OT Security Add-on for Splunk

Overview

Details

The OT Security Add-on for Splunk enables organizations that operate assets, networks, and facilities across both IT and OT environments to better apply the globally proven SIEM, Splunk Enterprise Security, to improve threat detection, incident investigation, and response. The OT Security Add-on for Splunk expands the capabilities of Splunk’s platform to monitor for threats and attacks, compliance, incident investigation, forensics, and incident response across the broad spectrum of assets and topologies - from email servers to PLCs - that define modern manufacturing, energy, and public sector organizations.

Components of this solution include:
OT Security Overview
Perimeter Monitoring
Infrastructure Monitoring
Centralized view across partner technologies.
NERC CIP Compliance Reporting
Correlation Rules including mapping to security frameworks like MITRE ATT&CK for ICS, CIS 20, and others
Integration with Enterprise Security
Dashboards designed to help you identify misconfigurations and missing data

The OT Security Add-on for Splunk REQUIRES Splunk Enterprise Security.

For any OT related sales conversations, please contact otsecurity@splunk.com

The Splunk for OT Security app requires Splunk Enterprise Security.

This app utilizes the Common Information Model app and ES's Asset and Identify Framework to identify specific threats to the OT environment. In addition, it utilizes two included data models for extended asset info including hardware and software and integration with partner technologies.

Components of this solution include:

OT Centric View of Assets: Overiews, Asset Views, Perimeter & Infrastructure Monitoring
NERC CIP Compliance Dashboards and Reports: CIP 002,004,005,006,007,008,009,010
Correlation Rules (including MITRE ATT&CK for ICS): Prebuilt correlations searches for detections specific to the OT environment (e.g. Internet activity inside OT environment)
Key Security Indicators: Prebuilt KPI's for Security related to OT Security
Baselining: Build configuration baselines for hosts interactively within Splunk
Analytics Stories: View related content based on specific scenarios and use cases
Integration with Enterprise Security including features like [Risk Based Alerting (RBA)](https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Implementing_risk-based_alerting)

Full documentation on the OT Security Add-on for Splunk can be found below (including how to install and configure the Add-on):
Documentation

Release Notes

Version 2.3.3

Feb. 7, 2024

Update for missing metadata folder preventing the nav menu from showing

Version 2.3.1

Dec. 1, 2023

Added Baseline Templating
Add Data Source Integration Dashboard to help identify gaps in data or mis-configurations
Added UDF Dashboard of XML Dashboards

Version 2.2.0

March 6, 2023

The latest edition adds several key features to help you move beyond the perimeter and beyond monitoring your OT Infrastructure as well as great integration with security frameworks. Specifically this update includes:

Native integration with MITRE ATT&CK for ICS and built in mappings to CIS 20, MITRE ATT&CK, NIST, and Kill Chain)
Content added for OT Infrastructure Monitoring and centralized view for OT Security Solutions
Additional Risk Based Alerting Integration
Baselining Assets Configurations with new GUI
Use case library analytic stories
Additional features to customize asset names and assets that are part of the OT Environment
Various fixes and improvements

Version 2.1.1

Jan. 4, 2022

4 Additional Dashboards focused around Perimeter Security (Monitoring, Auditing, Remote Access, and Traffic Analysis)
5 Additional Reports focused around Perimeter Security
10+ Additional KSI searches
5 Additional Correlation Searches
Added integration with Vulnerabilities Data Model
Added various macros to allow easier customization of dashboards and content
Added lookup to standardize asset types and their name customizable to products and user environment
Added asset and user filters to NERC CIP content dashboards
Added dashboard content around logical ports and services
Added additional documentation on integrating partner technologies into the OT Security Add-on
Updates of MITRE ATT&CK for ICS correlation searches for more improved integration
Updates to Enterprise Security 6.6 for new ES features like Risk Based Alerting
Fixed issue with Operational Security navigation menu missing

Version 2.0.2

March 16, 2021

Site and System Filtering Added for OT Security dashboards
4 new MITRE ICS Rules detections added
Additional rules for integration with 3rd Party OT Security Solutions
Review and update of existing correlation rules
CIP 006 Dashboards and Reporting Added
CIP 007 Dashboards and Reporting Added
CIP 008 Dashboards and Reporting Added
CIP 009 Dashboards and Reporting Added
Added Splunk Cloud compatibility

Version 2.0.1

Feb. 9, 2021

Version 1.0.4

Oct. 20, 2020

Added Dashboard - OT Controls : Network North South Traffic Analysis
Added Dashboard - OT Controls : Network & System Access
Added NERC CIP 004 Dashboards
Incremental updates on existing dashboards and correlation searches

3,259

Downloads

Share Subscribe

Version

Built by

Splunk Works

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate

Compatibility

Products: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

Products: Splunk Enterprise, Splunk Enterprise Security

Products: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

Products: Splunk Enterprise, Splunk Enterprise Security

Splunk Versions: 9.2, 9.1, 9.0, 8.2, 8.1