Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

With the escalating frequency and complexity of cyberattacks, businesses are constantly under threat. Security operations have become an indispensable aspect of organizational survival and success. Cyberattacks and data breaches regularly make headlines as malicious actors continue to adapt and develop new tactics.

Do you aspire to become a standout in the SOC world? To excel, you must consistently cultivate both your technical hard skills and non-technical soft skills. No specific career path is the golden ticket; each individual’s journey to SOC stardom is a blend of conventional education and hands-on training, seasoned with vital real-world experience. A purpose-built SOC analyst home lab is one proven self-guided learning tool to sharpen your technical know-how.

Threat hunting is proactively identifying and thwarting unusual network activity that could indicate an attempted security breach. It’s a historically manual activity, making it time-intensive and arduous. It’s no wonder, then, why most organizations don’t have the time, budget, or resources to undertake it effectively…if at all.

The threat landscape today is complex and constantly changing. Organizations require robust cybersecurity solutions to protect their networks and systems. SIEM and SOAR are two technologies that are pivotal in strengthening security operations. In this article, I’ll look at both technologies, SIEM and SOAR, to help you understand the importance of strengthening your organization’s SecOps.

In our latest release of Splunk Enterprise Security 7.2, we are excited to introduce capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making. The majority of these updates and new features were requested directly from Splunk Enterprise Security (ES) users and submitted through the Splunk Ideas portal.

Based on the popularity of last year's Macro-level ATT&CK Trending, we’ve updated the dataset for another year’s worth of insights. This data summarizes the frequency of MITRE ATT&CK technique observations across thousands of cyber incidents over the past four years. In this post, we’ll look at the contents of the updated dataset, using Splunk to pull out trends based on this ultra large-scale attacker landscape!

Now generally available, Splunk Edge Processor supports syslog-based ingestion protocols, making it well-equipped to wrangle complex and superfluous data. Users can deploy Edge Processor as an end-to-end solution for handling syslog feeds such as PAN logs, including the functionality to act as a syslog receiver, process and transform logs and route the data to supported destination(s).

Ave Maria RAT (remote access trojan), also known as “Warzone RAT,” is a malware that gains unauthorized access or remote control over a victim’s or targeted computer system. This RAT operates stealthily and grants attackers access to various functionalities within the compromised system. Its malicious activity includes data theft, privilege escalation, remote desktop control, email credential collections, browser credential parsing and more.