Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

graylog

Security Misconfigurations: A Deep Dive

Feb 27, 2025 By Jeff Darrington In Graylog
Managing configurations in a complex environment can be like playing a game of digital Jenga. Turning off one port to protect an application can undermine the service of a connected device. Writing an overly conservative firewall configuration can prevent remote workforce members from accessing an application that’s critical to getting their work done.
Read Post
elastic

How Elastic can help organizations achieve CMMC compliance

Feb 24, 2025 By Bobby Suber In Elastic
The Cybersecurity Maturity Model Certification (CMMC) is a framework established by the US Department of Defense (DoD) to ensure that organizations handling Controlled Unclassified Information (CUI) implement robust cybersecurity measures. As CMMC becomes a key requirement for defense contractors, higher education institutions engaged in research or contracts with the DoD must also comply with its standards.
Read Post
exabeam

The Rise of AI-Generated Attacks: Why UEBA is the Best Defense

Feb 24, 2025 By Exabeam In Exabeam
The cybersecurity industry is facing a new challenge: AI-generated attacks. With the rapid advancement of generative AI, cybercriminals now have access to sophisticated tools that enable them to craft highly targeted attacks with minimal technical expertise. Unlike traditional attack methods that require deep programming knowledge, AI-driven attacks allow even non-technical malicious actors to create malware, exploit scripts, and launch phishing campaigns with ease.
Read Post
elastic

Will AI start taking cybersecurity jobs?

Feb 19, 2025 By Joe DeFever In Elastic
No, but it’s fundamentally changing them. Generative AI (GenAI) is quickly becoming an essential part of everyday security workflows. So … is it a partner or competitor? The wide-ranging implementation of GenAI technologies into virtually every aspect of the security stack has, on the whole, helped security teams work more efficiently to mitigate threats.
Read Post
graylog

The Ultimate Guide to Sigma Rules

Feb 18, 2025 By Jeff Darrington In Graylog
In cybersecurity as in sports, teamwork makes the dream work. In a world where security analysts can feel constantly bombarded by threat actors, banding together to share information and strategies is increasingly important. Over the last few years, security operations center (SOC) analysts started sharing open source Sigma rules to create and share detections that help them level the playing field.
Read Post
Corelight

Corelight delivers data aggregation to reduce SIEM ingest by 50-80% compared to legacy network security monitoring tools

Feb 18, 2025 By Cynthia Gonzalez In Corelight
According to Forrester Research, “How do we reduce our SIEM ingest costs?” is one of the top inquiries they receive from clients. Many security organizations rely on SIEMs for their detection, investigation, and response workflows, ingesting critical security information and events to detect and respond to threats.
Read Post
CrowdStrike

Solving for Exponential Data Growth in Next-Gen SIEM

Feb 18, 2025 By Vicky Ngo-Lam In CrowdStrike
Do you ever feel overwhelmed by the number of data sources you manage with your SIEM? How do you piece together different pieces of the puzzle like SOAR, threat intelligence, and security tools for endpoint, cloud, or identity? Do you actually know which tools are strengthening your security posture, and which are just adding more complexity?
Read Post
exabeam

Choose Your Infrastructure: Why Vendor Selection Should Matter to CISOs

Feb 18, 2025 By Exabeam In Exabeam
When running a cybersecurity operation for an organization, there are numerous competing priorities—and the CISO is responsible for striking an intricate balance between them. Of course, the overall security posture is imperative, as are the organization’s broader business objectives. The CISO has to determine the organization’s tolerance for risk, while simultaneously understanding the most essential security use cases for the business and establishing protections for them.
Read Post
graylog

Using MITRE ATT&CK for Incident Response Playbooks

Feb 14, 2025 By Jeff Darrington In Graylog
A structured approach to incident response enables you to create consistently repeatable processes. Your incident response playbook defines responsibilities and guides your security team through a list of activities to reduce uncertainty if or when an incident occurs. MITRE ATT&CK Framework outlines the tactics and techniques that threat actors use during different stages of an attack.
Read Post
keeper

The Benefits of Integrating PAM With SIEM Solutions

Feb 14, 2025 By Jaryeong Kim In Keeper
Integrating Privileged Access Management (PAM) with Security Information and Event Management (SIEM) solutions offers many benefits for organizations, including enhanced threat detection, improved visibility, reduced risk of insider threats, simplified compliance and more. Continue reading to learn more about the benefits of integrating PAM with SIEM solutions and best practices for integrating the two.
Read Post
CrowdStrike

Detect Data Exfiltration Techniques with Falcon Next-Gen SIEM

Feb 13, 2025 By Radu-Emanuel Chiscariu In CrowdStrike
Sensitive data theft is among adversaries’ most common goals. For defenders, data exfiltration can lead to the compromise of customer data, public exposure of trade secrets, and potentially permanent business and reputational damage. Victims of data exfiltration may also face legal issues for non-compliance with data protection laws. This must be a top concern for businesses.
Read Post
datadog

Monitor your Atlassian audit records and event logs with Datadog Cloud SIEM

Feb 13, 2025 By Vera Chan In Datadog
Collaboration platforms like Atlassian Jira and Atlassian Confluence contain sensitive company and employee data, making them critical targets for cyberattacks. Teams use Jira to track and manage projects, and rely on Confluence as an internal knowledgebase for documentation, company policy guides, team wikis, and more. Atlassian organizations, which provide a centralized place for admins to manage their Atlassian products and users, are also prime targets.
Read Post
graylog

