[MUSIC]
>> Hello, everyone. Welcome to
this session at Microsoft Build,
where we will give you a deep dive into
elastic solutions and the value
that they bring to the Azure users.
John and I are both solution architects here at Elastic.
We'll show you how you can search,
observe, and protect your Azure resources,
leveraging solutions provided by
the Elastic Stack foundation.
Elastic Cloud on Azure provides you
that easy button to deploy Elastic.
It is available on Azure marketplace as well,
along with the Elastic arm template.
Elastic on Azure helps users
solved many problems that they face.
John will give us a deep dive into
how they do it. Over to you, John.
>> Thanks, Hemant. It's great to be
here at Microsoft Build with you today.
I'm going to start with just a little bit of math.
3 plus 1.
That's a pretty simple equation.
But today, I want to take a few minutes and show
you that it adds up to a lot more than you'd imagine.
In Elastic, we believe
that all of us are searching for something.
Why we search remains constant.
We are looking for insight, information, and answers.
Why we search may remain constant,
but how and what we search is changing continuously.
Whether that's due to new types of
data, such as geospatial,
or simply due to
the ever-increasing torrential flow
of data that we deal with.
The Elastic Stack is the foundation for everything we do.
We allow you to bring all your data into
one place or distribute it regionally for global scale.
Either way, you can explore it to get
relevant answers at the speed
of thought and at any scale.
Speaking of scale, with the amount
of data we deal with these days,
sometimes you need help to know where to
look or an alert where your attention is needed.
We've built advanced AI capabilities such as
anomaly detection and text categorization
into the Elastic Stack.
The Elastic Stack has been
engineered from the ground up to be
the best foundation for building
search-powered solutions.
It's the plus one that powers
and amplifies our solutions.
Today, we're going to show you three solutions
that we've built on the Elastic Stack that
will allow teams of all types to gain
insights and understanding more
efficiently than ever before.
These solutions will empower all of
your teams to achieve their goals,
whether you're a knowledge worker
searching for content for your next meeting
or an application developer building
a rich search experience for your customers.
Our enterprise search solution is
designed to simplify your life by letting
us do the heavy lifting to
create a compelling search experience.
Perhaps you're a site reliability
engineer responsible for
the health and performance of
mission-critical applications.
Living in a world of ever-increasing complexity.
Inevitably, when things go wrong,
our observability solution is designed with the intent
to drive meantime to resolution down to zero.
Or maybe you're a member of
the information security team trying to stay ahead of
not only more and more data but
also increasingly sophisticated attackers.
Our security solution will arm
every analyst on the team to prevent,
protect, and hunt for threats.
Our goal for you is to eliminate all blind spots.
These are all very different roles and
our solutions have been tailored to those roles,
but they are all driven by the Elastic Stack.
Let's take a look at the art of the possible
and see how Hipster is using
elastic solutions to empower
their teams and ultimately their business.
First, they're using Workplace Search,
part of the enterprise search solution
to make it easy for anyone
in the business to find information
relevant to their team and role.
The application development team has used App search,
also part of the enterprise search solution to
build a great search experience for their customers.
Hipster is collecting logs, metrics,
and APM tracing from all of
their systems and sending that data into
a centralized Elastic Search cluster that is used by
both the security team and the SRE team
since much of that data is relevant to both of them.
The two teams can share data as
needed without worrying about stepping on
each other's toes because the Elastic Stack lets them
create independent workspaces tailored
to each team's needs.
Finally, Hipster sales and marketing teams are
collecting business data for advanced analytics,
as well as creating eye-catching presentations
with live data instead of printing reports,
so that the executive team always
has a real-time view of the business.
By the way, even though Hipster has
deployed the SRE cluster in the Cloud,
and the business cluster lives On-prem.
The Elastic Stack allows the SRE team to query
across clusters to pull in business data so
that they have a single view
that shows not only the health of
their systems but the sentiment of their customers.
Now let's see how someone of Hipster's teams
are using elastic solutions in action.
First, we'll consider our knowledge workers,
which by the way, probably
includes almost all of us today.
According to McKinsey, the average person spends
108 minutes a day looking for content.
Because we spend so much time searching,
we've all become search experts in that we expect
the grade experience at home as well as at work.
This is Workplace Search,
and you can quickly see that it provides
a state-of-the-art search experience.
