Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In addition to Splunk’s recognition as a 10-time Leader in the 2024 Gartner Magic Quadrant for Security Information and Event Management (SIEM), we are extremely proud to announce that Splunk was ranked as the #1 SIEM solution in all three Use Cases in the 2024 Gartner Critical Capabilities for Security Information and Event Management report.

The threat of phishing attacks looms larger than ever. The LA County Department of Public Health recently announced that 50 employees fell victim to phishing attacks, compromising sensitive patient data. These deceptive schemes have become a staple in the cyberthreat landscape, targeting individuals and businesses of all sizes. For every employee, understanding the signs and consequences of a phishing attack is crucial to safeguarding their organization.

Managing vulnerabilities can feel like the end of the first act of Les Misérables as you sing to yourself, “one day more, another day another vulnerability.” Like Jean Valjean, you attempt to put up barricades to protect your environment from attackers exploiting these security weaknesses. Keeping pace with the number of vulnerabilities and threat actor activities becomes overwhelming, leaving you to feel outnumbered and outmanned.

Every security engineer has experienced this issue: after spending a lot of time creating a new SIEM alert to catch malicious behavior, you deploy it, only to find there are over 100 service accounts triggering false positives. Your SIEM is suddenly flooded with false alerts, and your team is overwhelmed as a result. You then spend hours or even days investigating these alerts and fixing your detection rule, hoping it will work better next time.

Managing dynamic cloud environments is an ongoing challenge for organizations as they scale and innovate. Protecting assets, data, and reputations is more important than ever, yet detecting insider threats, compromised accounts, and unusual behavior in an environment remains complex. Traditional SIEM solutions often focus on reactive, event-driven insights, but to meet today’s evolving needs, many teams are embracing proactive approaches like user and entity behavior analytics (UEBA).

Bolster your organization’s observability and security capabilities on one platform with AI, anomaly detection, and enhanced attack discovery Organizations in today’s digital landscape are increasingly concerned about service availability and safeguarding their software from malicious tampering and compromise. The traditional security and observability tools often operate in silos, leading to fragmented views and delayed responses to incidents.

Phishing is the weapon of choice for many adversaries. And it’s easy to understand why: Users fall victim to attacks in under 60 seconds on average, novice cybercriminals can launch effective phishing campaigns thanks to off-the-shelf phishing kits and generative AI, and above all, it works — 71% of organizations reported at least one successful attack in 2023.

(A thought from The Matrix: Neo likely used a SIEM before he took the red pill and could see the matrix without one...) One of the best ways to monitor security-related activities for your organization is to collect audit logs from every network device and analyze those logs for activities which violate acceptable behavior. This is precisely the role of a SIEM or Security Information and Event Manager. Let me simplify your life by providing some best practice suggestions for deploying and using a SIEM.

Devo recently brought together an esteemed panel of modern CISOs to discuss the issues that matter most to them and their peers. Included in the panel were: It was a lively discussion that covered important topics around the evolution of one of the top security executive roles. Here are five of the key takeaways that bubbled up from the hour-long CISO panel.

According to the CrowdStrike 2024 Global Threat Report, the fastest recorded eCrime breakout time was just 2 minutes and 7 seconds in 2023. This underscores the need to equip security analysts with modern tools that level the playing field and enable them to work more efficiently and effectively.

Imagine that you have a snack you want to eat while watching a movie on a Friday night. You look in your kitchen, only to find the snack missing. Whether a roommate hid the snack or ate it, you no longer have access to it, disrupting your evening plans. This destructive behavior interrupts your weekend objectives, but it’s pretty low stakes overall.

We’re excited to announce that ManageEngine has once again been positioned in the Gartner Magic Quadrant for Security Information and Event Management (SIEM), marking the seventh consecutive recognition in 2024. ManageEngine Log360 is a comprehensive SIEM solution designed to help organizations effectively handle log data. It offers real-time threat detection, incident response, compliance management, and user activity monitoring.

