We bring it
to the core

Get started with Splunk

A kickstart with Splunk!

Within a few days, SMT will help you get started with Splunk and lay the foundation for a valuable future. Together we identify the business requirements and make sure that the set goals and expectations are clear. Next, we install a number of Splunk applications and connect some data sources to the environment. Clear reports and dashboards are created to present the collected information.

Within several days you’ll have achieved the first results and saved on time and resources in the first part of the journey. The experience and knowledge of the consultants is used for a solid foundation within your organization. The work is carried out by SMT-consultants and afterwards the knowledge is transferred to the team and you can continue independently.

SMT Endpoint Compliance

Are you looking for a way to report quick and efficiently for internal and external audits? Would you like to improve your compliancy score without adding again another tool? Or does your SOC ask you for historical data to be able to add extra context to security incidents?

The SMT Endpoint Compliance solution provides an organisation with a holistic view to what degree endpoints comply with the security policy. During a cyber security attack they are looking for the weakest link in the process, hence the security of endpoints should meet the highest quality demands.

Endpoint protection is part of the Information Security domain. To protect these endpoints there is a minimum standard which should be part of the Security Policy. With SMT Endpoint Compliance you will gain insight into which level the endpoints comply to these standards. That is one of the first steps in the journey to Security Assurance.

SMT Endpoint Compliance supports to keep the standards at high level. You can deliver closing reports in a short time frame on the security status and simplify audits. Additionally, it provides knowledge to act on the required operational changes to improve the risk score. And in the situation of a security incident, the information provides extra context with historical data.

The benefits of SMT Endpoint Compliance:

• Built on top of Splunk – so no need for additional agents or software
• Can be run agentless – even without a universal forwarder
• Works in on-premise and cloud-based instances
• Can be used with open benchmarks or internal policies

SMT Real-time Phishing Detection Solution

E-mail phishing is one of the most important cyber security problems of these days with one in 99 e-mails being a phishing attack. Many organizations are struggling with this problem as these cyber-attacks take place outside the organization’s span of control. Do you want to have visibility of external e-mail traffic which has been send out on behalf of your brand? And prevent reputation damage of your brand caused by phishing?

The SMT Real-time Phishing Detection solution provides you with insights of e-mail phishing attacks including information of the cyber criminals.

SMT has built a solution that combines multiple technologies into an early detection system for e-mail phishing campaigns. This creates direct visibility when a campaign is launched using your domain name. Normally e-mail phishing campaigns go outside the scope and view of your SOC team.

The advantages:

• Insight into the abuse of your domain including information about the cyber criminals
• Detect directly e-mail phishing campagnes
• Minimize reputation damage due to a phishing attack

Dashboard Service

Do you need clear dashboards but simply don’t have time? Do you lack the required knowledge within the team to make matters transparent? Or do you want to show clear reports to higher management? SMT is happy to take care of this for you! Our Dashboard Service saves you time and money when translating use cases to clear (management) dashboards.

During an intake we make an inventory of the desired dashboards and write a Statement of Work.  The availability of the data and the number of data sources on the platform are essential, a distinction is made between the following three categories:

• Small: Small dashboards of single searches that use 1 or 2 data sources which are already available in the platform.
• Medium: Larger dashboards, with multiple views based on 2 – 5 searches.
• Large: Dashboards with multiple views of more than 5 searches, where large data sources still have to be connected to the platform. This concerns complex and multiple searches with correlation across multiple data sources.

Data Source Assessment

A Data Source Assessment provides insight into the data sources that are connected to the Big Data platform. We provide clarity how the connected data is currently used and whether it is fully utilized.

For this purpose, short interviews are planned with different teams to obtain as much information as possible. We will talk with both users of the platform as well as departments that do not work with it. In this setting, as many as possible questions come up, including the less obvious ones.

A Data Source Assessment looks at the following five domains and the most important objectives of the organisation:

• IT Operations
• Application Support
• Application Development
• Security, Compliance, Fraud
• Business Analytics

Expert On-Site

Our Expert On-Site service offers you a predetermined schedule of a consultant to answer user questions and solve technical problems. You define the list of activities and set the priorities, so you are always in control. This ensures that the maintenance work does not accumulate and is carried out by an expert. Afterwards you will receive a report with an overview of the executed work. If any topics are left, they will be dealt with during the next visit. Should there be time left on the scheduled day, the consultant is at your disposal for other related activities.

As part of the Expert On-Site service we deliver:

• a schedule for one year for the on-site visits.
• a possibility to manage the backlog.
• a report after each visit, with an overview of the activities performed.
• a minimum of 12 days and a maximum of 52 days, during 12 months.

