Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Fortifying Your Inbox: Advanced Email Security with Check Point & LevelBlue

Nov 27, 2025 By LevelBlue In LevelBlue
As email-based cyberattacks surge, security teams are struggling to stay ahead of increasingly sophisticated phishing, Business Email Compromise (BEC), and AI-driven social engineering. With attackers exploiting platforms like Microsoft 365, Google Workspace, OneDrive, and SharePoint, organizations face growing pressure to strengthen protection, visibility, and compliance.
View Video
sumologic

Detecting SHA1-Hulud: the logs must flow

Nov 26, 2025 By Daniel Kaiser In Sumo Logic
Sha1-Hulud has burrowed back into our lives, spreading rapidly and causing more destruction than ever. Named after the famous worm from the Dune franchise, this attack is also impacting global organizations. Since its first widescale spread on September 16, 2025, this worm has demonstrated its ability to propagate rapidly with high impact using the following techniques: This variant includes some new behavior, including.
Read Post
graylog

MCP ROI in a New Era of AI Orchestrated Threats

Nov 26, 2025 By The Graylog Team In Graylog
Security leaders spent most of the past year testing AI driven security automation. Many discovered that the promise of fully autonomous SOC operations collided with the reality of hallucinations, opaque recommendations, and inconsistent outcomes. McKinsey research now shows that more than 80 percent of organizations have not realized meaningful results from gen AI programs.
Read Post
datadog

Rehydrate archived logs in any SIEM or logging vendor with Observability Pipelines

Nov 26, 2025 By Zara Boddula In Datadog
Security and observability teams generate terabytes of log data every day—from firewalls, identity systems, and cloud infrastructure, in addition to application and access logs. To control SIEM costs and meet long-term retention requirements, many organizations archive a significant portion of this data in cost-optimized object storage such as Amazon S3, Google Cloud Storage, and Azure Blob Storage.
Read Post
graylog

5 Signs You've Outgrown Your Open-Source SIEM

Nov 25, 2025 By Jeff Darrington In Graylog
The evolution of your security stack is similar to the different phases of buying cars. In the beginning, you just need enough to transport a few items, maybe yourself and a few friends. The inexpensive two-door hatchback is perfect. However, as your family grows, whether with small humans or pets, you increasingly need more space and more capacity, leading to purchasing a four-door sedan or, even, a mini-van.
Read Post

Ep 19: The atomic habits of cybersecurity professionals

Nov 25, 2025 By Sumo Logic, Inc. In Sumo Logic
In this Masters of Data episode, we welcome back Zoe Hawkins and Roland Palmer to discuss building better security practices through small, incremental improvements personally and professionally. We emphasize regularly auditing security policies to avoid unnecessary friction that forces workarounds, treating security as sociology rather than just technology. We cover practical approaches like habit-stacking, weekly business reviews, staying informed about threats through intentional news consumption, and developing cognitive humility with security prompts.
View Video
graylog

How to Use Data Lakes to Reduce SIEM Costs and Strengthen Investigations

Nov 21, 2025 By The Graylog Team In Graylog
Most teams think of data lakes as cold storage. A long-term archive. A place to keep logs “just in case” while budgets tighten and ingest volumes rise. Functional, sure. But limited. The traditional data lake keeps everything, helps occasionally, and rarely fits the way analysts work. Graylog approaches the data lake differently. In Graylog 7.0, the data lake is not a warehouse. It is a pressure release valve for teams overwhelmed by storage cost, investigation delays, and cloud data sprawl.
Read Post
sumologic

You can't secure what you can't see: Why AgentCore logs matter

Nov 20, 2025 By David Girvin In Sumo Logic
AI agents are finally moving past cute demos and into actual production workflows. With AWS AgentCore, teams can build agents that write tickets, call APIs, deploy infrastructure, invoke external tools, and make changes faster than any human operator ever could. That’s powerful, but it also introduces a brand-new operational and security surface. And here’s the uncomfortable truth: most organizations have no idea what their agents are actually doing. Agentic AI isn’t magic.
Read Post
sumologic

Why your security analytics needs proactive threat hunting

Nov 19, 2025 By Christopher Beier and Janet Alexander In Sumo Logic
Even the mightiest and most prestigious companies and enterprises are not exempt from the sophisticated threats posed by cyber attackers. Your security team needs robust security measures for network security, endpoint security, threat detection, anomaly detection, data protection, security monitoring, application security and information security.
Read Post
elastic

Detecting the undetectable: Building a fraud detection framework with Elastic

Nov 17, 2025 By Kyle Rozanitis In Elastic
Learn how public sector organizations are using Elastic to identify fraudulent activity with rules and anomaly detection jobs fine-tuned for their specific use cases. Every organization faces the challenge of identifying and combating fraud. In the financial services industry, it might be credit card fraud; in the auto insurance space, staged accident fraud; and in the public sector, unemployment, health insurance, or tax fraud.
Read Post
manageengine