As Sally in marketing searches for
the latest e-mail marketing PDFs.
She gets query suggestions from her search history.
Fast results from a variety of sources with
relevancy ranked across all those sources.
Workplace Search has recognized the string PDFs as
a keyword and specifically
filtered Sally's results to just PDFs.
Although she can certainly expand the results if need be.
There's a nice details card
for each result that sometimes
might be all you need to find
an answer without even opening the document.
We'll see how other teams in Hipster
rely on Workplace Search in a bit.
Workplace Search also makes
the administrator's life easier.
Emilio runs Workplace Search at Hipster and he's gotten
a request from the SRE team
to boost the results from GitHub.
With Workplace Search, we've made it this easy.
While we're on the topic of Elastic enterprise search.
Let's see what our front-end
developer team has been up to.
They were recently tasked with creating
an easy-to-use self-support application
for Hipsters customers.
Search is a key component.
In the past, it might take a development team
weeks or months to create something like this,
but with Amp surge,
the developers had it up and running much more quickly.
>> Imagine a customer comes to a website trying to
solve an issue with resetting their password.
That's something they urgently need to solve.
If they can't, we know
it creates customer dissatisfaction.
Notice that with [inaudible] ,
the Development Team was able to create
a great user experience with features
such as typo tolerance and auto-complete.
Next, let's drop in on the Hipster SecOps team.
Here we're looking at the Elastic SIEM,
the user interface within Cabana,
specifically designed to enable security analysts
at all levels from endpoint protection teams to tier 1,
2 or 3 analysts.
We want to make sure that
the entire security organization has
the tools they need to prevent threats or hunt them down.
The overview page, we again bringing
this team an immediate view
of what they need to focus on.
Whether it's active cases that are
being managed, timeline investigations,
we'll take a closer look at those in a second,
or the latest news published by
Elastic Security Research Team.
What's immediately apparent however,
is that our signals view and
external alerts view have picked up on something.
Signals represent events that
had been detected within Elastic.
For example, detection rules had to fire
or alert for anomalies or rare processes.
External alerts emanate from outside the SIEM;
things in your environment such as
malware alerts or endpoint protection alerts.
In this case, it looks like
our Elastic endpoint protection has also
detected something and created an alert in the SIEM.
Let's take a look at the detections page
and see what's going on here.
We see that several different rules had fired.
If we take a closer look at these,
we can see a lot more detail
about the rules that have fired.
The Elastic SIEM comes pre-configured
with a large collection of detection rules,
anomaly and outlier detection jobs,
all ready for you to use.
As with our other solutions,
we're leveraging the power of the Elastic Stack
to guide you to things that need your attention.
The rules are mapped to the Mitre Att&ck Framework and we
even link to the Mitre website if you want to learn more.
This is useful for a Tier 1 analyst,
possibly fresh out of college,
learning more about this technique.
Again, we want to arm every analyst on your team
with a consistent set of powerful tools.
Zooming out, we can clearly see that
something has happened on this particular machine,
and this user, James,
clearly is doing something suspicious.
Here's where that timeline I
mentioned earlier comes into play.
I can simply drag this user
to the timeline and instantly use
the power of Elastic search query capability
to filter on James' activity.
You don't even need to know anything
about Elastic's query language.
We've made it drag and drop simple.
Based on the rules that had fired,
we may be dealing with a possible PowerShell exploit,
and we can quickly see that it was used to
start something called W script.
We can drag that in a timeline query builder to further
refine the query and to see
where else the script has been run.
From here, we can save this query and use it to
create a new detection role that would alert us
on Slack or pager duty or whatever other out of
the box third party integrations
when James runs W script again.
In this case, things look
suspicious enough that we should
pass this timeline investigation off to Alyssa,
one of the more senior analysts on the Tier 2 team.
Alyssa can start with this initial timeline
and widen the net of our investigation to
try and understand what led to
the initial detection engine and endpoint alerts,
and further investigate our suspicious user James.
Since she's expanding the investigation,
she'll also create a case in
the Elastic SIEM that can be linked to ServiceNow,
which the SecOps team is already using.
As well as other teams at Hipster,
SecOps relies on Workplace Search to
have relevant information at their fingertips.
Alyssa can quickly find
the security knowledge base article she needs
to guide her next steps in this investigation.
