Background:
A leading banking and financial services company want to detect early on whether employees are transferring sensitive data. By using Splunk and analyzing data in real-time, the company catches threats sooner and takes the steps necessary to mitigate them before they can cause damage.
Challenges:
- Thousand files/protocol types to report/act on
- File transmission status, Suspicious File Uploads, User anomalous activities, Compromised accounts
- Troubleshooting required manual login to multiple systems to identify the root cause for transmission failures/abnormal behavior
- Monitor and Manage SLAs for several thousand File transmissions
Solutions:
- Centralized File Transmission tracker dashboard for global file transmissions with user interactive drill-downs that tracks transmission time, status, file format, file size, etc.
- Alerts on Suspicious File Uploads – Splunk matches logs with allowed file formats for malicious activity.
- Infosecurity dashboard to track User Anomalous Activity across the globe using Machine Learning techniques and interactive visualizations such as Choropleth/Clustermaps
- Automated alerting setup for File Transmission SLA management: Proactive and Reactive alerts if an SLA is missed or about to be missed
Benefits:
- Improved Security Posture – Early Threat detection and response and cost savings
- Reduced Cycle time (improved MTTR)
- Improved File Transmission SLAs
- Single UI with End-to-End view of a system depicting File transmission status in real-time
Monitored Systems/Data Sources: Centralized File transmission servers (10,000+ files), No. of Transmission Protocols – 14
Users: Operations Team, Information Security Team
Product: Splunk Enterprise
