Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Elevating public sector cyber defense with AI-powered threat hunting

Public sector organizations face sophisticated, persistent threats — 38% of public sector organizations say their cyber resilience is insufficient compared to 10% of medium to large private businesses. With sensitive data and critical infrastructure at stake, agencies need tools that enable proactive detection and rapid investigation, all while keeping data inside a secure boundary.

Why the Gartner Critical Capabilities for SIEM report belongs in every buyer's toolkit

Have you ever wished for a tool that could guide you, even on the foggiest days? That was my father’s compass. He carried it not because it told him where he was, but because it reminded him where true north was. I spent twelve years in the U.S. Navy as a cybersecurity practitioner, and that same compass has stayed with me. And in the world of SIEM and threat detection, the Gartner Critical Capabilities for Security Information and Event Management (SIEM) report feels like that compass.

Quantifying Risk in the SOC: From Analyst Actions to Measurable Impact

How much value are you really getting from your logs, and what are you giving up to stay on budget? In this episode of Logs and Lattes, host Palmer Wallace sits down with Seth Goldhammer, VP of Product Management at Graylog, for a candid conversation about the hidden cost of traditional SIEM pricing. Seth explains how ingest-based and resource-heavy licensing models pressure security teams into tough tradeoffs, such as dropping logs, tuning down detections, or limiting retention just to avoid budget overages.

Exabeam Security Intelligence Summit UKI 2025 | Partner Track Highlights

Partners from across the UKI region joined us in London for the Exabeam Security Intelligence Summit. This video captures highlights from our Partner Track, where we launched the new APEX Partner Program: built to drive profitability, accelerate enablement, and create the most partner-driven ecosystem in cybersecurity. Watch the recap of the event and see how we’re raising the bar – together. Subscribe for more product demos and cybersecurity insights!

Exabeam Security Intelligence Summit UKI 2025 | Event Highlights & Key Takeaways

Relive the highlights from the Exabeam Security Intelligence Summit in London, where security leaders, users, and partners across the UK and Ireland gathered for a day of innovation and collaboration. From breakthrough AI advancements in SIEM and UEBA to inspiring customer success stories and hands-on breakout sessions, this event was more than just a conference, it was a community redefining the future of cybersecurity. Don’t miss the energy, insights, and connections that made this summit one to remember.

Stopping USB-borne attacks at the endpoint with Elastic Security Device Control

In today’s enterprise environments, endpoints are more than just laptops and desktops. They are the critical bridge where people, applications, and data intersect. While much attention is given to malware prevention and threat detection, one security layer is often underestimated: device control.

How AI Cuts SIEM Migration Time from Months to Minutes

SIEM migration is tedious, time-consuming, and pulls security professionals away from actual security work. Manually exporting thousands of detection rules, translating query logic, and fixing errors can take weeks or months. In this episode of AI can do what now?!, Haran Kumar (principal security solutions architect at Elastic) walks through how AI actually helps automate SIEM migration.

Recognition Without Compromise: Graylog's Rise in the SIEM Market

Graylog earned recognition from both Gartner and GigaOm, and it is reshaping how teams think about SIEM. In this episode of Logs & Lattes, host Palmer Wallace talks with Kimber Spradlin, Chief Marketing Officer at Graylog, about what this dual recognition means for customers, analysts, and the future of security operations.

Logs & Lattes: Episode 3 - Recognition Without Compromise: Graylog's Rise in the SIEM Market

Graylog earned recognition from both Gartner and GigaOm, and it is reshaping how teams think about SIEM. In this episode of Logs & Lattes, host Palmer Wallace talks with Kimber Spradlin, Chief Marketing Officer at Graylog, about what this dual recognition means for customers, analysts, and the future of security operations.

Advanced vector search in air-gapped environments

For organizations in air-gapped environments with no external network connection, implementing the latest search and AI technology can be challenging, often to the point of impossibility. However, Elastic’s customers in highly sensitive industries, such as national security and defense, have relied on Elastic’s agile technology for over a decade, trusting it for mission-critical use cases in air-gapped environments or even on tech kits.

How Behavioural Analytics Strengthens Compliance with Australia's Protective Security Policy Framework (PSPF)

The Australian Government’s Protective Security Policy Framework (PSPF) sets mandatory requirements for government entities to safeguard their people, information, and resources. As agencies rely more on digital systems, how can you meet these expectations? Behavioural analytics is designed for a today’s hybrid environments, where threats can be human or automated.

