming the next generation of, of defenders. But, but it's a huge challenge.

And I, I know that the company has, uh, done a lot of primary research, uh, the state of security, uh, report. And I'm wondering, can you spend a little bit of time and, and highlight some of the, the, the important points there that sort of point to this need to drive further resiliency within the soc? Yeah, definitely.

I mean, and if you look at the report, um, I don't have in front of me, so I'm not gonna quote any metrics for you. Okay. But, uh, we're finding that more and more people are trying to leverage and use ai.

And the issue that they're also having is we don't know where it's going. We don't necessarily know the impacts. I mean, I remember when, you know, uh, chat GBT first came out, everyone jumped onto it, and then we realized that everything you post, everything that you do is now public, right?

Right. Like, oh, all the companies pull back and like, no, we can't do that. Um, and so understanding that there's multiple different types of ai, there's multiple different types of the way to use AI and use it, especially in security operations, uh, yeah.

Is is kind of changing the narrative, right? Is alright, we need to use more specific AI models, uh, for very specific tasks and not necessarily open it all up. Or generative AI is really coming in handy, and especially using dedicated versions of gender day value for the analyst is mm-hmm.

Really helping them think through things that they wouldn't necessarily think, probing them with the right questions that they wouldn't necessarily think about helping them, uh, integrate and pull in from other tools and other sources. Um, so it actually has been a big help and we're getting there, but we are not, not even close to where we can go. And so, you know, we pull, we went way far real quick and now we're pulling back really thinking through that, um, and taking that to the next step and, you know, really doing the baby steps as we make sure we know the impact that it'll bring.

Well, I mean, the alert fatigue is incredible. And at, at RSA conference, um, I had my first opportunity to spend time with, with security practitioners and really sort of understand what, what they're up against. And, and, and it's incredibly challenging with the alert fatigue.

And to your point, the disparate tool sets. There, there is a consolidation movement happening that I see as an analyst. You know, uh, it's a, it's an amazing stat.

The average mid-market organization is managing upwards of 75 to a hundred security point solutions. And that's really untenable long term. It's difficult, um, to manage that.

And so I like the point that you made around using AI and automation in, in logical ways to sort of reduce that fatigue, but still provide analysts, you know, the necessary tools so that it's not just completely automated. Because I think that's also one of the concerns, uh, that, that may be warranted or unwarranted around will, will generative AI basically replace a SOC analyst. And I know that that's sort of an unscripted, um, point, but I'd love to get your, your take on on that sort of notion or idea.

Uh, so yeah, and, and interesting fact, I do have a lot of experience with this. Uh, so I started about five, six years ago is when I started bringing in automation and SOAR into our soc, um, very, very mature. And we've also started bringing in a lot of ai, and we've been doing AI in it for about three plus years.

Um, and it's really interesting looking back after the fact, I mean, it is, it completely changed the way we, we, we were working. Um, but looking back on the fact, there was a lot of lessons learned that I think people do need to think about. Uh, so for first, you know, before we started, uh, you know, there, there are studies done and we followed along with this, but there's about 20% of, uh, alerts actually get investigated, right?

Yes. And, you know, so that goes to that alert for take. I mean, there's just so much.

I mean, we were dealing with millions, um, of alerts, you know, just flowing in a million, uh, millions of logs flowing in thousands of alerts. Uh, we had a very large, uh, implementation, um, but we couldn't do that. So with automation, we brought in risk-based alerting.

We fixed that. We were actually able to do a hundred percent of alert triage, right? And so that really helped.

Um, and so we could actually say that we are finally alerting on everything, but then what we found out is in that automation and start starting to bring in that things were being closed in correctly, or there wasn't enough data and they were just being marked as false positives. And so that, you know, then you're like, oh, well we can't. So now we needed to pull back on that automation and really change the analyst portion.

We didn't have tier one, tier two or tier three analysts anymore. We had like case managers, right? And so they would get the case, they would review, find out what's get missing, and then, you know, do an investigation or kickoff different automations.

And then we brought in ai, and AI really helped with that because it would help to determine, hey, this is something we can't make a determination on. And it kind of went from that signature base to more of that, uh, anomaly base, right? It's like, oh, hey, here are things that we want you to actually take a look at and not, and that actually really helped too.

But then what we found is, you know, a couple years later after that, we were finding that one, my analysts were kind of losing some of the skills, right? Because they were relying too much on the automation and ai. But when we started to investigate, you know, a lot of those alerts, they weren't, they weren't fully investigated correctly or completely like, it can only take you so far.

