scales security capabilities with Splunk and
summary
Zoom runs Splunk on AWS to centralize security and app logs, ingesting about 1 TB/day ingest and retaining months of hot/warm/cold storage for compliance and forensics. The team replaces a slow legacy SIEM, uses heavy forwarders from datacenters, and validates exploits by replaying patterns against production logs to prove no customer data was affected. Architecture emphasizes a separate VPC for logging and AWS marketplace billing, delivering scalable alerts, playbook-driven response and measurable reduction of blind spots after deployment under FedRAMP ATO.
AI-written summary · about
chapters (12)
- 0:00Introduction and agenda
- 2:18Data platform strategy
- 5:42Foundational project steps
- 8:10Use case examples
- 10:20IoT and security applications
- 14:47Zoom platform overview
- 17:38Zoom's technical landscape
- 20:52Deploying Splunk at scale
- 25:11Architectural best practices
- 29:33Incident response workflows
- 32:22Summary and logistics
- 36:23Q&A and closing remarks
related talks
49mBuilding digital resilience with unified security and observability
24mAnalytics-based investigation & automated response
24mAnalytics-based investigation & automated response
31mNetwork Security at Scale: L3 Through L7 at Splunk
38mGet the most out of Splunk Security, OCSF, and Amazon Security Lake
17mArchitecting a security data lake at enterprise scale
05mhelps deploy modern apps at speed while maintaining security
01h 05mPractical network defense at scale