Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike Falcon Next-Gen SIEM Correlation Rule Template Discovery Dashboard

Finding the right detection content can be a challenge. The Correlation Rule Template Discovery Dashboard in CrowdStrike Falcon Next-Gen SIEM makes it easy to discover, explore, and activate relevant correlation rules—based on the data you already ingest. This demo highlights key features like compatibility mapping, real-time data source health, and automatic surfacing of new and updated templates. Stay aligned with the latest threats and streamline detection engineering in just a few clicks.

From alert fatigue to action: Smarter SOC workflows for defence teams

Free your analysts to focus on what really matters: security outcomes. Security teams in the UK Ministry of Defence (MOD) are facing a dual burden: the growing volume and sophistication of cyber threats and the relentless operational grind of triaging alerts, managing compliance, and stitching together intelligence from fragmented systems. The reality is clear: Traditional security operations center (SOC) workflows aren't built for today’s pace and quantity of threats.

Are You Protecting the Right People in Your Organization?

If your security priorities still center on CVSS scores and device vulnerabilities, you’re missing a significant piece of the risk puzzle. People. Attackers aren’t following your org chart. They’re targeting whoever gives them access. Enter the concept of Very Attacked People (VAPs): individuals in your environment who attract the most persistent, targeted attacks. And they’re not always the CEO or the CISO.

Ep 1: So you're buying your first SIEM...here's how not to suck at it

You’ve been told you need a SIEM. Maybe it was your CISO. Maybe it was your auditor. Maybe your SOC is tired of stitching together logs with duct tape and Python scripts. Doesn’t matter — you’re now on the SIEM buying journey. Congratulations… and condolences. Join security experts, Adam White and David Girvin as they walk through the ultimate playbook for buying your first SIEM without lighting your budget (and your team’s morale) on fire.

Ep 3: CISOs hate their security tools

Sumo Logic’s 2025 Security Operations Insights report surveyed 500 IT and security leaders from enterprise organizations to uncover what’s really happening inside today’s SOCs. Join security experts Adam White, David Girvin, and Zoe Hawkins as they break down the top findings from the report and shed light on what every analyst and CISO has felt for years: the system needs a reset.

Ep 2: Hacked together: fast, safe prototyping with AI

Join security experts Adam White, Chas Clawson, and Seth Williams as they explore how AI-first development is reshaping the way cybersecurity teams build, test, and deploy solutions. Traditional development cycles often leave critical ideas trapped in backlogs, but with Gen-AI and language models, security teams can now move from concept to prototype in hours, not months.

SharePoint "ToolShell" zero day

Hats off to the great work the community and industry has done regarding the “ToolShell” attack against Microsoft’s On-Premise SharePoint servers. The goal of this article is to build on that great work and help Sumo Logic customers with on-prem SharePoint servers investigate and identify evidence within their environments.

AI and the 2025 SIEM landscape: A guide for SOC leaders

Security teams often find themselves having to put out the immediate fires in front of them, but this comes at the expense of implementing a more methodical risk reduction strategy. Attack surfaces are expanding, and new risks emerge with new tech. Modern security operations center (SOC) teams are drowning in alerts, stretched thin by talent shortages, and racing to stay ahead of increasingly sophisticated adversaries.

Bits AI Security Analyst: Automate Cloud SIEM investigations

Datadog's Bits AI Security Analyst transforms the way security teams handle investigations by autonomously triaging Datadog Cloud SIEM signals. Built natively in Datadog, it conducts in-depth investigations of potential threats and delivers clear, actionable recommendations. With context-rich guidance for mitigation, security teams can stay ahead of evolving threats with greater efficiency and precision.

AI is cybersecurity's biggest threat

It’s also its greatest defense The biggest threat in our rapidly evolving cybersecurity landscape is artificial intelligence (AI).1 It’s also our greatest defense. Cybersecurity is a high-stakes game where everything is on the line and decisions have to be made fast. For years, cybersecurity strategy has been about increasing visibility to make informed decisions from vast amounts of data.

Model Context Protocol (MCP) vs Model Control Plane (MoCoP): Why your AI security is screwed if you only have one

If you’re building AI systems with agents, plugins, and orchestration layers and you’re only thinking about how to route traffic, you’re halfway to being pwned. Everyone’s rushing to build a Model Context Protocol (MCP) — and that’s great. But almost no one’s talking about MoCoP — the Model Control Plane, which is just as important and arguably where the riskiest stuff happens. (Also, side note, who the hell keeps making these damn acronyms so confusing?

Day in the life of an SOC leader

A security operations center (SOC) leader is the point person for an organization’s security operations. They run a team of security analysts, engineers, and other specialists. But what exactly do they do on a day-to-day basis? As the person managing the organization’s cybersecurity hub, the SOC leader has to navigate all the complexities that come with it.

