Splunkers have gathered resources, including remote work insights and a Zoom application for Phantom, to help their clients strengthen their security posture in the face of the COVID-19 pandemic. The increase in online activity has revealed some security concerns and situational awareness that were previously overlooked. Splunk's Remote Work Insights provides real-time visibility into different remote work systems, such as VPNs, Microsoft 365, Okta, and Zoom. The Zoom data module inputs, obtained through JWT Webhooks, allow security practitioners to answer basic security questions about Zoom usage. However, some questions remain unanswered, such as how to take proactive measures to educate and strengthen meeting security. Splunk Phantom can be used to strengthen security during the COVID-19 pandemic by providing a simple and user-friendly interface for the Zoom API, which provides access to all the data needed. The Zoom App for Phantom provides a low-friction way to introduce a large amount of meeting data into Splunk, but it only tells part of the story. The Zoom API provides access to all the data needed to understand meetings, including whether they are password-protected, if the waiting room feature is enabled, and what files were transmitted during the meeting. The Zoom App for Phantom also allows for the modification of meetings to require passwords and enable the waiting room feature, or to cancel meetings from the schedule.
