Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SIEM

The latest News and Information on Security Incident and Event Management.

Unlocking the Power of Co-Managed SOC: A Strategic Solution for Maximizing SIEM Effectiveness and Cybersecurity Success

Security information and event management (SIEM) systems play a pivotal role in cybersecurity: they offer a unified solution for gathering and assessing alerts from a plethora of security tools, network structures, and software applications. Yet, the mere presence of a SIEM isn't a magic bullet. For optimal functionality, SIEM systems must be appropriately set up, governed, and supervised round-the-clock.

XDR vs SIEM: Cost-Efficient Cyber Security for Today's Decision Makers

CISOs and IT leaders are tasked with the critical responsibility of safeguarding their organisations against an ever-increasing array of threats, all while striving to optimise costs and drive business growth. CISOs are grappling with the demand to achieve more with limited resources this year—a challenge that many have not encountered before.

Detecting account compromise with UEBA detection packages

The Elastic InfoSec Threat Detection team is responsible for building, tuning, and maintaining the security detections used to protect all Elastic® systems. Internally, we call ourselves Customer Zero and we strive to always use the newest versions of our products. This blog details how we are building packages of detection rules that work together to create a high fidelity alert for strange user behavior.

Valuable Career Insights for Your Career in Cybersecurity

Change is constant in any career, and the world of cybersecurity is no exception. Hackers and cybercriminals devise new tactics regularly, and cybersecurity professionals must stay current with emerging threats and new technology. While keeping pace with these shifts is essential, it’s also important to balance your commitment to the field with your personal career goals.

What's new in Elastic Security 8.11: Piped queries, AI assistance, and cloud and user data

Elastic Security 8.11 introduces pipe queries with Elasticsearch Query Language (ES|QL), an Elastic AI Assistant connector for AWS Bedrock, and data integrations for Okta, Microsoft Entra ID, Wiz, and Palo Alto Prisma Cloud. Together, these enhancements deliver vital guidance and context to threat hunters and investigators. Elastic Security 8.11 is available now on Elastic Cloud — the only hosted Elasticsearch® offering to include all of the new features in this latest release.

Challenges with Cybersecurity Asset Identification and Management

Anyone who’s ever misplaced their wallet knows that horrible moment where their stomach drops, the beads of perspiration begin to form on their forehead, and they start mulling over worst-case scenarios. In that worst case scenario, someone used the cash and cards in the wallet to go on a personal spending spree. In a company’s IT environment, a missing device or shadow IT represents that missing wallet.

Applying an intelligence-based approach to Cybersecurity; SIEM and dark web monitoring

“History repeatedly has demonstrated that inferior forces can win when leaders are armed with accurate intelligence.” – Central Intelligence Agency; Intelligence in War In the ever-changing landscape of global cybersecurity, the boundaries between traditional military intelligence and cybersecurity are increasingly blurred. At the heart of this convergence lies the science of intelligence analysis—a process fundamental to both realms.

Falcon Platform Raptor Release

The next generation of the CrowdStrike Falcon® platform re-architects the platform using the same technology as CrowdStrike’s Next-Gen SIEM to unlock the future of generative AI and XDR for all. This enables you to perform lightning fast searches to hunt for threats and ingest data from sources from across your entire enterprise to detect sophisticated attacks.

Maximizing Data Security in the Cloud - Outperforming On Premise Solution - it-sa 2023 Keynote

In an era where data breaches and cyber threats continue to escalate, businesses are seeking robust security solutions that offer a competitive edge. This session will delve into the advantages and advancements of cloud-based security systems, providing attendees with a comprehensive understanding of how cloud solutions can outshine their on-premise counterparts. We will explore the latest technologies, best practices, and real-world case studies to demonstrate the superior security measures offered by cloud-based solutions.