Splunk on Google Cloud

Splunk Enterprise Security is a next-generation security information and events management (SIEM) system on modular security frameworks with efficient detections based on correlation searches of essential data sources mapped to Splunk’s Common Information Model. It includes 12 cloud security analytic stories with 49 detection rules that cover Google Cloud, Kubernetes, and cloud infrastructure.

After reducing the time it takes to detect a threat, the next step is to reduce the time it takes to respond to a threat. Splunk SOAR (security orchestration, automation, and response) platform accomplishes this with playbooks that use actions for Google Cloud technologies, such as Compute Engine, Identity and Access Management (IAM), and Cloud Storage.

Chrome has partnered with Splunk on a new integration to collect, analyze, and extract insights from security events to identify high-risk behavior. These events can include password changes, unapproved password reuse, data exfiltration, unsafe site visits, and malware transfer events within managed Chrome browsers.