5 Ways CISOs Can Use Selective Retrieval to Optimize Data Lakes

Data lakes have evolved. Once treated as passive storage archives, they’re now becoming active components of enterprise risk management. The driver? Selective retrieval — the ability to park large data volumes in cold storage and later retrieve targeted slices for forensic or compliance needs. This shift matters. According to 2025 data from Cybersecurity Insights Group, 73% of enterprises report that SIEM ingestion costs are limiting their real-time analysis capacity.

Assess your SIEM's Capabilities

The SIEM landscape is undergoing rapid and profound changes, driven by the rise of new threats and innovative technologies. For you, security analysts and engineers, this means reassessing whether your current SIEM solutions are still up to the task. Waiting until after a breach to evaluate your SIEM can lead to disastrous consequences. This webinar provides a clear, no-nonsense roadmap to help you critically evaluate your SIEM, ensuring your security operations are adequate and exceptional.

CrowdStrike Named a Leader in the 2025 GigaOm SIEM Radar Report

CrowdStrike is proud to be named a Leader and Fast Mover in the 2025 GigaOm Radar for Security Information and Event Management (SIEM). This recognition positions CrowdStrike Falcon Next-Gen SIEM as the core of the AI-native SOC and future of security operations. CrowdStrike earned perfect 5/5 scores in key areas including Attack Surface Coverage, LLM-Based Co-Pilot and Agents, Automation, and Threat Research Units.

Enhance your cloud security visibility with the updated AWS CloudTrail app

For organizations operating in the cloud, visibility is everything. You need a reliable source of truth to answer “who did what, when, and where,” whether you’re investigating a security incident, chasing compliance goals, or monitoring operational activity. Enter the Sumo Logic CloudTrail App, your go-to solution for transforming raw AWS CloudTrail logs into meaningful, actionable insights.

So you're buying your first SIEM... here's how not to suck at it

Welcome to the chaos. You’ve been told you need a SIEM. Maybe it was your CISO. Maybe it was your auditor. Maybe your SOC is tired of stitching together logs with duct tape and Python scripts. Doesn’t matter — you’re now on the SIEM buying journey. Congratulations… and condolences. Let’s walk through how to actually buy your first SIEM without lighting your budget (and your team’s morale) on fire.

Unlock Email Threat Visibility with Mimecast and Graylog

Email threats aren’t slowing down. From credential phishing to malware-laced attachments, email remains one of the most exploited entry points for attackers. If you’re already using Mimecast to help mitigate that risk, you’re ahead of the curve — but raw log data only gets you so far. Starting with Graylog 6.2.3, you can pull logs directly from Mimecast using API v2.0 and view them immediately with built-in Illuminate Dashboards.

Elastic strengthens AI security integration with Microsoft Azure AI Foundry Model Catalog

Elastic partners with Microsoft to provide integration with the Azure AI Foundry Model Catalog. This collaboration significantly enhances the choices available to security analysts, providing access to a diverse array of powerful large language models (LLMs) that are native to the Azure cloud ecosystem. This partnership underscores Elastic's commitment to delivering cutting-edge cyber defenses for Microsoft Azure customers, using their existing cloud infrastructure and investments.

A Beginner's Guide to Ransomware-as-a-Service (Raas)

Over the last few years, news reports around ransomware attacks have noted that the attacks are increasingly sophisticated. Simultaneously, they say that the attackers are less sophisticated than in the past. While these two statements appear to conflict with each other, they are both true when viewed through the lens of the current cybercriminals business models.

Elevating data security: Ingest data from an Azure Event Hub secured by Entra ID

If you’re just here for the practical example, skip ahead. Are you still relying on static connection strings or shared access signature (SAS) keys to protect your sensitive data streams in Azure Event Hubs? While convenient, these methods can introduce security vulnerabilities. This blog demonstrates a more secure and modern approach.

AI-Powered Email Threat Detection and Response with Next-Gen SIEM

Email remains the top attack vector, and speed is critical when every second counts. Falcon Next-Gen SIEM and Fusion SOAR streamline detection by ingesting email telemetry and automating investigation with Charlotte AI. By analyzing sender behavior and message content, Charlotte AI delivers real-time, human-readable verdicts with confidence scoring. Teams can quickly isolate threats, block senders, or escalate suspicious activity. With AI-powered workflows and automation, email triage becomes faster, more precise, and scalable.

How AI is Redefining SOC Architecture

If you’ve been in cybersecurity longer than five minutes, you know one thing: legacy SOC architecture isn’t just showing its age — it’s creaking under the weight of today’s threats. Cybersecurity analyst Francis Odum nailed it when presenting at Torq’s SKO 2025: “Legacy SOAR assumed everything starts in the SIEM. Now, teams connect automation directly to EDR, email, and identity systems.”.

