Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

elastic

Airtel is strengthening security operations with Elastic's AI-driven analytics

Jun 27, 2025 By Puneet Duggal, In Elastic
In a previous blog post, we covered how Airtel’s (a leading telecommunications provider) managed security services (MSS), powered by Elastic Security, provide real-time threat detection, advanced analytics, and cloud security for enterprise customers. By using SIEM, endpoint protection, cloud security, and threat intelligence, Airtel enhances proactive threat hunting and incident response.
Read Post
sumologic

Balancing act: Sumo Logic vs. Splunk in the high-wire world of modern security

Jun 26, 2025 By Manny Lopez In Sumo Logic
Trying to stay ahead in cybersecurity can feel a bit like juggling gas-powered chainsaws while riding a unicycle across a tightrope—dangerous, noisy, and not for the faint of heart. Thankfully, security information and event management (SIEM) tools are your safety harness—keeping you steady, secure, and just far enough from the edge that you’re not plunging headfirst into the abyss of breached data, regulatory fines, and sleepless nights.
Read Post
datadog

Normalize your data with the OCSF Common Data Model in Datadog Cloud SIEM

Jun 25, 2025 By Eitan Moriano In Datadog
Security teams rely on SIEMs to aggregate and analyze data from a wide range of sources, including cloud environments, identity providers, endpoint protection platforms, network appliances, SaaS apps, and more. But every source delivers logs in its own format, with different field names, structures, and semantics. This fragmentation makes it difficult to build scalable, reusable detection rules or correlate threats across systems.
Read Post
graylog

7 SIEM Configurations To Improve Your Time to Value

Jun 25, 2025 By Jeff Darrington In Graylog
Whether you’re an Apple fan or not, one of the reasons people buy into their ecosystem is ease of setup across different devices. In a world where people customize the applications on their laptops to cross over with their mobile phones, an easy setup is a key to getting the most value from their devices. However, in the world of security information and event management (SIEM) solutions, the time to value often takes longer than most security teams want to admit.
Read Post
elastic

Elastic named a Leader in The Forrester Wave: Security Analytics Platforms, Q2 2025

Jun 24, 2025 By Natalie Blake In Elastic
We’re excited to share that Elastic has been named a Leader in The Forrester Wave: Security Analytics Platforms, Q2 2025. At Elastic, we believe security starts with the data. Elastic Security enables teams to detect, investigate, and respond to threats at scale, without lock-in or limits — powered by the speed and flexibility of Elasticsearch — and is grounded in a commitment to openness, innovation, and customer control.
Read Post
sumologic

The privacy illusion: when deleting your data doesn't actually delete your data

Jun 24, 2025 By David Girvin In Sumo Logic
Let’s talk about privacy—specifically, the kind you thought you had when you hit “delete.” OpenAI received a court order to retain every single ChatGPT conversation, even the ones you erased. Yep. Even the awkward ones. Even the ones that start with, “Hypothetically, if I were to…” Why? Because The New York Times is suing them over copyright, and now everyone’s deleted chats are potential evidence.
Read Post
graylog

SOC Burn Out Is Real: Improve Detection Without the Noise

Jun 24, 2025 By The Graylog Team In Graylog
“Too many alerts mean missing the real threats.” Alert fatigue is one of the top threats to a SOC’s performance. When everything looks like a threat, nothing does. The tradeoff is disabling rules, overly tuning rules, or simply ignoring alerts just to stay afloat. The risk? High-value, low-noise threats slip through the cracks.
Read Post
elastic

You thought Elastic only did SIEM? Think again!

Jun 23, 2025 By Jamie Hynds In Elastic
Elastic Extended Security, born from the acquisition of Endgame, brings years of battle-tested EDR and threat prevention expertise directly into Elastic’s Search AI Platform. This isn’t a bolt-on or third-party integration; it’s a native, deeply embedded component that redefines what’s possible with XDR. As data volumes grow exponentially, traditional EDR tools hit walls. Elastic doesn’t.
Read Post
elastic

AI, out-of-the-box!