Seeing the Invisible: Visualizing and Protecting AI-Agent Activity with Exabeam & Google

Artificial intelligence is no longer just an emerging technology in security operations and modern SIEMs. AI agents now enrich alerts, drive investigations, generate reports, and increasingly act as extensions of human analysts. But as with any powerful technology, new risk surfaces follow. From the Exabeam perspective, every entity in your environment deserves protection.

Overcoming Cybersecurity and Risk Management Challenges

Every time you leave your home, you take various risks, like being in a car accident or being struck down by a meteor. In some cases, like the meteor, the likelihood of the event is so low as to be nearly nonexistent. In others, like the car accident, the likelihood might be higher. Similarly, every technology that you connect to your networks creates a cybersecurity security risk. Any device or application that connects to the public internet can be an entry point for attackers.

Ep 15: Beginner's guide to security tools

In this episode, we run through our beginner's guide to security tools, emphasizing the importance of people, processes, and technology. We chat about the NIST framework as a foundational resource for building security programs, highlighting key steps such as identifying and managing risks. We also discuss basic tools like password managers and multifactor authentication as essential for enhancing security, particularly against threats like phishing. Finally, we explore the integration of AI in security and its potential to improve efficiency while maintaining human oversight.

How Airties migrated from ArcSight to Elastic and cut investigation times from hours to seconds

In a rapidly evolving digital landscape, organizations must continuously adapt their security operations to keep pace with new threats and business needs. For the team at Airties, a global leader in Wi-Fi mesh technology and access point solutions, this meant rethinking their legacy security information and event management (SIEM) platform. Airties is a manufacturer of access points, primarily serving large telecom operators. Its solutions power the Wi-Fi networks in millions of homes worldwide.

How Graylog Uses Explainable AI to Help Security Teams

Security teams face an endless stream of alerts, false positives, and investigation backlogs. Every second counts, yet many AI-driven tools promise to handle everything for you that leaves analysts uncertain about how conclusions were made. Graylog takes a different path. The company develops assistive AI that helps analysts make faster, smarter calls with context, transparency, and control. No black boxes. No mystery logic.

Ep 14: Security IS observability: Prove us wrong

In this episode, we discuss the critical intersection of security and observability within organizations. We highlight the often contentious relationship between security analysts and SREs, emphasizing the importance of fostering a collaborative culture to effectively address incidents. All teams should focus on solutions rather than blame, as user experience is affected by both security and infrastructure issues. We explore how to break down silos, especially in the context of AI security, and encourage cross-disciplinary learning to enhance overall security practices.

Logs & Lattes: Episode 2 - From Noise to Action: Smarter Security Ops That Reduce Risk

Security teams are overwhelmed by alerts, but which ones really matter? In this episode of Logs & Lattes, host Palmer Wallace talks with Rich Murphy, Senior Product Manager at Graylog, about how smarter security operations help teams cut through the noise and focus on what truly reduces risk. From alert fatigue to risk-first response, they unpack practical ways to prioritize real threats, automate with context, and make incident response faster and more effective. Learn how modern SOCs are evolving beyond alert overload to focus on meaningful, risk-based action.

From Noise to Action: Smarter Security Ops That Reduce Risk

In this episode of Logs & Lattes, host Palmer Wallace talks with Rich Murphy, Senior Product Manager at Graylog, about how smarter security operations help teams cut through the noise and focus on what truly reduces risk. From alert fatigue to risk-first response, they unpack practical ways to prioritize real threats, automate with context, and make incident response faster and more effective. Learn how modern SOCs are evolving beyond alert overload to focus on meaningful, risk-based action.

From Tool Sprawl to One Platform: How Graylog Simplifies Security Visibility

Security operations are buried under too many tools. Analysts switch between consoles, piece together context by hand, and burn valuable hours reconciling data that should already work together. According to Gartner, security leaders use an average of 19 different tools, and 80% say this level of complexity creates blind spots. This fragmentation slows down detection and response, drives up costs, and wears out teams that are already stretched thin.

Splunk Ranked Number 1 in the 2025 Gartner Critical Capabilities for Security Information and Event Management Use Cases

In addition to Splunk’s recognition as an 11-time Leader in the 2025 Gartner Magic Quadrant for Security Information and Event Management (SIEM), we are honored to announce that Splunk has been ranked as the SIEM solution in all three Use Cases for the second consecutive time in the 2025 Gartner Critical Capabilities for Security Information and Event Management report.