Responding rapidly to cyber threats is a make-or-break capability in today’s high-stakes security environment. A missed alert can quickly escalate a minor incident into a major crisis, jeopardizing your organization’s critical assets and hard-earned reputation. A recent IBM study revealed that companies took an average of 237 days to identify a data breach in 2021 — an inexcusable delay that could invite catastrophic consequences. (Source: IBM Cost of a Data Breach Report 2022)

Credential stuffing is shaping up to be one of the most predominant hacking methods of 2024. In early June, Ticketmaster fell victim to a data breach via credential stuffing, exposing information from 560 million customers. Credential stuffing attacks involve using stolen usernames and passwords to access accounts. In these attacks, threat actors also often use automation to try different combinations of credentials until they find a successful match.

Every day, in a high-stakes race against the clock, protectors must hunt down and stop threats before damage is done. As adversaries work faster and smarter, protectors must operate with greater agility. But legacy SIEMs are holding them back. Designed decades ago when log volumes and adversary speed were a fraction of what they are today, legacy SIEMs hinder investigations with agonizingly slow search speeds.

Security incidents and data breaches are the cybersecurity version of the definition of squares and rectangles in geometry. While all data breaches are security incidents, not all security incidents are data breaches. Before investigating an incident, many security teams know whether the alert will relate to a minor incident or a large-scale breach.

It’s been an exciting year for Splunk Enterprise Security! In May, we celebrated being recognized as a Leader ten times in a row in the 2024 Gartner Magic Quadrant for SIEM. We’re not stopping there. We’re excited to introduce the SIEM of the Future to keep the momentum going. Splunk Enterprise Security 8.0 is available now in a private preview.

At AWS re:Inforce 2024, CrowdStrike is announcing expanded AWS support to provide breach protection, enhanced visibility and faster response across your cloud environment. Let’s explore three cutting-edge CrowdStrike Falcon Cloud Security and CrowdStrike Falcon Next-Gen SIEM features that are changing the way organizations manage security risks.

How many times can we say, “It’s been a busy week for the security industry,” before it becomes cliche? We recently discussed changes in the SIEM market, with mergers and acquisitions disrupting the traditional SIEM vendor landscape and XDR vendors introducing new SIEM solutions. This week, we continue to see a range of mixed messages from the market around the future of XDR and SIEM.

Cybersecurity is a critical and challenging domain that requires constant vigilance, innovation, and adaptation. As cyber threats evolve and become more sophisticated, so do the tools and techniques to defend against them. One of the most effective ways to achieve comprehensive and proactive security is to implement a security information and event management (SIEM) platform that can collect, analyze, and correlate data from various sources to provide actionable insights and alerts.

The last time we wrote about open source software (OSS) for security, we explored how community-driven innovation addresses security problems stemming from the rapid pace of business-driven technological advancements. We posed the question: Can open source security solutions adequately secure and protect the OSS that modern businesses depend on?

CISOs face more cybersecurity challenges today than ever. As technology gets more advanced, so do the bad guys. Cyberattacks are becoming more clever and dangerous. On top of that, there’s no shortage of rules, regulations, and personal risk that CISOs must navigate. We surveyed 200 CISOs to better understand the biggest challenges they face today. Here’s some of what we learned.

The 2020 EU Cybersecurity Strategy, published by the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy, aimed to establish safeguards against security risks arising from increased digital connectivity. As part of the strategy, the strategy included updates to Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2).

Elastic 8.14 is now available! This release supports our mission to modernize security operations with AI-driven security analytics. 8.14 includes major features like the brand new Attack Discovery, significant enhancements to Elastic AI Assistant for Security, and the general availability of ES|QL — all of which provide the SOC with contextual, streamlined SecOps.

Choosing the right software to defend your organization, both in real-time and in retrospect, is one of the most important decisions an organization can make. Security teams need to be able to view activity and affect access quickly, and that becomes more difficult at bigger, complex enterprises. A classical approach to this problem is role-based access control (RBAC), but for many organizations, multitenancy is a better fit.

In navigating the complex landscape of regulatory compliance and risk management, India's banking sector faces unique challenges, particularly in meeting directives outlined by the Reserve Bank of India (RBI) and the Indian Computer Emergency Response Team (CERT-In). As organizations strive to adhere to these stringent requirements, Elastic Observability emerges as a powerful ally, offering advanced log analytics capabilities tailored to address regulatory mandates and mitigate operational risks.