Bytes Software Services

Splunk Threat Detection Investigation and Response Suite

Use any or all of Splunk’s Security products and services together to provide a unified security operations solution. On top of Splunk Enterprise or Splunk Cloud, combine Enterprise Security (SIEM), Mission Control, Splunk Attack Analyser (SAA), Splunk Threat Intelligence Management (TIM), Splunk SOAR, and Splunk UBA. bssgc

Features

• Advanced Fraud and cyber threat detection analysis with Machine Learning
• Information Assurance and security analysis
• Automate threat analysis of suspected malware and credential phishing threats
• Investigate activities associated with a potential security incident
• Risk Based Alerting - RBA
• Data-Centric Cloud Native Intelligence Management
• Simple and Scalable Security Orchestration Automation and Response
• Automated Playbooks with thousands of application integrations
• Identify and extract associated forensics for accurate and timely detections
• MITRE ATT&CK Matrix, Cyber Kill Chain Use Case Alignment

Benefits

• Enhance incident response and investigations using security data
• Collect, aggregate, de-duplicate, and prioritize threat intelligence from multiple sources
• Streamline security operations by conducting rapid investigations using ad-hoc searches
• Wide range of uses cases for SOC, SecOps and compliance
• Detect and reduce internal and external cyber threats/abuse
• Unify Security Data, Analytics and Operations
• Increase detection capabilities and optimize incident response
• Analyse ‘big data’ internet traffic and machine data
• Analyse machine data from systems with varying formats
• Exploit event sequences, alerts, risk scores and bespoke dashboards

£300 a user a month

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@bytes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

542546865673803

Contact

Chris Swani
+44 (0) 7951 326815
tenders@bytes.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: "Splunk Cloud is the base service; Splunk Enterprise Security & Mission Control runs on top of Splunk Cloud; Splunk SOAR Cloud can run as a standalone service; Splunk Attack Analyser is an add-on service but runs standalone; Splunk UBA is an add-on service that depends on Splunk Cloud"
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: "There are service limits associated with Splunk Cloud services that depend on the service level purchased and some hard limits based on the platform capabilities. These are subject to change from time to time in line with the development of the product and are identified here:; https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Service/SplunkCloudservice#Service_limits_and_constraints"
• System requirements: No system requirements for Splunk Cloud itself.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: "Premium Support and Standard Support have different SLAs; these answers are based on Premium Support.; P1= Availability 24x7x365, 30min response, 1hr update, 24hr target fix/workaround; P2= Availability 24x7x265, 1hr response, 4hr update, 1 business week target fix/workaround; P3= Availability 8am-5pm Business Days, 4hr response, 1 business day update, next release fix/workaround; P4= Availability 8am-5pm Business Days, 1 business day response, weekly update"
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: "3 support plan levels are offered- Base (free), Standard (included in subscription cost), Premium (extra cost).; See pricing details to compare costs at different tiers, and see the section on Support SLAs for details of differences in paid support plans.; Success Plans are offered as Standard or Premium, and come with OnDemand Services credits and Education credits.; TAM and Value Boost offer additional value-add services as well, with Technical Account Manager (TAM) service designed to accelerate issue resolution as a designated high-touch advisory resource to help advocate for customer needs, reduce technical risk, improve uptime, and accelerate your business outcomes with a named, attached Technical Account Manager. Value Boost service offers a named attached Designated OnDemand Services Consultant that knows your environment and has considerable product expertise, and a 90-day proactive assessment-led services engagement with 10-days of hands-on engineering designed and tailored to help customers accelerate realisation of important business outcomes.; ; "
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Splunk offers free and paid-for training courses for teams, free generic documentation, and can include knowledge transfer as part of onboarding and Professional Services engagements.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: "Data is copied from the original source into Splunk, so customer data may still remain in the original location.; Data stored inside the customer's Splunk Cloud environments can be exported to an agreed destination in a predetermined format at the end of the contract if the customer chooses to leave."
• End-of-contract process: If a licence is terminated Splunk can provide Professional Services at extra cost to help the Buyer to migrate their analytic needs to another supplier.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: "From phones and tablets, a user can access Splunk Cloud (including Enterprise Security) via an App for iOS or Android, or via a web browser (Splunk Cloud, Enterprise Security, SOAR, UBA, Attack Analyser, Threat Intelligence Management).; When accessing via a browser, not all features will display consistently compared to accessing from a laptop or desktop.; The iOS and Android apps only support the display of a subset of the chart and dashboard elements from Splunk Cloud and Enterprise Security, and don’t support drill-down behaviours or ad-hoc searching."
• Service interface: No
• User support accessibility: WCAG 2.1 AA or EN 301 549
• API: Yes
• What users can and can't do using the API: "Each service as part of the suite has its own APIs that are documented separately; the REST APIs are extensible for applications as well.; Compared to the customer-managed platform options, Cloud Services provide fewer REST API capabilities, but also makes available a different REST API interface- Admin Config Services- to administer ; Splunk Cloud - Admin Config Services - used for configuring IP allow-lists, outbound ports, private connectivity, managing app permissions, authentication tokens, HEC tokens, indexes, limits, both Splunkbase and private apps and add-ons, restarts, users, roles, capabilities, and integration with Splunk Observability Cloud from Splunk Cloud, plus viewing maintenance windows programmatically.; Splunk Cloud - REST endpoints are numerous and described in detail here: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTprolog"
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: "Core Splunk Cloud offering is designed for users to create their own searches, dashboards, and alerts to explore their data.; Additionally, different elements of the suite of services can be purchased that are described in this service.; Splunk Cloud- core data fabric service with searching, dashboards, alerts; Splunk Enterprise Security and Mission Control- SIEM service on top of Splunk Cloud; SOAR Cloud- security orchestration service alongside Splunk Enterprise Security, or stand-alone; Attack Analyzer- separate Cloud service for SOCs to perform automated threat analysis of attack chains; Subscribing to some or all of these services is customisable."