Six Times a Leader, Critics and Audiences Agree

Today I am thrilled to announce that Securonix has, once again, been positioned in the Leaders Quadrant of the 2025 Gartner Magic Quadrant for SIEM. Six times running. That kind of consistency doesn’t happen by chance. In a market full of trend cycles and flavor-of-the-month solutions, we strongly feel being recognized as a Leader time after time is simple: execute, innovate, earn customer trust, and show up every day for the security community.

From Heritage to Horizon: The Evolution and Innovation of New Securonix To Become 6X Leader in Gartner MQ for SIEM

When Gartner released the 2025 Magic Quadrant for SIEM this week, I took a moment to pause and reflect. For the sixth year in a row, Securonix is recognized as a Leader. Milestones like this don’t happen by accident. They’re the result of relentless effort, bold decisions, and an unwavering belief in the direction we chose.

Exabeam Named a Leader in the 2025 Gartner® Magic Quadrant for SIEM for the Sixth Time

BROOMFIELD, Colo. & FOSTER CITY, Calif. - October 13, 2025 - Exabeam, a global leader in intelligence and automation that powers security operations, today announced it has been named a Leader in the 2025 Gartner Magic Quadrant for Security Information and Event Management (SIEM). This marks the sixth time that Exabeam has been recognized by Gartner. To download a copy of the full 2025 Gartner Magic Quadrant for SIEM report, click here.

Monitor OCI Audit Logs with Datadog Cloud SIEM

Oracle Cloud Infrastructure (OCI) provides compute, storage, networking, and database services for running enterprise applications and workloads in Oracle. OCI supports both traditional and cloud-native applications, offering scalable, secure, and high-performance infrastructure for hybrid and multi-cloud environments. Securing workloads in OCI can be complex for organizations managing a mix of on-prem, hybrid, and cloud environments.

How AI is transforming Elastic's Security team

Spending hours creating threat intelligence reports is a thing of the past with our InfoSec AI Assistant, built on Elastic’s Search AI Platform. Mandy Andress, our CISO, shares how the AI Assistant has transformed the way our security team gathers, documents, and reports on threats — cutting report-building time by over 75%. Learn how we’re using generative AI to build threat intelligence reports quickly, assess relevance and risk faster, and shift from reactive defenses to proactive security strategies.

CrowdStrike Named a Visionary in 2025 Gartner Magic Quadrant for Security Information and Event Management

We are thrilled to announce that CrowdStrike Falcon Next-Gen SIEM has been named a Visionary in the 2025 Gartner Magic Quadrant for Security Information and Event Management (SIEM). Falcon Next-Gen SIEM is reimagining SIEM with AI, real-time data, and a unified platform approach, delivering the automation, speed, and control to transform SOC operations and power the agentic SOC.

Exabeam Nova: The First Autonomous Multi-Agent AI for Cybersecurity

Security teams are in an AI arms race — facing massive data volumes, insider threats, and adversaries using AI to find vulnerabilities and launch faster, smarter attacks. Exabeam changes the game with Exabeam Nova, the first autonomous multi-agent AI purpose-built for security operations. Fully embedded within the New-Scale Security Operations Platform, Exabeam Nova delivers measurable outcomes across threat detection, investigation, and response.

SIEM's Next Chapter: Evolving, Not Dying

The obituary for SIEM has been written more than once. The latest headline from Dark Reading calls it “dying a slow death.” Catchy. But wrong. If you work in a SOC, you already know the need for centralized, contextualized visibility is not going anywhere. What is changing the future of SIEM, is how SIEM delivers it. If you are still thinking of SIEM as a clunky, high-cost log hoarder, you are stuck in the wrong decade.

Exabeam Appoints Pete Harteveld as CEO

BROOMFIELD, Colo. & FOSTER CITY, Calif. - October 8, 2025 - Exabeam, a global leader in intelligence and automation that powers security operations, today announced Pete Harteveld as Chief Executive Officer. The leadership transition follows the decision by Chris O'Malley to step into retirement after three years of dedicated service to the company and over 30 years of executive leadership.

AI can do what now?! Agentic AI is the autonomous future coming to security operations

Agentic AI in cybersecurity promises to transform workflows as we know them, enabling a new level of personalization, automation, efficiency, and innovation. It’s already being deployed by security teams for use cases like autonomous threat detection and response, advanced threat hunting, automated incident investigation, real-time fraud protection, and more. So, how is agentic AI working overtime to help security analysts build a more resilient security posture?

