Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

6 Steps for Using a SIEM to Detect Threats

Most people know the old fairy tale of the boy who cried wolf. Every day, the little shepherd would scream from the top of his hill, “A wolf is chasing the sheep!” While villagers initially responded to the alarm, they soon realized that the boy was lying to them. In the end, when a wolf truly did chase the sheep, no one heeded the boy’s cry.

Supervised AI Is the Fastest Path to Better Threat Triage ROI

Security operations teams are under sustained pressure. Alert volumes continue to rise, environments grow more distributed, and experienced analysts remain scarce. Much of the industry conversation around AI focuses on autonomy and fully automated response. That focus skips the most reliable efficiency gains available right now.

Quantum Threats to Machine Learning: The Next Security Reckoning

At Exabeam, we’ve built our foundation on innovation in machine learning and artificial intelligence technologies that have transformed how organizations detect and respond to threats. We take pride in the rigor of our model security: encrypted data, tightly controlled access, continuous validation, and relentless red teaming. But true security isn’t about reaching a finish line; it’s about anticipating what’s next.

SIEM Requirements for MSPs: What You Need to Get Right

SIEM is a streamlined tool used by managed service providers (MSPs) to monitor activity across their clients’ systems in real time. The tool brings security data into one place. This makes it easier to spot suspicious activity early and respond quickly if something goes wrong. SIEM provides MSPs with a single, clear view of their environment to improve day-to-day monitoring. It also takes less time to investigate security incidents.

2025 Security Trends That Defined the SOC and What 2026 Will Demand

2025 exposed a shift that had been forming for years. Security operations were not slowed by limited visibility or weak tooling. They were slowed because the effort required to interpret growing volumes of data increased faster than staffing, budgets, or governance frameworks could support. Alert queues expanded, dashboards multiplied, cloud bills shaped retention choices, and AI arrived before most organizations had clear policies to supervise it. It was not a talent problem.

Understanding Ransomware Email Threats

The Ransomware-as-a-Service (RaaS) ecosystem has changed the look and shape of modern day ransomware attacks. Malicious actors typically view their cybercrimes as a business, hoping to make the most amount of money with the least amount of effort. For example, according to research, AI-automated phishing attacks performed similarly to human generated ones and 350% better than the ones sent to the control group.

The SOC Analyst Agent: Bring an Agentic approach to work with your SOC team

For years, security teams have dealt with the challenges of alert fatigue, endless tools and data sources, and constant context switching. But, so far, we haven’t been able to significantly improve it with traditional tools. However, new agentic approaches can start providing improved gains. This begins to change the way SOC teams operate and approach managing their talent.

Ep 23: How to bootstrap your AppSec program

On this episode of Masters of Data, Adam sits down with Zoe Hawkins and David Girvin to talk AppSec programs that don't suck. David's hot take from his 1Password and Red Canary days? AppSec is a people problem, not a tooling problem—stop being the person devs dodge at standup. We cover the essentials: build relationships first, threat model based on actual business risk (not your anxiety), and ditch the "shift left" obsession with scanning everything. Instead, start with offensive testing that finds vulnerabilities attackers can actually exploit.

Fireside Chat: LevelBlue + Tenable Partnership - Unlimited Vulnerability Scanning at No Cost

Discover how LevelBlue and Tenable are transforming cybersecurity in this exclusive fireside chat featuring Michael Vaughn, Director of Product Management at LevelBlue, and Greg Goetz, VP of Global Strategic Partners at Tenable.

Questions to ask before vetting an AI agent for your SOC

So you’re ready to “hire” an agent or two for security operations. While AI agents won’t replace your human analysts, they are quickly becoming indispensable team members. Choosing the right ones should resemble a typical hiring process: you need to determine if they possess the necessary skills to fill your team’s gaps, work effectively with others, and grow with your organization. Here are five questions worth asking before you bring an AI agent on board in your SOC.

Platform enhancements strengthening security across every child org

Multi-org environments introduce complexity that most tools simply weren’t built for. Analysts are often forced to jump between different orgs, duplicate configuration work, and maintain parallel dashboards, alerts, and content–inefficiencies that increase risk, overhead, and time-to-response. Every minute spent managing infrastructure is one you’re not spending serving your clients or responding to threats.

The only vendor standing: Elastic's clean sweep in 2025 AV-Comparatives Tests

In the current threat landscape, the margin for error is nonexistent. According to the IBM Cost of a Data Breach Report 2025,1 the average cost of a data breach in the US has surged to a record $10.22 million — a 9% increase from the previous year. For security teams, this reality creates a high-pressure environment where every missed signal or allowed compromise can spiral into a headline-making crisis.