Scaling

• Independence of resources: "Each customer stack is provisioned and scaled separately; a customer's stack is sized appropriately for their ingest volumes or virtual-compute consumption.; As they are completely isolated from each-other, then there is no impact from increasing numbers of customers.; If an individual customer onboards more end-users to their stack and are using it more heavily, then this will be highlighted and they may need to consider scaling their usage for their purchased capacity, or purchasing more capacity."

Analytics

• Service usage metrics: Yes
• Metrics types: "Numerous metrics about consumption and performance are available from the Monitoring Console from the Customer's Splunk environment. ; "
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Splunk

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: Splunk's own cloud service uses logical data separation, authenticated user accounts, and industry standard hardening. Data in transit is encrypted with industry standard SSL and data at rest is encrypted with AES 256-bit encryption. This service is acccredited to ISO270001.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: From CSV exports, PDFs of dashboards, formatted data over webhooks or other web-based services and HTTP Posts, and data retrieval in CSV, XML, or JSON format via API-based searches, to archive-copies of data exported from Splunk Cloud to a customer's own S3-compliant storage, as well as a one-time end-of-contract export of all ingested data (this may incur additional fees).
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • JSON
  • Raw Data

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: "Splunk Cloud is considered available if you are able to log into your Splunk Cloud Service account and initiate a search using Splunk Software. Splunk continuously monitors the status of each Splunk Cloud environment to ensure the SLA of 100% uptime. In addition, Splunk Cloud monitors several additional health and performance variables.; ; Alternatively Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. Availability is controlled by the Buyer or their cloud provider."
• Approach to resilience: Splunk handles resilience by replication of data across a cluster of Splunk Indexers across data centres. Splunk Cloud maintains a seven-day backup of data and configuration files and backups run continuously.
• Outage reporting: "Splunk provides a cloud monitoring console to monitor the health of your Splunk Cloud environment. Email alerts are also available.; ; Alternatively Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. Outage reporting is the responsibility of the Buyer or their cloud provider."

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: The Splunk user authentication system allows the assignment of roles which provide custom permissions. The Buyer can define all roles using a list of capabilities and data access restrictions.
• Access restriction testing frequency: At least once a year
• Management access authentication: Other
• Description of management access authentication: "Splunk access to a Customer service is controlled by robust and automated, approval-driven separate request to approve limited time access which is automatically withdrawn at the end of the allowed period.; When an engineer or a PS consultant has approved access, their access requires VPN connection controlled by MFA, from an authorised, managed machine, and then combinations of public-key and federated access using controlled clients to access any servers. UI access is provided using unique username and temporary password access with restricted rights within the environment, and is automatically deprovisioned when the allowed period is complete."

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Schellman Compliance, LLC
• ISO/IEC 27001 accreditation date: 01/12/2023
• What the ISO/IEC 27001 doesn’t cover: Splunk Cloud
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • SOC2 Type 2
  • HIPAA

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our Cloud based service uses trusted third-party validation. Auditing of our processes and policies efforts to safeguard customer data to industry standards worldwide. Working with our audit partners, SOC 2 Type 2 attestation is completed for all Splunk Cloud customer environments and ISO 27001 certification is completed for Splunk Cloud customer environments provisioned for data ingestion of over 20GB/day

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: "For Splunk initiated changes, maintenance is performed at most once per month and Customers will receive notice of Routine Maintenance by email at least 48 hours in advance. For Customer initiated changes, the maintenance can be performed regularly. You can request an alternate time within the Routine Maintenance window if required. Customers will receive email notice when such maintenance is starting and when complete.; ; Alternatively Splunk sits in the network of the Buyer or the infrastructure of their chosen cloud provider, Configuration and change management is the responsibility of the Buyer or their supplier."
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We have a robust process for threats to the Splunk platform. We maintain a policy of evaluating all potential security vulnerabilities that are discovered internally or externally within two business days of discovery. We use the industry standard CVSSv2 to rate vulnerabilities. In the case of critical risk, high impact vulnerabilities, Splunk will make all reasonable effort to supply patches, assuming that patches are a viable stop-gap for customers who cannot otherwise upgrade Splunk.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: "Splunk monitors application and platform components of the service for potential issues. Cloud Operations staff monitor alerts and logs for issues, and log a ticket for issues that require remediation. In the event of application or data compromise affecting customer data, the customer is notified immediately and remains in contact with the remediation team until resolution.; ; The security measures of Splunk and AWS are further described in the Technical Briefing paper at https://www.splunk.com/pdfs/technical-briefs/safeguarding-customer-data-in-splunk-cloud.pdf"
• Incident management type: Supplier-defined controls
• Incident management approach: Splunk maintains an incident response policy and program, with defined processes, roles and responsibilities. Customers may submit security issues through the normal support channels or any additional channels as provided in the EULA.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.; Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years. ; An Environmental Steering Committee has been established to coordinate environmental activities and drive change.; To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.; Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).; We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor. ; This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.; For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.; We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

• Price: £300 a user a month
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Try the only full-stack, analytics-driven, enterprise-grade observability solution. Explore all the benefits of Splunk Infrastructure Monitoring, Splunk APM, Splunk RUM, Splunk Incident Intelligence and Splunk Log Observer Connect free for 14 days, no credit card required (one user seat).
• Link to free trial: https://www.splunk.com/en_us/download/o11y-cloud-free-trial.html

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@bytes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.