Healthcheck for Splunk

The technical environment of Splunk is influenced in various ways. The growth of a Big Data environment, the growth of the license as well as the number of users of the platform, all  have direct consequences. In order to ensure that the environment is stable and continues to absorb growth, it is important to examine it closely. We work out the ideal architecture for the organization to prepare it for further development and growth. Performing a Healthcheck is a good starting point for mapping out the possibilities and critical pain points of the current environment. To make sure  that not only the organization but also the Big Data platform is ready for the future.

SMT’s years of experience have resulted in a collection of best practices. By analyzing the environment on 50 critical points, the Healthcheck tests whether or not it performs at top level. The result is a report with recommendations and action points coming together in a final report.

It takes a number of days – depending on the size of the environment – to perform the Healthcheck. This will be done together with the stakeholders in your organization. The consultant will need administrator rights.

Use Case Session

Do you see the added value of a data platform, but find it difficult to determine where to start? Is it hard to define the right use cases? And in which order they have to be executed?

During our interactive Use Case Session, we support you to get value from your data: now and in the future. We provide the tools to find and describe the various use cases. Together we prioritize the cases and define the roadmap for the future.

Over two days we organize multiple sessions with involved people from various departments. We have interviews and prioritize the use of data related to the business processes. This will clarify which use cases represent the biggest value, after which they are tested within the company on priority, business goals and the strategy. This is how we create added value for the entire organization and at the same time a solid foundation throughout the company. The overall goal is for the organization to be able to define, prioritize and execute valuable use cases themselves.

Subsequently, you will have the choice to execute the use cases yourself or use the expertise of the SMT-consultants. The track will always end with an analysis of the before and after situation of the implementation. Additionally, we evaluate the process such as which obstacles have been removed for defining, prioritizing and implementing the use cases.

Email Security Service

We offer a solution that detects attacks the first time they’re noticed. One which blocks the most dangerous cyber threats such as malware-laden attachments and URLs, credential-phishing sites and impersonation attacks. The email security solution integrates seamlessly with other security tools to protect against blended attacks.

Email-borne threats are stopped with first-hand knowledge of attacks and attackers before they can cause any harm. It has the latest, contextual intelligence available to rapidly adapt to the evolving threat landscape and can help improve the productivity of cyber security experts and workforce.

We have teamed-up with FireEye and their Email Security Solution. The cloud edition is great for migrating email to the cloud and when an email threat protection from impersonation techniques, phishing and spam is needed. The server edition, fits an on-premises appliance or virtual sensor that protects against advanced email attacks is required. 

SMT Security Assessment

Every organization will come to a point where it has to provide insight into Information Security. Is the data incorruptible and do the right people have access to information? Are correct and appropriate measurements already implemented? Is the organization compliant with laws and regulations? Whether for business reports, audits, or internal processes and risk management, sooner or later every organization must perform an assessment. At the same time, it can be determined at what level the organization is in the security roadmap, a multi-year plan for Information Security.

We have several types of assessments in our portfolio to gain insight into Information Security. Whether it is a SOC assessment or a certification audit, we have an appropriate evaluation for every situation.

• SOC Capability & Maturity Model (SOC-CMM): There are 2 versions and both take a few days depending on the size of the organization and the scope of the project. Basically it looks at the strength and weakness of the SOC, through which the development and progress of the SOC is monitored. In addition, it is used for an extensive and substantive discussion about the SOC. The assessment is carried out over the 5 domains of the SOC and/or the technical environment: Business, People, Process, Technology and Services.

• Risk Management Assessment (RMA): This is advised when there is a need for insight into the risks and they want to know what the damage is if these risks occur. This assessment is carried out over the predetermined processes and possible applications. We have developed our own RMA which can be used quickly and efficiently to identify risks and costs. Subsequently, measurements can be taken to mitigate these risks and to cover the costs.

• Security Maturity Assessment (SMA): An SMA is deployed at organizations where there is currently no SOC nor a SIEM is used. It provides insight into the maturity of an organization in the field of security, thus creating a clear picture of the current situation. An SMA also performs its testing in the following 5 domains: People, Process, Business, Technology and Services.

• Audit & Compliancy Assessment (ACA): This gives insight into which extend an organization complies with applicable legal guidelines such as ISO2700x, NEN, SOx, GDPR. It looks at what types of data are processed, whether it is a public or private company and if financial data is sent and stored.

The result of the SMT Security Assessment (SSA) is a report of the current situation. The SSA, together with the intake and customer needs, is part of the SMT Security Assurance Document (SSAD).

One can choose to have a SSA executed separately and to work with the results independently. Our advice is to make the SSA part of the SMT Security Assurance; the Customer Journey. You will be advised and supported from the intake until the set goals are achieved.