>> Announcer: Live from Las Vegas
it's theCUBE
covering Splunk.conf19.
Brought to you by Splunk.
>> Okay, welcome back everyone.
It's theCUBE's live coverage in Las Vegas
for Splunk's.conf user conference.
10 years, it's their anniversary,
it's theCUBE's seventh year.
I'm John Furrier, your host with a great guest here
Joe Partlow, CTO of ReliaQuest
Recently on the heels of buying Threatcare
and Marcus Carey and team, congratulations.
Thanks for coming on. >> Thank you.
>> It's been a fun month.
>> So obviously security we love it.
Let's take a minute to talk about what you guys do?
Talk about what your company does.
And I got some questions for you.
>> Obviously with the increasing cyber threats
security companies, customers have a lot of tools.
It's easy to get overwhelmed.
Really causes a lot of confusion
So really what we're trying to do is,
we have a platform called GreyMatter,
that is really how we deliver security model management.
Which what that means is that
bringing together people, process, technology
in a way that's easy to kind of makes sense
of all the noise.
There's, there are a lot of features in there
that would help monitor the health,
the instant response, the hunt,
any kind of features that you would need
from a security team.
>> So you guys are a managed service, you said?
>> Yeah, a little different than a traditional MSSP.
We work very close with the customers.
We work in their environment,
we're working side-by-side with them.
In their tools and we're really maturing
at getting better visibility in their environment.
>> Just want to get that right MSSP you are it,
right that's what you guys are?
M.S.S.P.P. (laughs)
>> On steroids, a little bit different.
>> All right, well, you guys have some things going on
you got a partnership with Splunk for the .com SOC.
>> Joe Partlow: Yeah.
>> Talk about that, what's that about here,
and what's it showing?
>> Joe: Yeah, that's been a great experience.
We work very close with the Splunk team
we monitor Splunk corporate,
work with the security team monitoring them.
So when .coms came around
it was kind of a natural progression
of Hey Joel and team on their side said:
"Hey how do we kind of build up the team
"and do a little bit extra?"
And obviously anywhere we could help secure .com.
It was really cool I give credit to the team, both teams.
Standing up a new Splunk install,
getting everything stood up,
really in the last few weeks.
Making sure that everybody at the pavilion
and the conference in general is protected
and we're watching for any kind of threat.
So it's been great working with the Splunk team.
>> So, is it that normal procedure
that the bad guys want to target the security conferences?
Just to kind of make a statement,
or is it more of a graffiti kind of mentality?
>> Yeah. >> It's a pack,
kind of like fun.
>> Yeah. >> Or is it
just malicious end points that they want to get out of here.
>> Oh yeah, this is a little bit of a,
hey let's do it for fun
and mess with the conference a little bit
so we'll want to make sure that doesn't happen.
>> So is my end point protected here?
My end points, my phone and my laptop?
>> Nothing user specific
but any of the conference provided demo stations
>> Okay so infrastructure for the equipment.
>> Correct. >> Not me personally, okay.
>> Yeah, yeah, we're not monitoring your personal machines.
(laughing)
>> I don't care, take it.
I gave up my privacy years ago.
This is an interesting thing.
Talk about working with Splunk
because you know I hear all the time,
and again we're looking at this
from an industry wide perspective here.
We got a SOC, they got a SOC.
So these SOC's are popping up.
You know, Security Operation Centers.
What is the state of the art for that now?
Is it best practice to have a mega monster SOC
or is it distributed?
Is it de-centralized?
What's the current thinking around how to deploy SOC's?
Circuit Operations Center or centers.
>> Yeah, we certainly go with a decentralized model.
We need to follow the sun
so we've got Operation Centers
here in Vegas, Tampa and Dublin.
Really making sure we've got the full coverage.
But it is working really close with the Splunk SOC.
So they've got a phenomenal team
and we work with them side-by-side.
Obviously we are providing a lot of the tier one, tier two
heavy lift and then we escalate to the Splunk team.
They're obviously going to know
Splunk Corporate better than we will.
So we work really close hand-in-hand.
>> So you guys acquired Threatcare
and Marcus Carey's now in the office of CTO,
which you're running. >> Yes.
>> How's that going to shape ReliaQuest and your business?
>> Yeah, the acquisition has been extremely exciting for us.
After meeting Marcus, I've known of Marcus,
he's a very positive influence in the community.
But having worked with him,
the vision for Threatcare and the vision for ReliaQuest
really closely aligned.
So where we want to take the future
of security testing, testing controls,
making sure up stream controls are working.
Where Threatcare wanted to go for that
was very much with what we align with
so it made sense to partner up.