Log everything from anywhere: Centralizing log collection with Log360

Nov 14, 2025 By Ramprashad Guruswamy In ManageEngine
In today's complex IT environments, comprehensive log collection is crucial for effective auditing and security monitoring. Without this, endpoints, especially those that are VPN-joined, stay out of your reach while auditing. This was the bottleneck faced by our Log360 customer who recently availed OnboardPro, ManageEngine's professional services. They knew Log360 was capable of collecting logs from all their network devices—but what about the endpoints that were connected remotely via VPN?
Read Post
exabeam

Legacy vs. Cloud-native SIEM: Weighing the Pros and Cons

Nov 13, 2025 By Exabeam In Exabeam
Choosing the right security information and event management (SIEM) solution is one of the most critical decisions you’ll make for your security program. As you evaluate your options, the central question is whether to stick with a traditional, on-premises SIEM or embrace a modern, cloud-native platform. This blog provides a direct comparison of the pros and cons of each, helping you make the best strategic decision for your organization’s needs.
Read Post
exabeam

Six Advanced Cloud-Native SIEM Use Cases

Nov 13, 2025 By Exabeam In Exabeam
You already know that a security information and event management (SIEM) offers crucial benefits like scalability and reduced management overhead. But how do those platform advantages translate into stopping sophisticated threats? The answer lies in moving beyond simple log collection to leveraging powerful, behavior-based analytics.
Read Post
datadog

Control logging costs on any SIEM or data lake using Packs with Observability Pipelines

Nov 13, 2025 By Zara Boddula In Datadog
Rising log volumes are making it harder than ever for security and SRE teams to balance visibility with cost. Every network, CDN, and security layer generates continuous streams of telemetry, but deciding what to parse, retain, or drop often requires manual configuration, specialized knowledge, and extensive tuning.
Read Post
exabeam

Embracing the Future of Security With Cloud-Native SIEM

Nov 13, 2025 By Exabeam In Exabeam
As technology and cyberthreats continue to evolve, businesses must adapt their IT infrastructure and security strategies to stay ahead of the curve. At the heart of this evolution is security information and event management (SIEM). However, if you’re still relying on a traditional SIEM, you’re likely struggling to keep up.
Read Post
exabeam

Finding the Perfect Fit: Hosting Models for Cloud-Native SIEM Solutions

Nov 13, 2025 By Exabeam In Exabeam
As you continue to embrace cloud-native security information and event management (SIEM) solutions, it’s important to understand the various hosting models available and select the one that best fits your organization’s unique needs. We’ll explore the pros and cons of different hosting models, including public cloud, private cloud, and hybrid cloud hosting. Your choice of hosting model plays an essential role in how your cloud-native SIEM solution is deployed, managed, and maintained.
Read Post
sumologic

Why your security needs a modern SIEM solution

Nov 13, 2025 By Sridhar Karnam In Sumo Logic
Not investing in a Security Incident and Event Management (SIEM) solution means you’re missing out on significant business benefits. A SIEM platform provides real-time detection and response to security incidents, helping you reduce the risk of costly compliance violations. Combine that with SIEM use cases such as consolidating and streamlining reporting, and your security team saves time and operational costs.
Read Post
elastic

It's time for the defense and intelligence community to upgrade endpoint security

Nov 13, 2025 By Matt Isett In Elastic
For more than 20 years, the US Intelligence Community (IC) and Department of Defense (DoD) have relied on a legacy Host Based Security System (HBSS) to provide basic endpoint security on critical networks. This solution has generally served its purpose by checking the box for endpoint security. However, most agencies still lack a truly integrated cross-operating system and cross-domain solution for endpoint detection and response (EDR).
Read Post
securonix

Data Pipeline Manager Flex Consumption (DPM Flex) Data Sheet

Nov 12, 2025 By Securonix Data Pipeline Manager Flex (DPM Flex) In Securonix
Securonix Data Pipeline Manager Flex (DPM Flex) changes how SIEM data is managed with AI-enabled, value-based data consumption that lets you ingest, store, and analyze more data for the same cost. Expand visibility, strengthen compliance, and unlock more value from your existing investment.
Read Post
exabeam

Making the Switch: A Step-by-Step Guide to Migrating from On-premises to Cloud-native SIEM

Nov 12, 2025 By Exabeam In Exabeam
Adopting a modern, cloud-native security information and event management (SIEM) solution is crucial for staying ahead of today’s complex cyberthreats. Whether you’re moving from an on-premises solution or migrating between cloud platforms, the transition to cloud-native SIEM can deliver significant benefits in scalability, flexibility, and advanced threat detection.
Read Post
securonix

