Blue Cube Security Ltd
Splunk Phantom
Maximize Your SOC efficiency With Security Orchestration, Automation, and Response (SOAR) Capabilities
Harness the full power of your existing security investments with security orchestration, automation and response. With Splunk Phantom, execute actions in seconds not hours.
Features
- Close your security skills gap
- Integrate your team, processes and tools
- Supercharge your SOC
Benefits
- Force multiplying your security operations efforts
- Greater SOC efficiency
- Advanced orchestration, automation and response capabilities
Pricing
£1,000 a unit a day
- Education pricing available
- Free trial available
Service documents
Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format,
email the supplier at operations@bluecubesecurity.com.
Tell them what format you need. It will help if you say what assistive technology you use.
Framework
G-Cloud 12
Service ID
6 7 1 3 3 5 6 2 1 8 4 0 7 6 0
Contact
Blue Cube Security Ltd
Operational Admin Support
Telephone: 0345 0943070
Email: operations@bluecubesecurity.com
Service scope
- Software add-on or extension
- Yes, but can also be used as a standalone service
- What software services is the service an extension to
-
• Enterprise Security
• Phantom
• User Behavior Analytics
• Insights for AWS - Cloud deployment model
-
- Public cloud
- Private cloud
- Hybrid cloud
- Service constraints
- None.
- System requirements
-
- Hardware non Windows> 2 x 6 core 2+GHZ, 12GB RAM
- Windows> 2 x 6 core 2+GHZ, 12GB RAM
- Linux, 2.6 and later
- Mac OS X 10.10 and 10.11
- Windows 8, 8.1, 10
- Windows Server 2008 R2, 2012, 2012 R2
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
- SLA to be defined against customer requirements.
- User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- None or don’t know
- Phone support
- Yes
- Phone support availability
- 24 hours, 7 days a week
- Web chat support
- Yes, at an extra cost
- Web chat support availability
- 24 hours, 7 days a week
- Web chat support accessibility standard
- None or don’t know
- How the web chat support is accessible
- Web chat is accessed through the Support Portal. The support portal is a public facing website which contains access to our Online Help Desk,Web Chat and documentation such as setup guides, videos and forums.
- Web chat accessibility testing
- Not Known / Not Tracked.
- Onsite support
- Yes, at extra cost
- Support levels
-
Standard Account Management support hours are 9.00am to 6.00pm Monday to Friday. We provide an Account Management function for all Public Sector clients. Our Account Managers endeavour to respond to requests as quickly as possible and are supported by a team of System Engineers to offer technical advice and scoping before and during purchase.
After purchase, technical support is as per price list.
Hands-on assistance & professional services by engineers is available outside of break-fix on paid time and materials basis defined by a Scope fo Work. - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
- Technical assistance is provided via the support website. On-site on-boarding (delivery) is available via Professional Services.
- Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
- Splunk provides the analytics and visualisation tools and depending on the configuration of data retention. The data rests at its original location and does not reside in Splunk. Therefore there is no need for data extraction at end of contract
- End-of-contract process
- Migration of analytics to another supplier can be offered depending on the buyers requirements.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 10
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- Security orchestration, automation and response from your mobile device. Work smarter, respond faster and strengthen your defenses — from anywhere, at anytime. Orchestrate security operations from the palm of your hand. Respond faster than ever because you’re reachable from anywhere. And run playbooks, triage events and collaborate with colleagues on the go.
- Service interface
- No
- API
- Yes
- What users can and can't do using the API
- Phantom’s flexible app model supports hundreds of tools and thousands of unique APIs, enabling you to connect and coordinate complex workflows across your team and tools. Powerful abstraction allows you to focus on what you want to accomplish, while the platform translates that into tool-specific actions.
- API documentation
- Yes
- API documentation formats
-
- HTML
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
Splunk application sits within the aptos cloud network or within the infrastructure of your chosen Cloud Provider. Splunk consumes data from sources within the network. The User is able to configure dashboards and the target data sources.
configuration can be through Splunk Web, Splunk's Command Line Interface (CLI), Splunk's REST API and directly in configuration files.
Scaling
- Independence of resources
- Splunk forwarders sit in the Buyers network or the infrastructure of their chosen cloud provider and therefore contention is under their control. The Splunk indexing and visualisation is typically part of the SaaS offered in an auto monitored and scalable cloud environment.
Analytics
- Service usage metrics
- No
Resellers
- Supplier type
- Reseller providing extra support
- Organisation whose services are being resold
- Splunk, Trend, Sophos, Qualys, Thales, Netscout, Imperva, CyberArk, Fortinet, AWS
Staff security
- Staff security clearance
- Conforms to BS7858:2012
- Government security clearance
- Up to Developed Vetting (DV)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Supplier-defined controls
- Penetration testing frequency
- At least every 6 months
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
- Physical access control, complying with another standard
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- In-house destruction process
Data importing and exporting
- Data export approach
- There are many ways that a user can export data .Splunk provides a REST API to export data. Data can be exported by the Splunk Web facility. Users can use the Command Line Interface, SDK's and data forwarding tools.
- Data export formats
- CSV
- Data import formats
-
- CSV
- Other
- Other data import formats
-
- Raw Data
- JSON
- XML
Data-in-transit protection
- Data protection between buyer and supplier networks
- Other
- Other protection between networks
- Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. Data protection between networks is the responsibility of the Buyer or their cloud provider.
- Data protection within supplier network
-
- Legacy SSL and TLS (under version 1.2)
- Other
- Other protection within supplier network
- Splunk sits within the Buyers network or the infrastructure of their chosen cloud provider. There is no connection between Splunks networks and those of the Buyer. Data protection between networks is the responsibility of the Buyer or their cloud provider
Availability and resilience
- Guaranteed availability
- We have different SLA's for different levels of service selected. That service level dictates the availability percentage, the tolerances and subsequently the service credit. Service credits are applied only to future service payments.
- Approach to resilience
- Available on request.
- Outage reporting
- Email Alerts and Via Customer Support Portal.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
- The service can integrate with existing authentication systems or uses groups and user permissions for access to particular functionality of the service.
- Access restriction testing frequency
- At least once a year
- Management access authentication
- Username or password
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- No audit information available
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- QAS International
- ISO/IEC 27001 accreditation date
- 14/04/2015
- What the ISO/IEC 27001 doesn’t cover
- N/A
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
- This is documented as part of our ISO27001 policies and processes.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
- Changes to services and features follow our documented configuration and change management policy.
- Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
- As part of our ISO27001 policies and processes we follow a number policies to prevent, assess, log, manage and eradicate vulnerabilities.
- Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
- We have processes that continually review our monitoring devices, logs, processes, usage, application metrics, unauthorized connection attempts, attacks and so on.
- Incident management type
- Supplier-defined controls
- Incident management approach
- We have pre-defined ISO processes for incident management. Users report incidents through our helpdesk, using an incident management form. We provide incident management reports in a standard format as per our policy.
Secure development
- Approach to secure software development best practice
- Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
Public sector networks
- Connection to public sector networks
- No
Pricing
- Price
- £1,000 a unit a day
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
-
Full service scope can be supplied subject to client requirements and timescales.
Please make a formal request via:
http://www.bluecubesecurity.com/contact-usgcloud/ - Link to free trial
- http://www.bluecubesecurity.com/contact-usgcloud/
Service documents
Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format,
email the supplier at operations@bluecubesecurity.com.
Tell them what format you need. It will help if you say what assistive technology you use.