I'm very excited about that
and I think we will roll that
into our GreyMatter platform as another capability.
>> GreyMatter, I love the name by the way.
First of all security companies have the best names.
You know Mission Control, GreyMatter,
you know Red Canary in the coal mine.
All good stuff.
All fun, well I know you guys work hard.
So I know the parts got to be good.
I got to ask you around the product vision around customers.
And how they're looking at security.
Because you know it's all fun and games
until somebody's hacked and their business is trashed.
Or there's Ransomware going on.
Data protection's become a big part of it.
What are customers telling you right now
in terms of their fears, and aspirations.
What do they need?
What's on the agenda, I guess for customers right now?
>> Yeah, I think the two biggest fears
and then the problems that we're trying to address
is one just a lack of visibility.
Customers have so many things on their network,
a lot of mergers and acquisitions.
Unfortunately a lot of times a security team
is the last one to know when something pops up.
So anything that we can do to increase visibility
and a lot of times we work closely with Splunk
or the SIM that they have.
To make sure that happens.
And then the other thing I think is
most people want to get more proactive
SIM and logging by nature is very reactive
so wanting to get out infront
of those threats a little bit more.
So anything we can do to try to get more proactive
is certainly going to be on top of their mind.
>> Well the Machine Learning tool kits
getting a lot of buzz here at the show.
That's a really big deal.
I think the other thing I'm seeing
and I want to get your reaction to is
this concept of diverse data.
That's my word not Splunks.
But the idea of bringing in more data sets
actually helps Machine Learning.
That's pretty much known by data geeks.
But making data addressable.
Because data seems to be the one thing
that is doing a lot of the automation.
That takes a heavy lift and also provides
heavy lifting capabilities
to set data up to look at stuff.
So data's pretty critical.
>> Oh yeah. >> Data addressability,
data diversity.
You got to have the data and it's got to be addressable.
Oh yeah. >> In real time
and through tools like Fabric Search and other things.
What's your reaction to that
and thoughts around that?
>> I agree one hundred percent.
I've seen most Enterprise customers
have a diverse set of data.
So trying to search across those data sets.
Normalize that data, it's a huge task.
But to get the visibility that we need,
we really need to be able
to search these multiple data sets,
and bring those into make sense.
Whether your doing threat hunting,
or responding to alerts,
or you need it from a compliance standpoint.
Being able to deal with those diverse data sets
is a key issue.
>> You know the other thing I want to get your thoughts on
and this is something we've been kind of commenting.
I kind of said a particular position on this
from an opinion standpoint,
but it's kind of obvious but is not initially true
but my point is with the data volume
going up so massive.
That tips the scales in the advantage of the adversaries.
Ransomware is a great example of it.
It's little Ransomware now in towns and cities.
These Ransomware attacks is just one little vector.
>> Oh yeah. >> But with the data volume
data is the surface area not just devices.
>> Oh yeah. >> So how is
the data piece of it,
and the adversarial advantage.
Do you think that that makes them stronger?
More of a surface area?
>> Yeah, definitely.
And that's something that we're leaning
on Machine Learning for a lot.
If you really make sense of that data.
A lot of times you want to baseline that environment.
And just find out what's normal in the environment?
What's not normal?
And once you can find that out
then we can start saying all right is this malicious or not.
Something maybe PowerShell or something
in one environment is a huge red flag
that hey we've been compromised
in another one, hey,
that's just a good administrator automating his job.
>> Yeah. >> Making sense of that.
And also just the sheer volume of data
that we see customers dealing with.
Very easy to hide in if your doing an attack
from and adversary standpoint.
Being able to see across that
and make sure that you can,
at scale sift through that data
and find actionable event.
>> I was just talking with a friend
that I've known from the cloud world, Cloud Native World.
We're talking about DevOps versus In Security Operations.
And those worlds are coming together.
There are more operational things than developer things.
But yet CSO's that we talked to
are fully investing in developer teams.
So it's not so much DevOps dogma, if you will.
But we got to do DevOps.
You know CICD pipelines okay I get that
but developers play a critical role
in the security architecture.
But at the end of the day it's still operations.
So this is the new DevOps
or SecOps whatever it's called these days.
How do customers solve this problem?
Because it is operational whether it's industrial IOT
or IOT or Cloud Native, microservices,
to On-premises security practices with end points.
I mean >> Oh yeah.
>> The thing we see that kind of gives those teams
the most success is making sure
they're working with those teams.
So having security siloed off by itself,
I think we've kind of proven in the past
that that doesn't work, right.
So get them involved with their development teams.
Get them involved with their MedOps or SecOps teams.
