Splunk expands machine learning capabilities

Splunk Inc. has announced expanded machine learning capabilities across its product portfolio with the release of their Enterprise 7.0, IT Service Intelligence (ITSI) 3.0, User Behavior Analytics (UBA) 4.0 and updates to their Cloud platform. Splunk also introduced an updated suite of solutions that apply analytics and machine learning to fraud and cloud monitoring use cases.

“Machine learning is critical to customer success and to the evolution of Splunk. Our seamlessly integrated capabilities open up machine learning to everyone, enabling our customers to better predict future outcomes and more effectively analyze their data,” said Richard Campione, chief product officer, Splunk. “Data is a strategic advantage and organizations are looking for the fastest, most efficient way to turn data into answers. With machine learning and metrics advancements that anyone can use, Splunk Enterprise 7.0 and Splunk Cloud powerfully deliver mission-critical answers faster and easier than ever before.”

Splunk Enterprise 7.0 and Cloud help customers better monitor, investigate and gain intelligence with their data, while delivering massive improvement in performance and scale. Support for metrics accelerates monitoring and alerting by at least 20x, and optimizations to core search technology deliver 3x speed improvement. With these enhancements, customers can use their platform to predict future IT, security and business outcomes through integrated machine learning techniques backed by powerful, extensible algorithms. These machine learning advances enable users to collect, prepare, transform, explore, visualize and publish data insights.

Key New Features:

- ITSI 3.0: The latest version of ITSI revolutionizes event monitoring by combining service context with machine learning to help identify existing and potential issues, prioritize restoration of business-critical services and deliver analytics-driven IT operations. ITSI 3.0 applies service context, including dependencies, to events and employs machine learning to reduce the noise of alert fatigue and surface only the most critical information.

- UBA 4.0: The new version of UBA enables customers to create and load their own machine learning models to identify custom anomalies and threats via UBA’s new software development kit (SDK). This first-of-its kind capability opens up UBA to the world, giving users more power to detect insider attacks and automate correlation of anomalous behavior into high fidelity threats.

- Machine Learning Toolkit: Free to any customer, the Machine Learning Toolkit (MLTK) is a data science application that anyone can use to predict future IT, security and business outcomes. Recent updates include machine learning model management, which integrates user permissions via an intuitive user interface. In addition, the MLTK now includes public machine learning APIs for open source and proprietary algorithms, and a data prep module to help customers prepare and clean their data before initiating machine learning modeling.

New Releases:

- ES Content Update: Bringing human intelligence and machine data closer, Splunk Enterprise Security (ES) Content Update is a new subscription service that offers pre-packaged security content to ES customers. ES Content Update will regularly deliver dynamic new content to security practitioners to detect specific threats, help security teams investigate threats and manage the decision-making process to make it easier to choose responses.

- Security Essentials for Fraud Detection: Security Essentials for Fraud Detection is a free Splunk app that guides customers on how to use Splunk to identify and investigate different types of fraud, including healthcare, payment card and transactional fraud. Using MLTK and a range of data analysis functions, Security Essentials for Fraud Detection makes it easier for customers to understand and adapt fraud use cases for their own environments.

- Insights for AWS Cloud Monitoring: Also available in the Amazon Marketplace as an Amazon Machine Image (AMI), Insights for AWS Cloud Monitoring provides organizations with an analytics-based approach to cloud monitoring. This solution offers real-time awareness of performance, security, operational and cost management insights from Amazon Web Services (AWS).

- Insights for Ransomware: Insights for Ransomware is a solution priced per user that provides organizations with real-time insights for proactive assessment and rapid investigation of potential ransomware threats.

- Booz Allen Hamilton Cyber4Sight: A solution which empowers security analysts and threat hunters with actionable threat intelligence, Cyber4Sight for Splunk is now generally available. The new app combines cyber insights and security intelligence from Booz Allen’s threat intelligence service with analytics-driven security insights from Splunk ES.

The announcements were made at .conf2017: the 8th Annual Splunk Conference.