WHITE PAPER

SECURITY INVESTIGATION AND RAPID RESPONSE

USING SPLUNK AND AMAZON WEB SERVICES (AWS)
 WHITE PAPER

Security Investigation and Rapid Response The Need for Security Investigation
with Splunk Enterprise, Splunk Cloud and Security investigation requires gathering
Splunk App for AWS foundational knowledge around alerts or
notifications and analyzing that information as
quickly as possible to determine what’s behind the
It’s what keeps you up at night. You’re
most critical issues. An analyst must quickly find
successfully delivering high quality IT
the required information to determine the who,
services and protecting critical assets at
what, where, when and how of the security threat,
your company. You receive an alert that
the impacts it might have on the company, and
some incident or breach may have occurred
what action to take.
that is impacting your organization and your
customers may be affected or their data Specific items to investigate are: who is associated
may have been compromised. To complicate with the alert and activity, where is the device
matters, your company recently migrated a or activity located (on-premises or on a public
portion of IT services to the cloud. So what or private cloud), what the alert is saying, what
do you do? activities are associated and related to the
attack or alert, when did the attack start, and
how to contain or disrupt the threat. Analysts
This scenario can happen at any time and can also need ways to determine if the system has
have a severe impact on any organization. When been infected or compromised, determine if the
an issue or unsuspected attack occurs, IT teams attack progressed beyond the infected system
often find out too late—learning only when or how far it reached. Whether for alerts, hunting
the company is affected, or when an asset or for an unknown threat or in a breach situation,
device has had an unauthorized config change. investigations can prove challenging for anyone—
Reputations are at stake as well – in many whether a dedicated analyst or person that plays
cases, notifications come from the individuals or multiple roles.
institutions consuming these services.
Data typically lives in siloed locations, and can
Investigation and rapid response for day-to-day come from many different security technologies
alerts are just as critical as hunting or addressing like firewalls, intrusion prevention systems, web
a breach situation. In all of these cases, response proxies, email protection systems, anti-malware,
time is critical. The faster a security team can endpoint protection suites, endpoint threat
verify a threat, scope the impact across both detection, and identity access management. Data
on-premises and cloud, and plot and initiate can also come from non-security technologies like
the right course of action, the more likely that asset databases, network infrastructure, document
damage will be minimal. That’s why security repositories, card readers, servers, applications,
teams and IT professionals need to find and and more. The number of silos increases with
remediate security problems as soon as possible. cloud deployments – between cloud services,
However, it is extremely difficult to investigate virtualized and hosted workloads, and off-prem
efficiently and with enough depth when the cloud investigations. All this data that is created is
story must be stitched together manually from known as machine data and is relevant for security
many different IT “silos.” investigations, hunting, and rapid response.

Security Investigation and Rapid Response Using Splunk and Amazon Web Services (AWS) 2
 WHITE PAPER

While machine data presents an opportunity • Look at the information provided by each and all
to gain security insights, the manual process of data sources and then add or remove those fields
verifying an alert and investigating the root cause from the display.
and impact of a breach across various locations
• Change the analysis timeframe to look back
can be challenging and time-consuming. By
in time, to fixed time windows or in real time –
centralizing and analyzing your machine data
this allows the analyst to understand activity
across silos, teams gain the knowledge necessary
sequencing and potential cause and effect
to assess, drill down into the specifics of why
relationships.
and where an incident occurred, verify, and take
action quickly, through a single pane of glass. • Apply different statistical operations to the
search results to aggregate, count, order the
While having visibility across silos is a great
results to determine anomalies.
starting point, verifying and addressing
threats over the long term requires a more • Apply different visualization techniques to the
comprehensive approach. search results to look for trends, patterns or both.

Security Investigation Defined These steps are often repeated in any order and
in any combination to allow the analyst to find
Security investigation is the ability to centralize,
the relationships across activities to determine
analyze, correlate, and visualize machine data to
what is malicious and what is normal. And once
verify and mitigate threats that pose harm, and to
any search criteria is established, the analyst will
alert and report on those threats in order to build a
set up a dashboard to monitor for that condition
strong defense against future attacks.
or set up an alert to be notified when the

Basic Principles of Investigation condition is encountered.

Security investigation requires multi-step analysis. Enter Splunk

There is a need to explore and interact with data
Splunk Enterprise and Splunk Cloud provide an
in order to identify evidence of infection or an
analytics-driven approach to security on the AWS
attack. It often starts with a small clue and then
Cloud that enables organizations to quickly and
the user must find relationships, common themes,
efficiently perform security investigations, hunt for
associations, and correlations in the data to
unknown threats, and embrace a rapid response
determine the impact and appropriate course of
program. Organizations can index and store all
action. The analysis consists of the following steps:
machine data from any source regardless of format
• Search for patterns across any data from cloud, or location – key security data sources include
on-prem or hybrid environments using a variety network, endpoint, identity, and threat intelligence
of methods – this allows the analyst to look for set as examples.
terms or related terms in different technologies.
Any combination of search criteria and
• Change the search pattern quickly by adding transformation, filtering, and analytical commands
or removing the pattern from the search – can be cascaded so a series of analysis can be
this allows the analyst to work through their performed. For example, in Splunk Enterprise, a
hypothesis on what to look for and follow the user can search for an infected IP address, count
indicators of compromise. all the results, filter by the top 10, and then graph

Security Investigation and Rapid Response Using Splunk and Amazon Web Services (AWS) 3
 WHITE PAPER

the results – all in a single Search Processing • Aggregate, count, and order the results with a drop-
Language™ (SPL) command. SPL enables a high down menu and apply different statistical analysis
degree of processing speed – for example, users of the search results to determine anomalies.
can directly pipe the result of any analytic step to
• Create visualizations and dashboards of the
another command for more efficient analysis.
search results to look for trends, patterns
Splunk security solutions give organizations the of activity and share the information with a
ability to investigate more alerts, faster and more broader range of people to collaborate and
accurately. Splunk software enables organizations to: respond quickly.