Making sure they're working together,
so that security teams can be an enabler.
They don't want to be the team that says no to everything.
But at the end of the day
most companies are not in the business of security
they're in the business of making widgets
or selling widgets or whatever it is.
Making sure those security people are working.
>> Building Apps too, right.
>> Yeah, yeah.
>> That's an App issue.
>> Exactly making sure that they're
kind of involved in that life cycle.
So that not that they can you know define what
that needs to be but at least be aware of;
Hey this is something we need to watch out for.
Get visibility into and keep the process moving.
>> Let's talk about Splunk
let's talk about their role in the enterprise.
Obviously enterprise sweet 6.0
is shipping general availability.
How are you guys deploying and optimizing
Splunk for customers?
What are some of the killer use cases
that's there and new ones emerging?
>> Yeah, we provide really kind
of three core areas for Splunk customers.
One is obviously making sure that the platform is healthy.
A lot of times we'll go into a customer
that maybe their Splunk team has turned over
or they've rapidly expanded
and quickly kind of overwhelming the system that is there.
So making sure that the architecture
is correct, maintained, patched, upgraded
and that they're really taking advantage
of the power of Splunk.
From and engineering standpoint.
Also another key area is building content
so as we were discussing earlier making sure
that we got the visibility and all that data coming in
we've got to make sure are we pursing that data correctly.
Are we creating the appropriate alerts
and dash boards and reports
and we can see what is going on.
And the last piece is actually taking action on those.
From an incident response standpoint
watching those alerts and watching
that content fire and making sure
that we're escalating and working
with the customers security team.
>> I'd love to get your thoughts,
final question on the,
first of all great insight, love that.
As customers who are,
first of all Splunk we by our data
is number one, third-party app for blogs,
app, app workloads and in cloud as well.
As more clients that you have rely more
on cloud AWS for instance.
They have security hub, they're deploying some,
they're starting to lean on the cloud providers,
the hyper-scale cloud providers for security.
That doesn't diminish the role Splunk plays
so a lot of people are debating;
We'll the cloud's going to eat Splunk's lunch
and so but I don't think that's the case.
I want to get your thoughts on it.
Because they're symbionic. >> Oh yeah.
>> So what's your thoughts on the relationship
to the cloud providers?
To the Splunk customers
whose also potentially move to the cloud
and have a hybrid cloud environment.
>> I would agree.
They're going to exist side-by-side for a long time.
Most environments that we see are hybrid environments.
While most organizations do have a cloud first initiative
there's still a lot of On-Prem stuff.
So Splunk is still going to be a key cornerstone
of just getting that data.
Where I do see is maybe in those cloud platforms
kind of stretching the reach of Splunk
of let's filter this in parts of this stuff
maybe closer to the source
and make sure we are getting the actionable things
into our Splunk ES dashboards and things like that.
So that we can really make sure
that we're getting the good stuff.
And maybe the stuff that's not actionable
we will leave up in our AWS environment.
That's a lot of the technology
that Splunks coming out with that's able
to search those other environments
is going to be really key I think for that.
Where you don't have to use up all of your licensing
to bring that non-actionable data in.
But you're still able to search across it.
>> But that doesn't sound like
a core Splunk service, that's more of an operational choice,
less of a core thing.
You mentioned you think
that Splunk is going to sit side-by-side
with the clouds what gives you that insight?
What's telling you that that's going to happen?
What's the deal?
>> You still need the core functionality of Splunk.
Splunk provides, it's a great way to bring data
in and purses it extremely well.
Having those correlation engines and searches.
That's very nice to have that pre-packaged.
Doing that from scratch you can certainly,
there's other tools that can bring data in
but that's a heavy lift to try
and recreate the wheel so to speak.
>> We're here with Joe Partlow CTO of ReliaQuest,
partnering with Splunk,
setting up this .com SOC for the exhibits
and all of the infrastructure.
>> Final question. >> Yeah.
>> John: What's the coolest thing
going on at .conf this year?
What should customers or geeks
look at that's cool and relevant
that you think should be top line, top couple things?
>> Yeah I, one of the things I liked the most
out of the keynote was the whole Porsche used case
with the AR augmentation.
I thought that was really really cool
and then obviously the new features
that are coming our with DFS
and some of the other pricey models.
Definitely an exciting time to be a partner of Splunk.
>> All right Joe thanks for coming.
I'm John Furrier here with theCUBE live in Las Vegas.
Day two of three days of coverage of .conf.
Their tenth year anniversary, our seventh year covering.
Listening to theCUBE, I'm John Furrier thanks for watching.
We'll be right back.
(upbeat music)