XM Cyber and Splunk Integration

Unified cybersecurity management and awareness

Challenge

Today’s challenging cybersecurity landscape offers an over-abundance of cybersecurity tools. As the number of breaches proliferates, so do the solutions and technologies designed to stop them. The state of cybersecurity is not getting easier to manage, and enterprises and organizations are spending more money than ever on new technologies and solutions. CISOs, CIOs, and other enterprise executives need a unified view of their entire cybersecurity ecosystem. Comprehensive visibility and monitoring is the only way to continuously maintain proper cyber hygiene.

Solution

Designed for security and risk management leadership, XM Cyber‘s Continuous Controls Monitoring platform empowers decision makers with a unified dashboard of their organizations’ entire cybersecurity ecosystem.

XM Cyber can be fully deployed within an enterprise in a few hours, enabling easy identification of weaknesses, reduction of mean-time-to-detect (MTTD), prevention of breaches, and advancement of cybersecurity posture and maturity. Through XM Cyber’s partnership with Splunk, leaders receive alerts from XM Cyber on key aspects and issues in Splunk Enterprise Security such as configuration, incident and investigation management, password policies, user and role administration, and more. This integration helps enterprises manage their cybersecurity environment and continuously monitor their cybersecurity ecosystem posture.

Key  Features

• Identifies cybersecurity tools that are misconfigured, malfunctioning, or missing
• Finds security gaps and provides recommendations for fixing
• Builds an ongoing security program to ensure alignment with new threats
• Uses continuous analytics to send alerts when there are deviations from normal behavior
• Automatic reporting

The integration between XM Cyber and Splunk offers CxOs powerful and effective resilience visibility along with

compliance validation and controls, to secure and monitor Splunk in an unprecedented manner.

XM Cyber’s Continuous Controls Monitoring platform deploys to the corporate network automatically, in a matter of a few hours, predefined with security domains and CSC measurements to deliver three unique cybersecurity ecosystem views:

• First, it provides organizations with the best indicators of the cybersecurity tools that may be misconfigured, malfunctioning, or missing and should be added to provide complete cybersecurity protection.
• It then reveals the security gaps that exist in each security domain and delivers continuous proactive recommendations to close these gaps.
• Finally, XM Cyber’s machine learning analytics engine continuously calculates online measurements that represent normal behavior, and then alerts when a deviation from normal behavior is detected.

Fast  and  Secure  Deployment

The XM Cyber Continuous Controls Monitoring connector for Splunk Enterprise Security receives security and configuration data from the Splunk server via a secure REST API.

Key  Features  &  Benefits  of  Continuous  Controls  Monitoring

• Cyber Hygiene Analysis and Reporting for Managers: Alerts and reporting regarding Splunk current configuration implementation status based on vendors’ and security standards best-practices, including security configuration issues, incidents and investigations management, admins and roles administration, and more.
• Customizable  Views  and  Reports: XM Cyber is highly customizable – all views and reports can be copied and modified to an organization’s specific needs and structure. The integration between XM Cyber and Splunk offers CxOs powerful and effective resilience visibility, as well as compliance validation and controls.
• Reduced Incident Analysis Time: XM Cyber provides continuous alerts on deviations from normal behavior regarding Splunk implementation and effectiveness, along with near real-time continuous monitoring of relevant security issues.
• Continuous Incident Response: CISO and other relevant managers in the organization, along with the Splunk technical owners, receive continuous mitigation recommendations and steps to improve as well as ways to secure and monitor Splunk implementation, effectiveness, maturity, and resilience, in an unprecedented manner.

Key  Use  Cases

About Splunk

Splunk (NASDAQ: SPLK) is the world’s first Data-to-Everything Platform, designed to remove the barriers between data and action for everyone to thrive in the Data Age. We’re empowering IT, DevOps and security teams to transform their organizations with data from any source and on any timescale. Splunk helps organizations ask questions, get answers, take actions and achieve business outcomes from their data. Organizations use market-leading Splunk solutions with machine

learning to monitor, investigate and act on all forms of business, IT, security, and Internet of Things data.