The New CISO Podcast Ep.134 - Evan Ferree | From Breach to BISO: Becoming a Security Influencer

Most security professionals know what a CISO does. But what about a BISO? And why are Fortune 500 companies increasingly creating this executive role? In this episode of The New CISO Podcast, host Steve Moore sits down with Evan Ferree, Staff Vice President and Business Information Security Officer at a Fortune 50 company, to decode one of cybersecurity's most misunderstood leadership positions. What You'll Learn.

How Exabeam Detects LLM Abuse for Google Cloud Model Armor

In this demo, see how the Exabeam New-Scale Security Operations Platform integrates with Google Cloud Model Armor to detect and stop abuse of large language models (LLMs). You’ll learn how Exabeam: Monitors AI activity for suspicious or malicious behavior Uses advanced analytics to spot LLM misuse in real time Helps security teams enforce responsible AI use policies Watch how Exabeam and Google Cloud work together to provide stronger visibility, detection, and protection against emerging threats targeting LLMs.

How Graylog Helps You Spot LockBit-Style Attacks Sooner

The DFIR Report recently detailed a LockBit attack with ransomware intrusion that succeeded without advanced exploits or zero-day vulnerabilities. The attack relied on a stolen AnyDesk installer, credential reuse, and renamed PowerShell scripts that blended into routine activity. These moves were not sophisticated, but they were fast and effective. The end result: complete domain encryption.

From endpoint to XDR: Operationalize Jamf Protect data in Elastic Security

Enhance your threat detection, investigation, and response capabilities by integrating Jamf Protect macOS data within Elastic Security. Security teams often struggle to detect and respond to macOS threats with endpoint data alone. The integration with Jamf Protect changes that. Jamf Protect delivers rich macOS telemetry and built-in protections like Threat Prevention and Network Protection, powered by Jamf Threat Labs.

Case Management with Falcon Next-Gen SIEM

Speed and structure are essential for modern incident response. Falcon Next-Gen SIEM introduces built-in Case Management, giving security teams a unified workspace to organize detections, artifacts, and related activity. Analysts can standardize investigations with templates, enforce SLAs, and escalate cases automatically to the right teams.

Smart Logging Without the Price Trap

How much value are you really getting from your logs, and what are you giving up to stay on budget? In this episode of Logs and Lattes, host Palmer Wallace sits down with Seth Goldhammer, VP of Product Management at Graylog, for a candid conversation about the hidden cost of traditional SIEM pricing. Seth explains how ingest-based and resource-heavy licensing models pressure security teams into tough tradeoffs, such as dropping logs, tuning down detections, or limiting retention just to avoid budget overages.

Ten modern SIEM use cases at cloud scale

The role of SIEM has never gone away. From the beginning, it’s been the backbone of security operations: the system where logs converge, alerts are analyzed, and incidents are investigated. What’s changed is our ability to use it correctly. Legacy, traditional SIEM tools forced trade-offs. Teams filtered data at ingest, dropped logs to control costs, or siloed analytics into disconnected point tools. The result was a SIEM that felt heavy, reactive, and underwhelming.

Elastic Security Explained: Transparency, AI, and the Future of Threat Hunting

Elastic’s James Spiteri joins John Hammond to dive deep into the evolution of Elastic Security, from the ELK stack’s early days to today’s full-fledged, unified SIEM, XDR, and cloud security solution powered by agentic AI and automation. They discuss free tools, open detections, and how Elastic is making cybersecurity more accessible and collaborative for everyone.

Security Pipelines Are Broken. Here's How to Fix Them

There’s a quiet failure at the heart of many security programs. It’s not a lack of data. It’s too much of the wrong data. Telemetry pipelines built for volume, not visibility, now flood teams with noise instead of insight. The result? More alerts. Slower response. Overworked analysts are stuck maintaining ingestion rules instead of catching real threats.

From raw data to real-time defense: A conversation with John Hammond

Explore how Elastic Security's unified platform with SIEM and XDR protections transforms SOC workflows through AI-powered analytics and consolidated security operations. Elastic Security Director of Product Management James Spiteri recently joined cybersecurity researcher, educator, and content creator John Hammond for an in-depth technical demonstration. John spends his days analyzing malware, breaking down attacker techniques, and making hackers earn their access.

From Fragmented Intel to Unified Response

Threat intelligence holds incredible promise—but only if it translates into timely, decisive action. Too often, security teams chase disconnected data across fragmented tools, incompatible formats, and siloed workflows. The result? Slower response times, missed threats, and exhausted SOC analysts. The answer is clear: unified intelligence. That’s the power of the Securonix Unified Defense SIEM and ThreatQ integration—streamlined, contextualized, and built for action.