How 2025 Reshaped SOCs and What Matters in 2026

Security teams spent 2025 operating at maximum load. Alert volume kept rising, analysts pivoted across too many tools, AI arrived faster than governance could support, and cloud costs shaped what data teams felt safe keeping. In this episode of Logs and Lattes, host Palmer Wallace and Jeff Darrington break down what actually happened inside real SOCs and how those lessons are already guiding 2026.

Why a People-Centric Security Strategy Improves Resilience

If Darth Vader and the rest of the Empire made one major strategic mistake, it was failing to understand the important role that the human element plays in security. Convinced of their superiority, the Empire’s leaders assumed that the Death Star was impenetrable. However, in the end, it was a scientist and his team who compromised the technology by building in a backdoor.

Logs & Lattes Episode 4: How 2025 Reshaped SOCs and What Matters in 2026

Security teams spent 2025 operating at maximum load. Alert volume kept rising, analysts pivoted across too many tools, AI arrived faster than governance could support, and cloud costs shaped what data teams felt safe keeping. In this episode of Logs and Lattes, host Palmer Wallace and Jeff Darrington break down what actually happened inside real SOCs and how those lessons are already guiding 2026.

Calculating a SIEM's Total Cost of Ownership

A security information and event management (SIEM) solution aggregates and correlates data from across the organization’s complex, interconnected environment. Modern enterprise IT consists of decentralized users and applications that require organizations to implement technologies that provide visibility across disparate security solutions. Simultaneously, SIEMs have a reputation for being difficult and expensive to manage.

Falcon Shield Evolves with AI Agent Visibility and Falcon Next-Gen SIEM Integration

CrowdStrike is introducing two powerful innovations in CrowdStrike Falcon Shield to stop identity-based attacks in the AI era: a centralized view of AI agents across platforms and the integration of first-party SaaS telemetry into CrowdStrike Falcon Next-Gen SIEM — the industry’s first native integration of SaaS security posture management (SSPM) and next-gen SIEM.

How Exabeam Uses Its Own Security Platform to Defend Against Threats

At Exabeam, we don’t just build a security operations platform — we use it to protect ourselves. In this behind-the-scenes look at the Exabeam Security Operations Center (SOC), you’ll see exactly how Exabeam uses Exabeam to secure our corporate systems, customer data, cloud environments, and internal infrastructure.

Secure Your AWS Cloud with Falcon Next-Gen SIEM: Seamless Integration & Intelligent Detection

See how Falcon Next-Gen SIEM delivers instant, frictionless integration with AWS for full visibility in minutes. Watch how pre-built detections analyze every API call, connecting events into clear attack stories. With automated response playbooks that take immediate action, you can detect faster, respond smarter, and stop cloud threats before they spread. CrowdStrike Falcon Next-Gen SIEM: Consolidate security operations with the world’s most complete AI-native SOC platform.

Ep 21: How to start a threat program

In this Masters of Data episode, we welcome back Chas Clawson to discuss building effective threat hunting programs from the ground up. We explore the difference between proactive threat hunting and detection engineering, emphasizing how AI tools are making sophisticated security operations accessible to teams of any size. We cover practical approaches, such as prioritizing threats based on business risk, creating feedback loops between red and blue teams, and measuring success through meaningful metrics rather than vanity numbers.

Transform AWS Security Operations with Falcon Next-Gen SIEM

CrowdStrike is redefining how SOC teams turn cloud data into actionable intelligence by unifying speed, scale, and cost efficiency in one platform built for the cloud and AI era. Together with AWS, today we are announcing new integrations and consumption options designed to further simplify how customers secure and operationalize workloads on Amazon Web Services (AWS).

Datadog Cloud SIEM: Driving innovation in security operations

Security can quickly become overwhelming for large organizations, with teams processing logs that are fragmented across cloud providers and SaaS platforms, staggering alert volumes, and the need to scale operations efficiently as environments grow. Datadog Cloud SIEM is designed to help teams manage this workload by centralizing insights, detecting threats faster, and prioritizing investigations with rich risk context.

Why a Cloud SIEM Just Makes Sense

The irony of being an adult working in IT and security is that where having your head “in the clouds” was inappropriate as a child, today most of your activities require you to have your head in the cloud. Organizations moved their business operations to the cloud because they could achieve various operational benefits, like improved collaboration and reduced costs. Yet, many companies still maintain an on-premises SIEM.