Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Everything that makes employees’ lives easier, makes yours harder. Detecting insider threats — both employees and cybercriminals pretending to be employees — has never been more difficult or more important. The cloud technologies that make everyone else more efficient make security less efficient. They’re noisy. They send a lot of alerts. You’re tired. You’re overworked. You’re overloaded.

In 2005, a new market emerged when Gartner coined the term "SIEM" OR Security and Information Event Management. Back then, it was a legacy system aggregating event data produced by security devices, systems, network infrastructures and applications. However, it lacked monitoring functionality and was limited to vertical scalability.

Insights from the 2022 Results That Matter study “88% of boards regard cybersecurity as a business risk rather than solely a technical IT problem.”1 Regardless of geography, industry, sector, or use cases, most would agree that reducing risk is a top priority for their organization. Whether it’s decreasing phishing scams, ransomware, and malware attacks or reducing the risk of customer churn due to breaches, security is everyone’s concern.

For many people, cybersecurity is merely a necessary business function. But that’s not how our customers see it. For you, cybersecurity is an ever-escalating arms race involving sophisticated operators and uncounted moving parts where a single mistake can cause an avalanche of problems. Cybersecurity isn’t just your job, it’s your life. You are on the front lines, responsible for protecting your organization in a high-pressure environment every day.

Elastic Security has long been open — with open source roots, open development, and the release of our SIEM in 2019. In 2020, we further embraced the openness of Elastic and released our open detection-rules repo to collaborate with our users and be transparent about how we protect customers. That repo is focused on our SIEM and Security Analytics use cases and did not yet include Elastic Endpoint Security artifacts.

Remote workforce models don’t look like they’re going anywhere anytime soon. While your employees need to collaborate, you need to make sure that you mitigate data breach risks. You worked diligently over the last few years to put the right access controls in place. The problem? Data breaches aren’t always threat actors and are not always malicious.

On July 27, 2022, Microsoft Threat Intelligence Center (MSTIC) disclosed a private-sector offensive actor (PSOA) that is using 0-day exploits in targeted attacks against European and Central American victims. MSTIC and others are tracking this activity group as KNOTWEED. PSOAs sell hacking tools, malware, exploits, and services. KNOTWEED is produced by the PSOA named DSIRF.

Security analysts and administrators need every advantage to keep up with prioritizing and investigating alerts. A SIEM (security information and event management) solution helps uncover threats, but it takes a lot of time assigning and updating tags, criticality, and signal suppression. Sometimes users opt to skip the step altogether, especially if there are a lot of entities to add or update at once. Other times, they introduce errors during this manual step.

I am very pleased and proud to share the big news that Devo is now an AWS Security Competency Partner. This is a significant milestone for Devo and it’s important for our current and future customers and partners. This designation validates that Devo has successfully met AWS’s technical and quality requirements for providing customers with a deep level of expertise in threat detection and response.