Sumo Logic Threat Labs -- Customer Brown Bag -- February 26, 2026
Join us as Paul from Sumo Logic's Threat Labs team shares his team's responsibilities and campaign processes, along with real-world threat lab examples.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Logs & Lattes Episode 5: Top 10 Cybersecurity Threats Hybrid Teams Actually Face in 2026
Lean security teams operating in hybrid and regulated environments are not just fighting threats. They are fighting time. When evidence is scattered across email, identity, VPN endpoints, cloud, and network tools, even a solid detection means nothing if triage slows to a crawl. In this episode of Logs and Lattes, host Palmer Wallace and Graylog Solutions Architect Kyle Pearson break down the top ten security threats hybrid organizations are actually dealing with in 2026 and the single common failure behind most of them: fragmented telemetry that delays investigation when it matters most.
Redefining security incidents for AI, data sovereignty, and modern clouds
For two decades, security practitioners have lived with a tidy, almost childlike definition of an incident.
Exabeam Research: AI Accountability Becomes the New Mandate as Cybersecurity Economics Shift
93% of organisations in the UK and Ireland are increasing cybersecurity budgets in 2026 with AI as the top spending driver despite being the hardest investment to justify.
Splunk report: Agentic AI takes centre stage in CISOs' path to digital resilience
Nearly all CISOs report they are now responsible for AI governance and risk management, cite the growing sophistication of threat actor capabilities as their greatest risk. Vast majority say AI enables more security events to be reviewed.
Micro Lesson: Cloud SIEM Bulk Insight Management
This video will show you the new Cloud SIEM Bulk Insight Management feature to apply changes to up to 5000 insights at once, saving time and increasing efficiency for SOC teams.
How to check the impact of third-party CVEs on your Elastic deployment
The Elastic Support Hub now provides instant self-service lookup for CVE impact statements.
The New CISO Podcast Ep. 141 - Dean Sapp | Six Steps for Better Communication as a CISO
In this episode of The New CISO, host Steve Moore speaks with Dean Sapp, CISO and Data Protection Officer at Filevine, about one of security's most critical yet overlooked skills—written communication. Drawing from a brutal college English class that failed students for a single typo and over 20 years building security programs in the legal tech industry, Dean reveals why the ability to articulate security findings clearly separates average professionals from exceptional leaders who drive real business impact.
Log Collector Deployment via the Falcon Sensor in Falcon Next-Gen SIEM
See how CrowdStrike Falcon Next-Gen SIEM enables security teams to deploy log collectors instantly via the Falcon Sensor—without relying on traditional software distribution processes. In this demo, you’ll learn how to create a Log Collector Policy, automatically install collectors across host groups, validate installation through Falcon telemetry, and centrally manage third-party data ingestion from Fleet Management.
Rethinking data governance and global compliance
Across Europe and beyond, regulatory frameworks are reshaping how and where organizations manage data. These laws establish enforceable standards for data sovereignty, data governance, and data privacy that directly influence cloud architecture, security strategy, and AI innovation. Without these regulations, you run the risk of these organizational consequences: Data management shouldn’t be considered as only a task for IT. It’s a board-level priority.
Ep 30: What is data pipeline management, and why does it matter for security?
On this episode of Masters of Data, we're joined by Eric Avery, Sumo Logic's head of infrastructure and data, to break down data pipeline management: efficiently moving massive data volumes from multiple sources to one usable location. We explore how pipelines fuel analytics and AI, the role of data transformation, and where OpenTelemetry fits in. Eric shares insights from processing 3.5 exabytes daily and how AI has reignited excitement around data. We also cover pipeline security, the shift from data lakes to AI-powered platforms, and practical digital security tips.
Customer Insights with Clark Pichon, Security Operations Center Manager
In this video, Clark Pichon, Security Operations Center Manager, shares how they're leveling up security operations with the help of AI and automation. From building queries faster using Dojo AI to cutting down time-to-detection and closing alerts more efficiently with SIEM automation, see how these tools are helping the team work smarter and respond faster than ever before.
The Real Role of Agentic AI in Modern Security
Agentic AI won’t replace today’s technologies. It will amplify them. In today’s threat landscape, that’s a necessity. Additional Resources: About Elastic Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale.