Jun 23, 2025 By Amena Siddiqi, In Elastic
Elastic's GenAI capabilities are now available by default in Elastic Cloud Elastic AI features in Elastic Security, Observability, and Search are now enabled by default in Elastic Cloud. Getting started with generative AI (GenAI) shouldn’t be a project in itself. Too often teams encounter organizational friction that slows adoption of AI-based features, from third-party contracts and external API keys, to additional terms of service and billing management.
Read Post
devo

How AI Can Reduce Alert Fatigue in Your SOC

Jun 20, 2025 By Devo In Devo
Alert fatigue is a common phenomenon in Security Operations Centers (SOCs). It’s the digital equivalent of crying wolf. As SOCs are flooded with a relentless stream of alerts—many of which are low priority or false positives—it becomes increasingly difficult to identify truly critical security threats. Analysts are stuck spending countless hours verifying, contextualizing, analyzing, and acting on information, often at the cost of missing out on critical alerts.
Read Post
elastic

Reclaiming analyst time: Smarter investigations with AI in defence

Jun 20, 2025 By Crossley McEwen In Elastic
How the MOD can reduce investigation fatigue and boost operational efficiency Security analysts at the UK Ministry of Defence (MOD) — and everywhere — face an overwhelming challenge: They can receive thousands of alerts daily, and distinguishing genuine threats from false positives in a timely fashion has become nearly impossible without technological intervention.
Read Post

Vulnerability Data in Next Gen-SIEM with Falcon Exposure Management

Jun 20, 2025 By CrowdStrike In CrowdStrike
Vulnerability data is often siloed and captured in static dashboards, disconnected from real-time investigation. But with Falcon Exposure Management streaming into NG-SIEM, that changes. This demo shows how teams can correlate live vulnerability events with endpoint behavior, network activity, and even cloud telemetry. Using a Firefox example, we trace active and historical exposure, revealing how ExPRT.AI, asset metadata, and cloud-aware context come together in Next Gen SIEM.
View Video

4 Steps to Cyber Resilience | Expert Insights from LevelBlue | Dark Reading Interview

Jun 20, 2025 By LevelBlue In LevelBlue
In this exclusive Dark Reading News Desk interview, Theresa Lanowitz from LevelBlue shares four practical and powerful steps organizations can take to boost their cyber resilience. From fostering a proactive cybersecurity culture to elevating cyber discussions to the boardroom, this conversation is packed with actionable insights. Learn how to secure your software supply chain, leverage AI for defense, and stay ahead of emerging threats.
View Video
graylog

SIEM Essentials for Security Operations

Jun 17, 2025 By The Graylog Team In Graylog
For many Security Operations Center (SOC) teams, every day feels like a balancing act just shy of burnout. The alerts don’t stop. The tooling gets in the way more than it helps. And analysts—the people at the heart of security operations—are left trying to untangle signals in a sea of noise, pressure, and constant escalation. This isn’t just a tooling issue. It’s a deeper misalignment: the gap between what SIEM was supposed to be and what security teams actually need.
Read Post
graylog

Making the Most of Rule-Based Intrusion Detections

Jun 16, 2025 By Jeff Darrington In Graylog
Think back to being in high school and wanting to leave the room during class. Your teacher would give you a hall pass to show anyone monitoring the halls that you had permission to walk around. Your behavior, walking around during the class period, was suspect unless you followed the rule, getting a hall pass. For security teams, rule-based intrusion detections are the hall monitors that look for behaviors that indicate a problem.
Read Post

Cyber Resilience 2025 with Theresa Lanowitz | LevelBlue Futures Report

Jun 13, 2025 By LevelBlue In LevelBlue
What does cyber resilience look like in 2025? Join Theresa Lanowitz, Chief Evangelist at LevelBlue, as she unpacks the findings of the 2025 LevelBlue Futures Report: Cyber Resilience and Business Impact. In this exclusive video, Theresa shares expert insights into the evolving threat landscape, the rise of AI-readiness, software supply chain visibility, and the five key traits of a cyber resilient organization.
View Video
graylog