Understanding the CISO: Role, skills, and security impact

In the face of increasingly sophisticated cyber threats, the chief information security officer, or CISO, is responsible for ensuring the organization's data is secure. CISOs ensure that proper security strategies, policies, and technologies are working to meet their goals of mitigating risk, maintaining regulatory compliance, and upholding customer trust. A CISO helps align security initiatives with business goals, enabling growth while minimizing disruptions and vulnerabilities.

ManageEngine Log360 launches Zia Insights, its first AI-powered contextual analytics for modern SOCs

Security operations centers (SOCs) have been drowning in a sea of alerts, raw logs, and siloed data for quite sometime now. A study by Morning Consult and IBM showed that 63% of alerts handled by SOCs daily are false positives or low priority, and analysts spend one-third of their day investigating these alerts. Yet, the information needed to detect, investigate, and respond to threats is often already present, just fragmented and buried. This is where AI steps in to rewrite the rules of engagement.

XDR vs. SIEM: Defeating Cyber Chaos

Cybersecurity decision-makers face a growing challenge: defending against a rising tide of threats without drowning in operational complexity. Designed for large security teams, SIEM platforms often introduce more chaos than clarity, burdening small teams with high costs, complex deployments, and overwhelming data. In this webinar, Stephen Helm and Ricardo Arroyo will discuss the core differences between SIEM and XDR (Extended Detection and Response) and explain why XDR is emerging as the smart, scalable choice for modern MSPs and lean IT security teams.

Ten new and updated apps for securing and monitoring your environments

Whether you rely on Sumo Logic for securing your systems, monitoring your infrastructure, or maximizing application performance, connecting to your tech stack is essential. That’s why we continuously release new apps and upgrade existing ones, ensuring you can easily connect to your stack and visualize key data with out-of-the-box dashboards. Let’s dive into some of the latest additions to our app catalog, designed to help you monitor, secure, and optimize your environment.

17 Common Indicators of Compromise

On a sunny summer vacation day, your childhood self is running around a playground looking everywhere for a small piece of paper as part of a treasure hunt. Each clue you find leads to another, then another, until you finally locate the hidden treasure. Investigating a security incident is similar to this process, but instead of clues written on paper, your clues are digital artifacts that attackers left in your systems. These digital artifacts are called indicators of compromise (IoCs).

AI adoption in security: Top use cases and mistakes to avoid

Widespread implementation of artificial intelligence (AI) in security presents a paradox. On one hand, it helps security experts combat advanced threats at scale. On the other hand, AI is also contributing to the scale of sophistication of adversaries' threat campaigns. To fight fire with fire, organizations are increasingly automating security processes to make up for the uneven playing field on which they find themselves.

Lessons from the 2025 Security Operations Insights report

Sumo Logic’s 2025 Security Operations Insights report doesn’t just survey the field—it speaks for the SOC. From stacked queues and stale alerts to automation that never fires and dashboards that scroll but don’t inform, this report puts numbers behind what every analyst and CISO has felt for years: the system needs a reset. But this isn’t a story about failure. It’s a wake-up call—and a blueprint.

How Threat Campaign Detection Helps Cut Through Alert Fatigue

Security fatigue gets attention for a reason. Phishing emails, authentication prompts, and constant vigilance all take a toll. But alert fatigue is the deeper, more destructive force. It overwhelms analysts, delays response, and creates blind spots that adversaries exploit. Security teams today are buried under noisy alerts and fragmented tooling. False positives waste time. Manual triage eats up valuable analyst hours. Eventually, burnout sets in and threats slip by. It is not a hypothetical risk.

SOC analyst vs. security analyst: What's the difference?

A security operations center (SOC) analyst enhances your security posture by defending the organization against cybersecurity threats. Responsible for monitoring, detecting, investigating, and responding to cyber threats, the SOC analyst is the first line of defense in keeping the organization’s IT ecosystem secure when an incident arises. A security analyst, similar to a SOC analyst, is responsible for proactive defense and security posture.

Migrate from your existing SIEM and quickly onboard security teams with Datadog Cloud SIEM

Many organizations face significant challenges with onboarding teams to a new or existing SIEM. Security teams grapple with escalating expenses tied to data ingestion, storage, and retention at scale. Steep learning curves can make setup an ongoing and frustrating chore, leading to mistakes and gaps in coverage. Further, SIEMs with constrained ecosystem integrations block users from the tools and customizable workflows they need and are comfortable with.

Why your DevSecOps team needs a log management solution

Not all log management and log analysis tools are created equal. With organizations like yours generating large amounts of log data, understanding how to manage, analyze, and secure these log files is key for maintaining system performance, meeting compliance requirements, detecting performance issues, and responding to incidents faster.

Stop writing dumb AI security policies: use threat models, not fear

Every time someone asks me about building their AI policy, I die a little inside. Not because it’s a bad question, but because my answer is always the same: “Can we not build it off pure fear for once?” Most people don’t understand how AI architecture works, so their first instinct is to panic. And, we’ve seen this movie before: cloud, mobile, bring your own device (BYOD).