{"id":20332,"date":"2021-04-23T13:42:03","date_gmt":"2021-04-23T11:42:03","guid":{"rendered":"https:\/\/datanets.ro\/?p=20332"},"modified":"2021-05-04T11:16:31","modified_gmt":"2021-05-04T09:16:31","slug":"splunk-uba","status":"publish","type":"post","link":"https:\/\/datanets.ro\/en\/splunk-uba\/","title":{"rendered":"Discover unknown threats with Splunk UBA"},"content":{"rendered":"

Hidden threats, inside risks, and sophisticated attacks are difficult to detect using traditional security solutions. Splunk UBA (User Behavior Analytics) helps companies control this type of threat using advanced analysis and Machine Learning technologies and integration with the Splunk Enterprise SIEM system. Early detection of unknown or internal threats is becoming increasingly difficult for companies, due to the increase of cyber-attacks and the diversification of penetration and propagation methods.<\/p>\n

\"\"<\/p>\n

Internal threats, in turn, are also increasing. According to ENISA<\/strong><\/a> data, last year 88% of organizations considered “insider threats” a real danger. And 40% said that their critical business data was vulnerable to such types of risks.<\/p>\n

However, the difficulty of detecting threats is also due to the fact that the IT departments are struggling with large volumes of false-positive alerts. According to studies, in 2017, a big company received, on average, over 10,000 alerts per month. More than half (52%) of these were false-positives, while almost two-thirds (64%) were redundant. For this reason, companies investigated only 56% of daily security alerts, according to the Cisco<\/strong><\/a> report from the same year. After four years, the situation did not improve.<\/p>\n

 <\/p>\n

Splunk UBA, the answer to hidden threats <\/strong><\/h2>\n

 <\/p>\n

The Datanet solution for this cumulative problems is Splunk Enterprise Security (ES)<\/strong><\/a>, a SIEM system that helps companies to identify, investigate, and quickly respond to threats and attacks and anything abnormal activity that tends to affect their activity. The early detection capability of the SIEM system is enhanced by integration with the Splunk User Behavior Analytics (UBA) application. The UBA solution automatically detects abnormal behavior of users, equipment, applications, and privileged accounts, aggregates them into patterns, and delivers actionable information.<\/p>\n

For this, Splunk UBA uses advanced methods of modeling and behavioral analysis, as well as Machine Learning (ML) algorithms. With the help of aggregated data from multiple sources (via Splunk ES), the solution detects and associates in real-time the identity of users with IP addresses and the patterns discovered. ML algorithms and peer group analyzes, which use categories of users to assess and classify their behavior, ensure that any deviation from established patterns is identified.<\/p>\n

Splunk UBA thus ensures the detection of cases of:<\/p>\n