And so again, we had to pull back and kind of change how the AI worked and how did the automation worked. And, uh, so I don't think that, I don't think anytime soon we will get to the point where we can remove the analysts out. Uh, our big approach at Splunk, uh, and something I'm, uh, firm believer on is automation, ai, generative ai, machine learning, deep learning, all are there to support the analyst and make them more effective, uh, to make them more efficient and more accurate and consistent.

Um, so I don't think it's gonna happen anytime soon where we replace. I know people want that, but, uh, there's just too many like unknowns to really make that happen. I, I totally agree with you, Chris.

And you know, I think one of the, the other superpowers with gen AI is the ability to generate, uh, sit reps, you know, situation reports. Yeah. Security's gotta be a team sport, right?

And you've gotta be able to communicate that to all parts of the organization, legal, human resources, engineering, executive management, and the ability to use Genai as a complimentary tool to generate that. What, what can be sort, sort of a mundane task for an analyst, as an example, can free them up to do the more important investigation work, right? So I, I think that's another superpower, but I agree as we sort of wind down our conversation, I, I'd I'd love to touch on specifically what Splunk is doing to make this all a reality, because certainly you're known for your federated approach to data as well as unifying the whole notion of, uh, sec, you know, security operations.

So can you, can you go a little bit deeper and sort of talk about, can you point to some things that, that you're focused on today to sort of drive that home? Yeah, definitely. Um, you know, so we have ES which has been, you know, state, uh, table stake for enterprise or for security, um, with Splunk.

And then we've really started adding on a lot more features around es, uh, to really start helping and making that unified and really maximizing the, the use of the logs that we're bringing in and really helping to, uh, enable, um, those analysts, like with the tech analyzer, uh, being able to, you know, do malware detonation and, you know, pull in additional threat intel and, you know, look through, um, files and things like that has been, yeah, something that really has helped the analysts. Then we released ari, which is our, um, asset risk intelligence. And now that's really just going and getting all of the history and background of all of your assets.

Like where have they been, what have they logged into, what have they connected to, uh, what have been the IPS over the last 30 days, right? Really, again, giving that intelligence, those analysts, right? Yeah.

And then, you know, we had SOAR already, but with the, you know, the launch of, you know, ES eight coming out, uh, actually today when this, uh, goes live is, uh, we are combining all of these together and bringing it in, adding case management, adding AI assistance, like you said, to really help with, uh, that, uh, report generation and the summary generation. And so we're looking at what does an analyst do day to day and what are what, how can we make sure they have all the tools at their fingertips? And then, you know, going beyond that is, like you said, the federated search.

The federated model is, we know not all data is gonna be in Splunk. We know you've got all of the other tools, you know, there's all the hundreds of tools that everyone has. And maximizing the location, knowing what needs to come in for that fast detection and response, and knowing what you don't need that you use for your investigation.

Um, and so I think that whole process is something we're really trying to build and bring to the market, uh, and making it easier for our analysts to be more resilient and more effective. You know, from my perspective, what you do from an observability standpoint with, with data and logs and that sort of thing is exceptional. Um, I really can't think of, you know, any other company that, um, does it as well as you do.

And, and that is super critical just to sort of understand the gaps and, uh, and what needs to be addressed there. So, and I, um, you know, I wrote, I've written about you, you know, numerous occasions on, on Forbes and have spoken to that point, but I do think it's a superpower that, um, and I keep using the superpower theme. I don't know, I'm kind of on a marvel kick today, but, but it truly is a superpower.

But hey David, thank you for the time. It's been a, a very enlightening conversation. Any, any final thoughts to leave with our viewers before we, uh, sign off?

Um, yeah, I mean, definitely one of the things that, uh, I really think we should hit on as well is just that Cisco and that Splunk better together story, right? Cisco massive with network telemetry, really big on observability, and you hit on that with the observability as well. And with us combining the observability products with us, bringing in their network telemetry, network tools and being really integrated with, uh, ES and with Splunk and with their XDR, like talis that I mentioned earlier, is we really feel like this was the merger needed to really take, uh, Splunk to that next level and really become that security, uh, household name, right?

And knowing that we know how to bring all of that data logs together, uh, I just think that that's something that sometimes that's scaring people, you know, having us come together, but honestly from the outside, uh, and then coming in and then being a part of this, uh, I'm really excited about where we'll be able to go. Yeah, I, it's a super powerful combination and I think there's more to come, you know, in the, in the near future. But, but hey David, thanks for the time.

It's been a great conversation. Well, I wanna thank all of our viewers for tuning in to, uh, this Splunk session during the cybersecurity track at six five Summit. We've got a lot of other great tracks as well within cybersecurity, as well as other categories.

So be sure to tune in. And David, thanks again for your time. No problem.

Thank you so much for letting me join.