Splunk Unveils Unified Portfolio Innovations at .conf23 for Enhanced Digital Resilience

Splunk Inc. , the cybersecurity and observability leader, unveiled new product innovations to its unified security and observability platform at the company’s annual user conference, .conf23.

The advancements span Splunk’s portfolio and empower SecOps, ITOps and engineering teams with unified experiences and workflows so they can detect threats, investigate and respond — quickly, accurately, and at scale. These innovations build on Splunk’s unified security and observability platform and paired with Splunk AI offerings, provide organisations with unparalleled visibility across their hybrid environments to optimise costs, accelerate detection, investigation and response and drive digital transformation.

The inability to address incidents – whether a security threat or a customer-impacting disruption –
hinders an organisation’s ability to remain competitive. By unifying security and observability processes and technologies, organisations can help ensure their digital systems remain resilient. According to a recent ESG report, 55% of senior IT decision-makers say observability enabled them to gain more insight into vulnerabilities, and 51% said the observability remediation capabilities enabled their security teams to act faster. It’s clear SecOps, ITOps and engineering teams need tools that cut through operational complexity and provide shared visibility across their tech stack to drive efficient incident response.

Enhance Unified Security Operations with Automated Threat Analysis from Splunk Attack Analyser
Today’s security operations teams are overwhelmed by alerts, manual processes and siloed tools and lack the context needed to scope complex attacks. Splunk Security products provide a unified solution that integrates Splunk’s industry-defining security technologies across detection, investigation and response to simplify these workflows and reduce alert fatigue. With Splunk’s enhanced unified security operations experience, customers can automate 95% of their incident response tasks.

The addition of Splunk Attack Analyser (formerly Twinwave) to this unified experience ushers in a novel approach to enable security teams to automate the analysis of malware and credential phishing attacks to uncover complex attack techniques used to evade detection. Through an integration with Splunk SOAR, Splunk Attack Analyser enables security analysts to automate threat forensics that provide accurate, timely detections and reduce the time and resources spent on manual investigations.

Drive Exceptional Customer Experiences with Splunk Observability Cloud and Splunk Cloud Platform integrations
Centralised workflows and troubleshooting tools foster better customer experiences. With the preview of the OpenTelemetry Collector as a technical add-on (TA), Splunk Platform customers can more easily adopt Splunk Observability Cloud and deploy the Collector alongside their existing forwarders to capture metrics and traces. This new feature eliminates the headaches of deploying and managing two agents by providing customers with a unified view of their infrastructure and services. The introduction of the Collector is a milestone in Splunk’s commitment to the OpenTelemetry project and the open-source community by helping customers transmit their data with less complexity and greater flexibility.

With Splunk’s new Unified Identity, ITOps practitioners and engineers can now seamlessly and immediately access Splunk Cloud Platform and Splunk Observability Cloud data with one user identity. As a result, customers can enjoy an improved login experience and instantly access log data from Splunk Cloud Platform data for faster troubleshooting. The integration provides ITOps practitioners and engineers with a common set of visualisations for more agile cross-team alignment to drive rapid detection and response.

Unparalleled Visibility Across Any Environment – From Edge to Cloud – with Splunk Platform Enhancements
Having comprehensive visibility from edge to cloud is the bedrock of resilience. The latest advancements in Splunk Cloud Platform and Splunk Enterprise 9.1 enable SecOps, ITOps and engineering teams to visualise data flows across their entire tech stack to foster deeper collaboration, so organisations can scale their operations to respond rapidly and minimise disruptions. Platform enhancements include:

• Ingest Actions now expands capabilities for routing data to multiple, distinct Amazon S3 buckets, enabling greater granularity in data management.
• The new Federated Search for Amazon S3 preview offers a unified search experience of data at rest in Amazon S3 buckets – without having to ingest that data to Splunk – and across Splunk instances and third-party data lakes through its integration with Ingest Actions and Edge Processor for better data movement. In turn, customers avoid latency and unnecessary charges.
• Edge Processor featuring SPL2 now enables data ingestion and export to Splunk using HTTP Event Collector (HEC), making it easier to manage data. In addition, to complement data sovereignty and compliance needs, users can set default destinations per Edge Processor for more flexibility in routing.