|
By cesmng
SIEM is a platform that centralizes logs from across an environment, normalizes them, and correlates them in real time to surface threats and satisfy compliance audits. Gartner's 2024 reprint records SIEM market growth from $5.03 billion in 2022 to $5.7 billion in 2023, a 13% annual growth rate (Gartner's SIEM definition). You're likely dealing with the problem SIEM was built to solve.
|
By cesmng
The most popular advice about GLBA security requirements is also the least useful: review the policy annually, collect signatures, and keep the evidence in an audit folder. That approach may prove that someone approved a program. It doesn't prove that multifactor authentication protects every relevant system, that logs capture unauthorized access, or that the incident response team can identify a reportable event quickly enough to act.
|
By cesmng
“Install antivirus and enable the firewall” is still common security advice. It's also incomplete. Those controls can block malicious code and unwanted traffic, but they don't automatically connect an endpoint detection to the firewall event that preceded it, identify a compromised identity, or tell an analyst whether a policy change was legitimate.
|
By cesmng
Tactics, techniques, and procedures are the behavioral language of an adversary: tactics explain why, techniques explain how, and procedures describe the specific implementation. MITRE created the first ATT&CK model in September 2013 and publicly released it in May 2015 with 96 techniques organized across 9 tactics. That origin matters because TTPs turn scattered security events into an operational model.
|
By cesmng
Your SOC dashboard shows a successful login from a normal user account. The connection uses HTTPS, the destination is an approved web server, and the network firewall allows it. Inside the request, however, an attacker has placed a SQL injection payload in a login parameter. Nothing is wrong with the perimeter firewall. It has been asked to answer a question it wasn't designed to answer.
|
By cesmng
You're in the middle of a normal week, and a partner calls because a client can't open a shared matter folder. Then the help desk finds encrypted files, a strange login from overnight, and an inbox rule that forwarded privileged emails outside the firm. That's the starting point for cyber security for lawyers, not a policy memo, and it's why your firm needs controls that protect confidentiality, preserve evidence, and prove due care when the pressure is on.
|
By cesmng
You are already in the meeting, and the question on the table sounds simple: can the SOC detect a technique tied to a noisy intrusion path? Three analysts answer three different ways because each one is staring at a different dashboard, a different log source, and a different mental model. The MITRE ATT&CK framework gives those people one shared way to describe adversary behavior, so the discussion starts with evidence instead of guesswork.
|
By cesmng
You're in the middle of a noisy SOC shift, and a firewall alert lands late. The device was supposed to send logs over syslog, but the path was UDP-based and the network dropped the messages under stress. By the time an auditor asks for proof, the team has an investigation, a gap in the timeline, and no clean evidence trail to show what happened.
|
By cesmng
You open an inbox and spot the kind of email every SOC team knows too well, a message that looks routine, lands with a harmless subject line, and asks someone to click, open, or approve something they shouldn't. That's where what is the cyber kill chain stops being an abstract term and starts being a practical way to think about intrusion, because the attack usually isn't one event, it's a sequence of choices an adversary makes before the damage shows up.
|
By cesmng
You're usually not thinking about retention when the week starts. You're thinking about alert noise, an audit request from compliance, and a storage bill that keeps climbing because logs are piling up in your SIEM, EDR, or XDR stack. Then someone asks a simple question, and the answer isn't simple at all. Which logs must be kept, for how long, and where do you stop using hot storage and start preserving evidence for HIPAA?
|
By UTMStack
In this video, I walk you through the essentials of UTMStack compliance automation, specifically focusing on CMMC compliance. I explain how to navigate the compliance menu and ensure the correct framework is selected. I also highlight the automatic evaluation of controls and the options available for exporting reports. Please make sure to review the controls and provide any necessary evidence if the system indicates non-compliance.
|
By UTMStack
In this video, I walk you through the process of managing false positives in the UTMSatck platform. We often encounter numerous false positives when starting with a new SIEM, which can lead to confusion and unnecessary alerts. I demonstrate how to tag these false positives effectively and filter them out to streamline our alert system. Please make sure to implement the tagging rules I discussed to help reduce noise in your SOC team's workflow.
|
By UTMStack
In this video, I walk you through the process of creating custom dashboards and visualizations in UTMStack SIEM. I demonstrate how to build various types of visualizations, such as pie charts and bar charts, to effectively display alert data. I also highlight the importance of adding filters for better data management and how to set up auto-refresh for real-time monitoring. Please make sure to follow along and try creating your own dashboards as we go through the steps together!
|
By UTMStack
Keeping IT Services profitable can be challenging, equipment and software costs increase, margins suffer and customers cancel. The solution resides in the economy of horizontal scale. Imagine what could happen if your existing customers contracted two times more services from your business, would that help? Sell them something every business needs: cybersecurity, launch your own Security Operations Center, and close new profitable deals. Why UTMStack and not something else? The answer is simple: UTMStack is free and Open source and very intuitive, so you can hit the ground up and running in no time.
|
By UTMStack
Overview of UTMStack Free SIEM features and approach the threat detection and response through ML-powered real-time AI detection.
|
By UTMStack
Advanced persistent threats (APTs) and targeted attacks are a growing concern for organizations of all sizes. These types of cyber attacks are characterized by their high level of sophistication and the ability to evade traditional security measures. In order to defend against APTs, organizations need to adopt a multi-layered approach that includes implementing security information and event management (SIEM) systems.
|
By UTMStack
Facts about the dark web and the threat that small businesses face. Learn how Dark web monitoring can protect your business.
- August 2026 (19)
- July 2026 (19)
- June 2026 (26)
- April 2025 (3)
- October 2024 (1)
- November 2023 (1)
- October 2023 (7)
- July 2023 (1)
- June 2023 (3)
- May 2023 (3)
- January 2023 (4)
- June 2022 (1)
- May 2022 (1)
- April 2022 (3)
- March 2022 (3)
- February 2022 (1)
- January 2022 (5)
- July 2021 (1)
- August 2020 (1)
- May 2020 (1)
A Next-Generation SIEM and Compliance Platform that delivers all essential cybersecurity services while being simple and Cost-Effective.
Stack Modules:
- Log Management (SIEM): Security information and event management. Collect, store and correlate log data, and use in compliance reports.
- Vulnerability Management: Active and passive vulnerability scanners for early detection, with of the box reports for compliance audits.
- Access Rights Auditor: Track and manage accounts access and permission changes. Get alerted when suspicious activity happens.
- Incident Response: Remotely manage your environment and respond to attacks right from your dashboard.
- HIPS and NIPS: Host based and Network based Intrusion Detection Systems with prevention capabilities.
- Dark Web Monitoring: We keep searching the Dark Web for compromised users or PII data from your organization.
- Endpoint Protection: Protect endpoints and servers with Advanced Threat Protection.
- Compliance: GPDR, GLBA, HIPAA, SOC and ISO compliance reports and dashboards.
- Endpoint Protection: Keep track of changes and access to classified information.
The Unified Threat Management platform for all cybersecurity needs.