Product advancements for SecOps, ITOps and engineering teams include Splunk Attack Analyzer, OpenTelemetry Collector, Unified Identity and more

Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, today unveiled new product innovations to its unified security and observability platform at the company’s annual user conference, .conf23.

The advancements span Splunk’s portfolio and empower SecOps, ITOps and engineering teams with unified experiences and workflows so they can detect threats, investigate and respond — quickly, accurately, and at scale. These innovations build on Splunk’s unified security and observability platform, and paired with Splunk AI offerings, provide organizations with unparalleled visibility across their hybrid environments to optimize costs, accelerate detection, investigation and response and drive digital transformation.

The inability to address incidents - whether a security threat or a customer-impacting disruption - hinders an organization’s ability to remain competitive. By unifying security and observability processes and technologies, organizations can help ensure their digital systems remain resilient. According to a recent ESG report, 55% of senior IT decision makers say observability enabled them to gain more insight into vulnerabilities, and 51% said observability remediation capabilities enabled their security teams to act faster. It’s clear SecOps, ITOps and engineering teams need tools that cut through operational complexity and provide shared visibility across their tech stack to drive efficient incident response.

Enhance unified security operations with automated threat analysis from Splunk Attack Analyzer

Today’s security operations teams are overwhelmed by alerts, manual processes and siloed tools and lack the context needed to scope complex attacks. Splunk Security products provide a unified solution that integrates Splunk’s industry-defining security technologies across detection, investigation and response to simplify these workflows and reduce alert fatigue. With Splunk’s enhanced unified security operations experience, customers can automate 95% of their incident response tasks.

The addition of Splunk Attack Analyzer (formerly TwinWave) to this unified experience ushers in a novel approach to enable security teams to automate the analysis of malware and credential phishing attacks to uncover complex attack techniques used to evade detection. Through an integration with Splunk SOAR, Splunk Attack Analyzer enables security analysts to automate threat forensics that provide accurate, timely detections and reduce the time and resources spent on manual investigations.

Drive exceptional customer experiences with Splunk Observability Cloud and Splunk Cloud Platform integrations

Centralized workflows and troubleshooting tools foster better customer experiences. With the preview of the OpenTelemetry Collector as a technical add-on (TA), Splunk Platform customers can more easily adopt Splunk Observability Cloud and deploy the Collector alongside their existing forwarders to capture metrics and traces. This new feature eliminates the headaches of deploying and managing two agents by providing customers a unified view of their infrastructure and services. The introduction of the Collector is a milestone in Splunk’s commitment to the OpenTelemetry project and the open-source community by helping customers transmit their data with less complexity and greater flexibility.

With Splunk’s new Unified Identity, ITOps practitioners and engineers can now seamlessly and immediately access Splunk Cloud Platform and Splunk Observability Cloud data with one user identity. As a result, customers can enjoy an improved login experience and instantly access log data from Splunk Cloud Platform data for faster troubleshooting. The integration provides ITOps practitioners and engineers a common set of visualizations for more agile cross-team alignment to drive rapid detection and response.

Unparalleled visibility across any environment - from edge to cloud - with Splunk Platform enhancements

Having comprehensive visibility from edge to cloud is the bedrock of resilience. The latest advancements in Splunk Cloud Platform and Splunk Enterprise 9.1 enable SecOps, ITOps and engineering teams to visualize data flows across their entire tech stack to foster deeper collaboration, so organizations can scale their operations to respond rapidly and minimize disruptions. Platform enhancements include:

• Ingest Actions now expands capabilities for routing data to multiple, distinct Amazon S3 buckets, enabling greater granularity in data management.
• The new Federated Search for Amazon S3 preview offers a unified search experience of data at rest in Amazon S3 buckets - without having to ingest that data to Splunk - and across Splunk instances and third party data lakes through its integration with Ingest Actions and Edge Processor for better data movement. In turn, customers avoid latency and unnecessary charges.
• Edge Processor featuring SPL2 now enables data ingestion and export to Splunk using HTTP Event Collector (HEC), making it easier to manage data. In addition, to complement data sovereignty and compliance needs, users can set default destinations per Edge Processor for more flexibility in routing.

For more information on Splunk’s latest product innovations to its unified security and observability platform announced at .conf23, visit the blog links below:

• Security news
• Observability news
• Platform news

Supporting Quotes:

"We are in the business of delivering happiness, something we can't do without continuous, real-time access to the data and systems we need to keep our business secure and reliable," said Devon Bryan, Global Chief Information Officer, Carnival Corporation. "We want to provide extraordinary customer experiences on our cruises that keep guests coming back again and again. That’s where we are and where we’re headed, and I can’t think of a better partner to help us get there than Splunk.”

"As the digital landscape evolves, organizations really need a holistic approach to security and observability. A comprehensive strategy can help security teams safeguard their valuable assets, detect and address potential threats proactively, ensure regulatory compliance, maintain operational continuity and build trust among their stakeholders," said Jon Oltsik, Distinguished Analyst and Fellow at TechTarget’s Enterprise Strategy Group. “Splunk's latest innovations can help, as they are designed to empower and speed up IT operations, security operations and engineering teams' work and collaboration for detecting, investigating and remediating security issues.”

“Real-time cross-team collaboration is essential for a digitally resilient business, and SecOps, ITOps and engineering teams all share a need to detect, investigate and respond,” said Tom Casey, SVP & GM of Products and Technology at Splunk. “At Splunk, we’re excited to announce our latest innovations that empower these teams with shared data context, more unified experiences and the only integrated Security and Observability Platform powered by Splunk AI, so they can work together to make their systems secure and reliable.”

For more details on all of Splunk’s .conf23 announcements, please visit our newsroom.

About Splunk Inc.

Splunk helps build a safer and more resilient digital world. Organizations trust Splunk to prevent security, infrastructure and application issues from becoming major incidents, absorb shocks from digital disruptions, and accelerate digital transformation.

Splunk, Splunk>, and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2023 Splunk Inc. All rights reserved.

View source version on businesswire.com: https://www.businesswire.com/news/home/20230718908333/en/