Adversary Tradecraft: A Deep Dive into RID Hijacking and Hidden Users

Feb 12, 2025 By Graylog Security In Graylog
Researchers at AhnLab Security Intelligence Center (ASEC) recently published a report on the Andariel threat group, a DPRK state-sponsored APT active for over a decade, that has been leveraging RID hijacking and user account concealment techniques in its operations to stealthily maintain privileged access to compromised Windows systems.
Read Post

State of the SIEM Market

Feb 11, 2025 By Graylog In Graylog
Navigate a shifting SIEM market: Challenges, lessons and strategic insights The SIEM market is evolving, and legacy systems struggle to keep up with today’s complex security challenges. Many mid-to-large enterprises, particularly those with revenues up to $5B, find outdated SIEMs hinder their agility and responsiveness. Vendor consolidation and shifting market dynamics add to the difficulty of selecting the right solution.
View Video
graylog

Using Streaming Data for Cybersecurity

Feb 10, 2025 By Jeff Darrington In Graylog
After a long day, you sit down on the couch to watch your favorite episode of I Love Lucy on your chosen streaming platform. You decide on the episode where Lucy can’t keep up with the chocolates on the conveyor belt at the factory where she works. Without realizing it, you’re actually watching an explanation of how the streaming platform – and your security analytics tool – work. Data streaming is the real-time processing and delivery of data.
Read Post

From our DevSecOps teams to yours: Discover Mo Copilot

Feb 10, 2025 By Sumo Logic In Sumo Logic
Join Rowan Noronha, Kui Jia, and John Visneski as they explore how cutting-edge AI is revolutionizing DevOps and security workflows with Sumo Logic Mo Copilot, an innovative AI-powered assistant designed to simplify and accelerate DevSecOps operations. Learn how Copilot leverages natural language processing to address common challenges such as troubleshooting, threat response, and unified data integration, offering teams unprecedented efficiency and clarity.
View Video

Proficio utilizes Elastic Security for threat management and AI integration

Feb 10, 2025 By Elastic In Elastic
Brad Taylor, CEO and co-founder of Proficio, discusses the dynamics of cybersecurity, the essentials of managed detection and response, and how Proficio leverages Elastic and AI to protect global organizations from emerging threats. About Elastic Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale. Elastic’s solutions for search, observability, and security are built on the Elastic Search AI Platform — the development platform used by thousands of companies, including more than 50% of the Fortune 500.
View Video

See CrowdStrike Falcon NG-SIEM in Action

Feb 8, 2025 By CrowdStrike In CrowdStrike
In a world of stealthy, fast-moving threats and ever-increasing log volumes, defenders need an edge that’s orders of magnitude faster, smarter, and more scalable than current approaches. Watch this video to see how to detect and stop the adversary Odyssey Spider quickly with CrowdStrike Falcon Next-Gen SIEM. Seamlessly extend the capabilities of the world-leading CrowdStrike Falcon platform to all data sources while stopping breaches and slashing costs compared to siloed tools.
View Video
graylog

Centralized Log Management for NIS2 Directive Compliance

Feb 6, 2025 By The Graylog Team In Graylog
As digital transformation expands the threat landscape, compliance mandates adapt to meet new challenges. In 2020, the European Commission announced its decision to accelerate its revision of the Directive on Security of Network and Information Systems (NIS2). When carrying out its impact assessment, the Commission realized that it needed to update the NIS Directive in response to new risks.
Read Post
exabeam

Best-Of-Breed Security Is Always Important-but for SIEM, It's Imperative

Feb 6, 2025 By Exabeam In Exabeam
Which approach provides superior cybersecurity: a single-vendor platform portfolio or a multivendor best-of-breed ecosystem? Superficially, single-vendor platforms seem to have various advantages: But take a closer look, and glaring gaps appear. Multiple, headline-grabbing security incidents have involved large platform players, and if you’re a seasoned cybersecurity leader, you should consider the risks associated with putting all your eggs in one basket.
Read Post
datadog

Simplify your SIEM migration to Microsoft Sentinel with Datadog Observability Pipelines

Feb 5, 2025 By Micah Kim In Datadog
As cyberattacks rise in number and sophistication, many CISOs are pushing their organizations to adopt modern SIEM solutions to better monitor and investigate threats to their applications and infrastructure. Enterprises with a large Microsoft Azure or Windows-based footprint in particular are increasingly eyeing Microsoft Sentinel to consolidate their security stack and workflows.
Read Post
exabeam

Traditional Security Can't Stop LOTL Attacks. Exabeam UEBA Destroys Them.

Feb 4, 2025 By Exabeam In Exabeam
Attackers are becoming more sophisticated and stealthier. Their methods are more advanced. Of these advanced methods, living-off-the-land (LOTL) attacks are the sneakiest and most effective. By using legitimate tools and processes already in your environment, malicious actors can get what they want without being seen. But with the Exabeam New-Scale Security Operations Platform and our industry leading user and entity behavior analytics (UEBA), security teams can stop them.
Read Post
elastic

Behind the scenes of Elastic Security's generative AI features

Feb 3, 2025 By Susan Chang, In Elastic
A quantitative approach to prompt tuning and LLM evaluation Elastic has long been developing machine learning (ML) and AI-powered security detections. We constantly bring in new technologies when available to help make our users’ lives easier. So, with the rise of generative AI (GenAI), we have developed even more Elastic Security features to use this powerful, new technology. Among those are.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.