Finally, let's go visit
John and the Site Reliability team.
In today's information driven world,
every business has mission
critical applications that absolutely
need to be up and running,
and just as importantly, running well.
We all know how impatient
we become searching the Internet.
If we don't get immediate answers,
we'll just go someplace else.
After all, your competitor's
just a tab away in your customers browser.
Like many retail shops today,
Hipster has gone all in on containers,
microservices and orchestration with Kubernetes.
Oh, and they're Cloud-native too,
so they've deployed this application in the Cloud.
While this architecture allows your teams to
effectively use whatever technology meets their needs,
and to be extremely agile and deploy
code on a daily or even hourly basis,
those benefits come at a price of a lot more complexity,
more things to monitor and watch,
and ultimately a lot more data.
The Elastic Observability solution
allows the Hipster team to bring all of
that telemetry from their applications and
Cloud infrastructure into one place.
Logs, metrics, APM trace information,
and even service endpoint geographic uptime,
so they can follow
any users journey through their shopping experience.
As I mentioned, the SRE team is
not only watching the health of their applications,
but also keeping an eye on their user's experience.
They're able to search across
clusters to bring in business data so they
can correlate a user's experience
with issues when they occur.
In the spirit of cooperation across teams,
Alyssa from SecOps has given the SRE team a
heads up about the case
that they're actively investigating,
just in case they notice
any unusual system performance problems
while she continues her analysis.
John and the SRE team has just
gotten a slight message indicating that one of
the services in Hipster's online store
is running slower than normal.
Could it be related to Alyssa's active case?
Let's find out.
We can see that something is
going on with the AdWords service.
The Elastic Stack has detected a performance anomaly.
Transactions are taking much longer than usual.
The Hipster team no longer needs to
guess at thresholds to generate alerts.
Elastic's anomaly detection alerts them
only when something is outside
the norm and needs their attention.
With the tight linkages between
Elastic solutions and the Elastic Stack,
the machine-learning alert in Slack takes us
right to the APM service we may have in Cabana,
so we can immediately see that the AdWords service,
which is apparently having issues,
is actually causing upstream problems
for the front-end service.
That means that customers are
almost certainly seeing this issue.
From here, we can take
a deeper dive into the AdWords service,
or maybe we want to explore other anomalies
to see if they might shed some more light on the problem.
In this case, we already have
an inkling that the AdWord service is at fault,
so we'll drill down for a closer look
to see if we can find the answer quickly.
Elastic APM has automatically annotated
this trace to show me that a new version,
1.7, has recently been deployed.
While the DevOps team and
the SRE team work well together,
sometimes things slip through the cracks and here again,
Elastic observability helps point
you in the right direction.
From the APM view,
we can quickly pivot to take a look at
the log files for the AdWord service.
Again, notice that we didn't have to go
hunting around on servers for this log file.
Elastic observability keeps me focused on
the problem by correlating the timeline across each view.
John's pivoted to the Elastic logs UI,
looking at the logging events emitted
by the problematic AdWords service,
right at the same point in time that
the performance anomaly was detected.
It's pretty apparent that something is happening with
the AdWord service caching mechanism.
There are continuous cache misses,
and that almost certainly means memory problems.
Even though we've collected millions of
logging events for just a single service,
we can instantly search for something like a heap space.
It should be using Elastic search.
Yeah, sure enough,
the service ran out of memory and has been restarted.
Almost certainly, this problem was introduced by
that new version 1.7 that was just deployed.
As a next step, John might now use
workplace search to look through GitHub to find
out more details about that AdWord service
that was just deployed to learn more.
Back to 3 plus 1,
three solutions powered by the Elastic Stack.
Elastic Enterprise Search, Observability and
Security are amazing solutions in their own right,
but they're amplified by
the power of the leading search engine on the planet.
I'm showing you how Elastic can able
all of your teams to be more productive,
and ultimately,
that translates into value for your entire business.
With that, I'll turn it back over to you Heyman.
>> Thank you John, for the wonderful deep dive
into Elastic solutions
on Azure and how Azure uses are leveraging them today.
Thank you everyone for joining
us and we hope to see you at
our workshop booth in
the Partner Showcase at Microsoft Build.
You can also find us on Azure Marketplace to get going
with Elastic on Azure today. Thank you.