Today, we are going to look at using the Splunk Stream App to hunt for threats across your network. Sing along with us! 🎼 “Islands in the stream” of our data… (Part of our Threat Hunting with Splunk series, this article was originally written by John Stoner. We’ve updated it recently to maximize your value.)

It comes as no surprise that analysts spend a lot of their time investigating and responding to a continuous flood of incidents on a daily basis. While the sheer volume of alerts alone make for a time consuming endeavor, trying to manually tackle so many of these alerts results in slow incident response and can trap your team into a series of reactive security operations.

Financial crime risk management (FCRM) is the practice of proactively looking for financial crime, including investigating and analyzing suspicious activity, rooting out vulnerabilities and taking steps to lower an organization’s risk of becoming a victim. For organizations in every industry across the globe, an effective FCRM strategy has never been more important.

Multi-cloud environments are getting plenty of buzz in recent years. It’s no wonder, really, that increased flexibility, risk mitigation, performance optimization and compliance adherence associated with the practice have drawn in new muli-cloud evangelists across the industry. For all the great benefits multi-cloud offers, it does present one significant challenge: how do you ensure a single point of control while establishing consistent security policies for all users?

What is the quantum threat, and is it real? The boy who cried (quantum) wolf: being honest about the threat and what it means for you A cryptographically-relevant quantum computer (CRQC) is a quantum computer that can run algorithms to crack or weaken existing (so-called “classical”) cryptography. Today, I’ll explain when — or if — this CRQC is likely to exist, what the real threat is, and how it might affect your data and assets.

The state of cybersecurity is in constant flux — meaning we must constantly iterate and revisit our systems to protect ourselves. With security logging and monitoring failures moving up to number 9 of the OWASP Top 10, organizations everywhere are revisiting their stance on network and application monitoring. This is great for getting a pulse check on security posture and is certainly key in any good strategy, but we might be forgetting something — IoT devices.

It is not very often that we see cybersecurity vendors put aside competitive differences and ambitions to work towards a common goal that benefits the entire cybersecurity community. The Open Cybersecurity Schema Framework (OCSF) has shown to be an example of a productive industry-wide collaboration to facilitate a more secure environment for businesses, governments and individuals all over the globe.

A wise person once said that you should use the lookup command before you go threat hunting. Or, as I hear it in my head, “Look it up before you go-go…hunting”, a la WHAM!:   In this must-read tutorial for hunting in Splunk, we’re looking at the lookup command, including what it does and how and where to use it for threat hunting. Let’s get started! (This article is part of our Threat Hunting with Splunk series. We’ve updated it recently to maximize your value.)

Vulnerability scanning is the process of identifying security weaknesses and flaws in systems and software running on them. It's part of a vulnerability management program that protects organizations from data breaches. IT departments or third-party security service providers scan for vulnerabilities using vulnerability scanning tools. Doing so helps predict how effective countermeasures are in case of a threat or attack.

The way we work has drastically changed since the start of the pandemic. With more companies adopting remote and hybrid work models, there has been a 600% increase in cybercrime and 65% of organizations have seen a measurable increase in attempted cyberattacks, which is particularly problematic since, according to the 2022 Splunk State of Security report, 78% say remote workers are harder to secure.