“Aren’t you a little short for a Stormtrooper?” In this iconic Star Wars moment, Princess Leia lazily responds to Luke Skywalker, disguised as one of her Stormtrooper captors and using authentication information to open her cell. In other words, Star Wars acts as an analogy for a cross-site request forgery (CSRF) attack. In a CSRF attack, malicious actors use social engineering so that end-users will give them a way to “hide” in their authenticated session.

By collecting, analyzing, and leveraging data from security events, security analytics empowers teams to proactively detect anomalies and pinpoint vulnerabilities to mitigate targeted attacks, insider threats, and advanced persistent threats (APTs).

Cross-site scripting attacks are the digital version of the mystery trope where people inject IV lines with hazardous material. In the murder mystery genre, these crimes often focus on someone who looks legitimate, sneaking malicious material into someone’s medicine to harm the patient. Similarly, a cross-site scripting attack is when a threat actor sneaks malicious code into someone’s application to harm end users.

When security information and event management (SIEM) tools came to the market over a decade ago, many practitioners considered the combination of information management and event management groundbreaking. Since then, the technology has gone through iterations to improve and enhance its capabilities, including the incorporation of user and entity behavior analytics (UEBA), machine learning and AI capabilities, and “out-of-the-box” configurations for smaller organizations to rely on.

Feeling overwhelmed by alerts? You’re not alone. At SOC Analyst Appreciation Day (SAAD) 2024, we heard from countless analysts facing the same challenges of burnout, perfectionism, and the need for mentorship. With a fantastic line-up of speakers, including John Hammond, Ron Eddings, Peter Coroneos from Cybermindz, and other security leaders, this year’s event provided valuable insights and sparked engaging discussions.

Your antivirus protects your workstation from malware, but how do you protect your business from Advanced Persistent Threats?

As small and mid-sized businesses (SMBs) across Asia adopt cloud technologies to accelerate growth, securing your cloud infrastructure becomes a significant challenge. The complexities of managing cloud environments, regulatory compliance, and ensuring real-time threat detection require robust solutions that are both scalable and cost-effective.

Windows event logs are a key source of important information about your Windows environments, including detailed records of user activities, system performance, and potential security issues. However, with the sheer volume of logs modern environments generate, it can be overwhelming for security teams to efficiently detect, triage, and respond to threats in real time.

CrowdStrike Falcon Next-Gen SIEM enhances security operations by integrating data, AI, workflow automation and threat intelligence into a single platform with a unified console and a lightweight endpoint agent. We continue to innovate in next-gen SIEM to power SOC operations, most recently with a series of product updates announced at Fal.Con 2024. But we’re not stopping there.

It’s no coincidence that Graylog 6.1 is making its debut right before Halloween. This release is a true behemoth, designed to tackle some of the longest-standing and most challenging issues in Security Event and Information Management (SIEM). Packed with innovations, Graylog 6.1 is here to change the game.

It wasn’t too many years ago that only large-scale organizations and enterprises were compelled to worry about cybersecurity. They were the primary targets for malicious actors, and so they seemed to be the only ones thinking about defense. But just like most things, that has completely changed. Small and medium-sized businesses are just as vulnerable to cyberattacks. Without the size and resources to bring security in-house, most turn to managed security service providers (MSSPs) for help.

In today’s increasingly complex and evolving threat landscape, Security Operations Centers (SOCs) have become the nerve center for protecting critical national and local government assets. Building and maintaining an in-house SOC is often beyond the reach of many government agencies due to budget constraints, the need for skilled personnel, and the rapid growth of cyber threats.

Mitigating risk based on the threat landscape is a complicated yet essential part of being a CISO, which is why threat reports like the 2024 Elastic Global Threat Report are a huge help for me. In addition to providing an in-depth understanding of what’s happening, threat reports also offer a quick overview of what needs to be explained or communicated to the rest of the organization.

One of the most powerful weapons at an attacker’s disposal is the use of specialized tools designed to compromise network security. Mimikatz, BloodHound, and winPEAS are just a few examples of tools that can wreak havoc in your environment if left undetected. In this article, we’ll explore how malicious actors can exploit specialized tools to launch sophisticated attacks.

There are lots of hurdles to jump when trying to set up and maintain a SIEM. Preparing infrastructure and installing the software components, getting logs ingested into the system, parsing and normalizing those log messages properly, configuring alerts for detection, etc. These are all large tasks that require thoughtful planning and a lot of work to get right. But let’s say you’ve managed to clear all those hurdles…in that case, great job!!

CrowdStrike is excited to announce we are named a Major Player in the IDC MarketScape: Worldwide SIEM for Enterprise 2024 Vendor Assessment.1 This marks our first appearance in a SIEM-focused analyst report since bringing CrowdStrike Falcon Next-Gen SIEM to market less than a year ago. We believe this milestone speaks volumes about our commitment to revolutionizing security operations.

Yesterday, Elastic Security Labs released the 2024 Elastic Global Threat Report, a comprehensive look at more than 1 billion data points from Elastic’s unique telemetry. The report provides insights into the methods, techniques, and trends of threat actors from the perspective of defenders — giving crucial insights for security teams to prioritize and improve their security posture.

Endpoints, whether physical devices or cloud resources, are critical targets for potential cyberattacks. SentinelOne is an endpoint detection and response (EDR) solution that provides real-time detection of and response to endpoint threats. Using both static and behavioral detections, SentinelOne Singularity Endpoint helps protect against a range of threats, including malware, zero-day exploits, advanced persistent threats, and more.

Elastic Security Labs discovers that threat actors are taking advantage of readily available abused security tools and misconfigured environments. Elastic Security Labs has released the 2024 Elastic Global Threat Report, surfacing the most pressing threats, trends, and recommendations to help keep organizations safe for the upcoming year. Threat actors are finding success from the use of offensive security tools (OSTs), a misconfiguration of cloud environments, and a growing emphasis on Credential Access.