Telemetry: What It Is and How it Enables Security

Jun 11, 2025 By Jeff Darrington In Graylog
If you have ever built a LEGO set, then you have a general idea of how telemetry works. Telemetry starts with individual data points, just like your LEGO build starts with a box of bricks. In complex IT environments, your security telemetry is spread across different technologies and monitoring tools, just like in a large build your LEGO bricks come separated into smaller, individually numbered bags. In both cases, the individual bricks or data points aren’t special.
Read Post
datadog

Build, test, and scale detections as code with Datadog Cloud SIEM

Jun 11, 2025 By Nimisha Saxena In Datadog
Security teams often struggle to keep up with rapidly evolving threats, especially when they have to manually manage detection rules. Without automation or version control, it's difficult to maintain consistency across environments, track changes, or deploy updates quickly. Datadog Cloud SIEM supports detection as code, a structured approach to authoring, testing, deploying, and managing detection rules using code and infrastructure-as-code tools like Terraform.
Read Post

Cybersecurity GTM Strategy in Action | Tawnya Lancaster, LevelBlue

Jun 11, 2025 By LevelBlue In LevelBlue
How do you align cybersecurity services with what the market really needs? Tawnya Lancaster, Director of Product Marketing and Market Research at LevelBlue, shares how her team transforms global market insights into impactful go-to-market strategies. Learn about the rollout of flexible new service tiers across managed detection & response, vulnerability management, and network/cloud security.
View Video

Cybersecurity Innovation at LevelBlue | Rakesh Shah on What's Next

Jun 11, 2025 By LevelBlue In LevelBlue
What does the future of managed security services look like? Rakesh Shah, VP of Product Management at LevelBlue, breaks down the roadmap ahead in this forward-looking video. Discover how LevelBlue is simplifying security offerings, modernizing service delivery, and introducing a clear “good-better-best” tiering model to give customers more choice and control.
View Video
datadog

Automate Cloud SIEM investigations with Bits AI Security Analyst

Jun 10, 2025 By Vera Chan In Datadog
Security analysts face unprecedented challenges in today's cloud landscape. Security operations center (SOC) teams are chronically understaffed, and cybersecurity threats are skyrocketing—further intensified by GenAI-driven attacks. High false positive rates add to this strain, fueling alert fatigue and delaying the detection of real threats. These hurdles make it harder for analysts to keep pace, which ultimately drives up mean time to resolution (MTTR).
Read Post
devo

6 Core Components of an Alertless SOC Security Teams Should Know

Jun 6, 2025 By Devo In Devo
The traditional approach to managing security operations centers (SOCs) is straining the mental and physical reserves of even the most skilled security analysts—while also failing to provide the protection organizations need against today’s threats. Analysts are left to respond to a never-ending stream of alerts, resulting in an overwhelming, reactive cycle that stifles proactive investigation and threat hunting.
Read Post
Trustwave

MDR vs SIEM: Which is Right for Your Organization?

Jun 6, 2025 By Trustwave In Trustwave
The decision to buy a Security Information and Event Management (SIEM) product or outsource to a Managed Detection and Response (MDR) depends on a number of factors, including the size of your organization, the complexity of your IT infrastructure, and your overall security needs. Before we get into the main discussion, let’s step back and define what we are talking about so everyone is on the same page.
Read Post
CrowdStrike

How Falcon Next-Gen SIEM Protects Enterprises from VMware vCenter Attacks

Jun 5, 2025 By Tony Gore - Adrian Godoy In CrowdStrike
Internet-facing assets are targeted for many reasons, such as to establish persistence, evade defensive capabilities, and access sensitive networks. According to the search engine Shodan, approximately 1,600 VMware vSphere instances are directly accessible via the internet, representing a significant attack surface.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.