From Data Burden to Strategic Advantage: Rethinking SIEM Economics for the Modern SOC

Nov 12, 2025 By Simon Hunt In Securonix
Your security operations are running in full throttle. Every log, alert, and event is fuel for defense. But as enterprises scale across endpoints, cloud, and SaaS, data has become both an enabler and an expense. The explosion of telemetry has turned visibility into an economic dilemma. Across the industry, CISOs are confronting a simple truth: the challenge isn’t how much data you can collect; it’s how intelligently you can use it to stay both Breach Ready and Board Ready.
Read Post
exabeam

The Missing Memory in Your Security Stack: How Attackers Exploit Stateless Systems

Nov 12, 2025 By Exabeam In Exabeam
Security teams are facing a daunting challenge: today’s cyberattacks are slower, quieter, and more difficult to spot than ever before. Adversaries, from nation-state actors to malicious insiders, have mastered the art of flying under the radar. They stretch their activities over days, weeks, or even months, using legitimate credentials and tools to disguise their actions as normal business operations. The uncomfortable truth is that most SIEM and XDR platforms are stateless.
Read Post
CrowdStrike

How the Falcon Platform Delivers Fast, CISO-Ready Executive Reports

Nov 7, 2025 By Keyauri Kendrick - Ben McInnis - Jay Flora - Lucia Stanham In CrowdStrike
Most exposure reporting is still slow, error-prone, and disconnected from reality. Analysts spend hours collecting and formatting data using different tools that produce conflicting priorities. Reports are bloated with raw CVE lists that lack context and rarely connect to business impact. They are often delayed, arriving after the adversaries have moved. While teams struggle with outdated reports, adversaries are seeking new ways to gain initial access.
Read Post

Cyber Resilience in Healthcare: Insights from 2025 LevelBlue Spotlight Report

Nov 7, 2025 By LevelBlue In LevelBlue
Join us for an insightful on-demand webcast exploring how healthcare organizations are strengthening cyber resilience to protect patients, safeguard data, and ensure care continuity. Based on findings from 220 healthcare cybersecurity leaders, the 2025 Spotlight Report reveals how hospitals and health systems are adapting to evolving threats, mitigating software supply chain risks, and aligning cybersecurity with clinical and business priorities.
View Video
sumologic

Faster security investigation with Cloud SIEM playbooks

Nov 6, 2025 By Peter Kazmir In Sumo Logic
Playbooks — and automated processes in general — were once primarily associated with security orchestration, automation and response (SOAR) platforms, but that has changed recently. Many modern security information and event management (SIEM) solutions have started incorporating SOAR-like functionality, enabling you to automate security workflows and improve your mean time to detect (MTTD) and mean time to respond (MTTR).
Read Post
manageengine

ManageEngine Recognized in the 2025 Gartner Magic Quadrant for Security Information and Event Management

Nov 5, 2025 By Esther Christopher In ManageEngine
We’re proud to announce that ManageEngine has once again been recognized in the 2025 Gartner Magic Quadrant for Security Information and Event Management (SIEM). To us, this marks another significant milestone in our journey to deliver a unified, intelligent, and accessible security analytics platform for organizations worldwide.
Read Post
graylog

7 Steps to an Efficient Security Operations Center Design

Nov 5, 2025 By Jeff Darrington In Graylog
In the original Star Trek television show, Captain Kirk would slightly recline in a command chair with various buttons that allowed him to deploy different technologies. Regardless of the alien threat, he had the necessary tools at his disposal to protect the Enterprise and his staff. An organization’s security operations center (SOC) acts as the Captain Kirk “command chair” for all security activities.
Read Post

Elevate Your GRC Game: Automate Risk, Compliance & Resilience | LevelBlue + OneTrust

Nov 4, 2025 By LevelBlue In LevelBlue
In today’s evolving world of Governance, Risk, and Compliance (GRC), organizations face new challenges—expanding digital boundaries, data sprawl, manual processes, and a constantly shifting regulatory landscape. “Elevate Your GRC Game” brings together LevelBlue and OneTrust to show how automation and AI can transform these challenges into opportunities. Discover the latest GRC trends—from proactive risk management and business-integrated frameworks to continuous compliance and data governance.
View Video
coralogix

Smarter SIEM starts here: Context, speed, and the power of MCP

Nov 3, 2025 By Lily Waldorf In Coralogix
Traditional SIEMs were built for a simpler time, when infrastructure was static, data was structured, and threats were easier to spot. Designed to collect logs and centralize alerts, they gave organizations a single pane of glass into their environment. Visibility isn’t enough anymore.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.