Splunk

Splunk is a unified security and observability platform offered by Passus S.A. as an Elite Partner. It covers three primary domains: security, observability, and operational technology (OT). **Security:** - Splunk Enterprise: Collects, stores, and analyzes machine data from physical, virtual, and cloud environments. Enables near-real-time search and monitoring of user transactions, system interactions, device behavior, and security incidents including abuse, attacks, and data leaks. - Splunk Enterprise Security (SIEM): Manages and correlates logs and activities from security systems, operating systems, business applications, network devices, and databases. Analyzes behavioral patterns to assess impact on organizational continuity. - Splunk SOAR: Enables security teams to automate tasks, orchestrate workflows, and handle SOC functions such as event management, collaboration, and reporting to reduce incident response times. **Observability:** - Splunk IT Service Intelligence (ITSI): Monitors, analyzes, and manages IT services by integrating logs, metrics, and events. Supports problem identification, failure prediction, root cause analysis, and system performance optimization. - Splunk Infrastructure Monitoring: Provides real-time monitoring of infrastructure, resources, and applications, delivering performance, availability, and resource utilization data. - Splunk Application Performance Monitoring (APM): Monitors application performance in real time, enabling identification, diagnosis, and resolution of application performance issues. **OT Security:** - Splunk Edge Hub: Addresses security for endpoint devices and industrial systems, targeting threats such as malware, phishing, trojans, spyware, adware, rootkits, and zero-day attacks across endpoints, physical/virtual application servers, and data center databases.