Detecting Notepad++ CVE-2025-49144 Using Sysmon Logs
Text editors rarely show up in threat models. Installers show up even less. CVE-2025-49144 changes that. The issue is a local privilege escalation in the Notepad++ Windows installer that can allow a low-privileged user to gain SYSTEM-level execution by abusing insecure executable search behavior during installation. Affected versions include Notepad++ 8.8.1 and earlier, per the NVD record.
Why Endpoint, SIEM, and EDR Fail Against Defense Evasion Without Context
Defense evasion is one of the main reasons cyberattacks go undetected for days or weeks. Attackers avoid breaking systems now. They prefer to hide inside them. For that, they use defense evasion techniques that allow them to blend into normal activity and avoid alerts. Tools like EDR and SIEM can detect parts of an attack, but cannot provide the complete picture. This creates detection blind spots. Teams also face alert fatigue, which prevents them from recognizing real threats.
Exabeam Agent Behavior Analytics: First-of-Its-Kind Behavioral Detections for AI Agents
AI agents are moving into real workflows faster than most teams expected. According to PwC’s 2025 AI Agent Survey, 79% of companies are already adopting AI agents, and 88% of executives expect to increase AI-related budgets in the next year. These agents are now handling research, summarization, customer engagement, and operational tasks at a scale humans can’t match.
The Human-AI Alliance in Security Operations
Picture a SOC analyst starting an investigation. A suspicious spike in authentication activity appears on their dashboard, and they need to understand what’s happening quickly. To do that, they move through a familiar sequence of tools. What begins as a single investigation quickly turns into a chain of context switches: That’s nine steps to investigate one event. This isn’t accidental. Security tools have evolved to solve isolated problems, but together they have created fragmentation.
Ep 29: From detection to post-mortem: The complete incident cycle
On this episode of Masters of Data, we break down incident response from detection through containment, forensics, recovery, and postmortem. The foundation? Comprehensive logging. Without it, you're blind. We explore building cross-functional teams and a blame-free culture where people actually report issues. Communication is key: what you tell engineering isn't what you tell executives or customers. AI is accelerating investigations, but the fundamentals still rule: proper tool access, the right people on call, and translating technical chaos into business-speak. The takeaway?
Enrich logs with ServiceNow CMDB context before routing to any SIEM or logging tool
Many DevOps and security teams rely on ServiceNow CMDB (Configuration Management Database) as the system of record for metadata about infrastructure assets, application and service ownership, and dependencies. ServiceNow CMDB captures which team owns each service, what business unit the service supports, the environment where it runs, and how assets relate to each other.
AI Agents Are The New Detection Problem Nobody Designed For
AI agents now operate as core identities in enterprise environments, authenticating, accessing data, and executing workflows at machine speed. Their flexibility and scale introduce a detection challenge traditional security models were never built to solve. Exabeam has seen this pattern before with insider threat and workload identities. AI agents accelerate the need for identity-centric detection.
Office Hours with David Girvin
Weekly office hours with David Girvin. Check out recent feature releases and updates, watch a quick live demo, and ask any questions with live Q&A.
Anomaly Detection with Machine Learning to Improve Security
Being a security analyst can feel like being trapped in a Where’s Waldo book. You can find yourself staring at a data stream looking for something that “isn’t like the others.” However, as your organization collects and correlates more data from the environment, finding the Waldo can feel overwhelming. In a modern IT environment, organizations have hundreds or thousands of devices, users, and data points that they need to correlate so they can identify normal network activity.
Ep 28: Stop being the 'no' department: How modern GRC enables growth
On this episode of Masters of Data, we sit down with Cassandra Mooseberger, Manager of Security Compliance at Sumo Logic, to unpack governance, risk, and compliance (GRC). Cass breaks down her three-pillar framework: governance and compliance, risk management, and trust. She reveals how GRC teams can flip from cost center to sales enabler through trust pages, automated questionnaires, and proactive support. We explore practical strategies for working with engineering: listen first, understand before changing, and skip the "rip and replace" impulse.
Cyberthreat Detection: Key Steps Every Company Should Take
Today, an organization's survival is intrinsically linked to its cybersecurity posture. Proactive cyberthreat detection has transitioned from a technical best practice to a core business imperative. With adversaries employing increasingly sophisticated methods, from AI-driven phishing campaigns to fileless malware and stealthy lateral movement, relying solely on preventive controls can be a recipe for failure. A robust detection strategy is what separates companies that suffer prolonged breaches from those that contain incidents swiftly.