• Index all machine data regardless of format • Monitor their entire infrastructure – cloud, hybrid,
or location into a centralized view and extract and on-premises – with custom alerts and the
fields to easily find patterns, relationships, and visualizations that can be created, teams can
meaning. This is important to verify malicious make more informed decisions and eventually
activity and progression within an attack. preempt issues before they happen.

• Achieve better verification with guided multi- • Monitor cloud account activity –– using the
step processing of data to gain deep insights by Splunk App for AWS, cloud and security teams
searching data without schema or limitations. gain critical insights into their AWSaccount(s),
enabling them to add real-time visibility of
• Interact with data quickly and easily – with the
various AWS service components into their
field extractions and search result interactions
investigative process to help mitigate risk,
users can refine the search criteria, while
maintain compliance and conduct audits.
searching across all data irrespective of format to
determine next actions. When used for security investigation, the Splunk
platform helps users gain a range of analytical
• Search and investigate by a variety of techniques
capabilities, including visual analysis, graphical
across any data set more quickly – refine a search
representation of thresholds, alarms, and
by simply adding or removing SPL commands
indicators. Security knowledge and workflow can
to get the desired “search criteria,” providing the
be extended to broader data sets that can capture
ability to remove non-relevant fields and respond
and deliver insights to any team using applications
rapidly to the incident.
that are integral to your business. This helps teams
• Understand sequences of activities – users can collaborate and address the shortage of skills
change the time display of the analysis in real and empower less technical staff to easily solve
time to look at historical data or a specific time problems using their data.
window – this can help develop correlations of
By making it easy to collect and analyze data
possible relationship cause and effect.
from nearly any source, IT professionals and
• Gain complete control of analysis, based on security analysts can improve investigation and
time – the user can customize and describe the workflow effectiveness. Looking at all the data and
parameters of the timeline to understand when performing analytics allows security teams to get
and possibly why an incident might have occurred. a better view of their entire infrastructure and take
the necessary steps to reduce risks.

Security Investigation and Rapid Response Using Splunk and Amazon Web Services (AWS) 4
 WHITE PAPER

Managing Risk and Time Splunk solutions, including the free Splunk App for
AWS, enable you to:
With Splunk security solutions, teams can more
effectively manage risks to get back to focusing • Seamlessly transform data from your AWS
on business needs without having to continually environment (including AWS CloudTrail, AWS
look for and solve the same issues. This enables Config, Config Rules, Amazon CloudWatch,
security practitioners to spend their time on AWS Billing and Cost Management, Amazon
priority security issues and strengthening the Elastic Compute Cloud (Amazon EC2), Amazon
overall security posture rather than getting Elastic Block Store (Amazon EBS), Amazon
bogged down in manual data gathering or trying Simple Storage Service (Amazon S3), Elastic
to manually stitch the story together between Load Balancing, Amazon Virtual Private Cloud
what’s happening on-prem vs on the AWS Cloud. (Amazon VPC) Flow Log, Amazon Inspector,
Further, operations teams will have improved Amazon Relational Database Service (Amazon
collaboration and workflow and can document RDS), and Metadata inputs) into real-time
knowledge of issues that arise. security insights across users and resources.

Splunk Enterprise and Splunk Cloud can provide • Gain instant insight through pre-built dashboards
users the power to understand their challenge, and reports.
determine what actions to take, and investigate
efficiently to quickly determine if there is a • Identify and resolve AWS security risks
critical issue, so that security teams can focus
• Fulfill your role in the AWS shared responsibility
on analyzing and visualizing security insights to
model – ensuring security of workloads and
share and plan so the same issue doesn’t continue
applications running on AWS.
to happen. Splunk enables teams to collaborate
and gain end-to-end visibility across the entire • Analyze full audit trail of all user activity with data
infrastructure to help minimize damage and from AWS CloudTrail for real-time monitoring
disruption to the business. of critical security related events – including
changes to security groups, unauthorized user
Splunk and AWS access, and changes to admin privileges.
Splunk has closely aligned with AWS to deliver
• Gain real-time monitoring and topology
solutions that offer real-time visibility into your
visualization of all your AWS resources – enabling
cloud applications, infrastructure and AWS account.
you to view your entire environment in a single
With these solutions, you can monitor your AWS
topology diagram, monitor instance start/stops,
deployment using Splunk as well as deploy Splunk
and gain end-to-end visibility across all network
software as an AWS-based cloud service.
configuration changes.

Try Splunk now, no software installation required – try hands-on basic techniques with a guided walkthrough of
investigating a real “threat” in an online sandbox environment
Learn more about the Splunk App for AWS and see how it can help you gain visibility into your AWS accounts
Simplify your procurement process today and subscribe to Splunk Cloud on the AWS Marketplace

Learn more: www.splunk.com/asksales www.splunk.com

© 2017 Splunk Inc. All rights reserved. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light
and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,
product names, or trademarks belong to their respective owners.
© 2017, Amazon Web Services, Inc. or its affiliates. All rights reserved. WP-Splunk-Security-Investigation-Splunk-and-AWS-cobranded-101