Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Security Incident and Event Management.

The AI SOC explained: Intelligent security for modern threats

The SOC was originally designed for a threat landscape that no longer exists. Today, the sheer number and speed of modern threats make it tough for even the best analysts to keep up. Manually sorting through huge amounts of data, dealing with alert fatigue, and relying on fixed rules make it harder to understand the full story behind each threat. The AI SOC addresses this problem, but not in the way most vendors describe. It’s not just a simple product or feature.

How to Gain Value from AI in Cybersecurity

The Terminator is often people’s reference point for artificial intelligence (AI), especially when they worry that technology will be the end of civilization. However, on the other end of the AI spectrum is the beloved, marshmallow fluff Baymax, the helper robot providing assistance to those in his presence. The reality of AI sits somewhere between these two extremes. For security teams, AI initially seemed like a revolutionary technology that would offer faster detection and automated analysis.

SIEM-as-a-Service offering leverages Elastic for unified cybersecurity across the US government

The US Cybersecurity and Infrastructure Security Agency (CISA) has launched a SIEM-as-a-Service (SIEMaaS) offering for federal civilian agencies, featuring Elastic Security on Elastic Cloud. SIEMaaS delivers a cloud-based platform for next-generation, AI-powered threat analytics, incident response, and open-standards-based cybersecurity data ingestion.

AI can do what now?! - Detecting financial fraud with Elastic Security

Financial fraud is increasingly cyber-enabled, requiring organizations to detect complex campaigns across transactions, identities, and digital systems faster and with greater accuracy. Join cybersecurity experts Lisa Jones-Huff and Joe Murin as they discuss how Elastic Security applies AI, machine learning, and generative AI to modern fraud detection. They’ll share how Elastic Security helps teams connect signals, reduce noise, accelerate investigations, and scale fraud prevention through emerging frameworks and standards across financial services organizations.

Ep 35: RSAC FOMO? Dojo AI Demo

As we gear up for RSA Conference, we give viewers a sneak peek at Sumo Logic's SOC analyst agent, which turns a 45-minute analyst investigation into a five-minute AI-powered sprint. We walk through live demos showing how the agent automatically generates queries, maps threats to MITRE ATT&CK, and hands you recommended remediation actions all without making you switch tabs or tools. We also show off MCP integration that lets teams collaborate on active investigations right from Slack, because no one should be chained to their war room when there's dinner to be had.

The Future of Intelligent SOC -- Customer Brown Bag -- March 19th, 2026

Join us as Christopher explores how to build a modern, intelligent SOC with decision-ready detection, shared adversary context, and automated response that empowers faster, more confident security operations, featuring the role of the Sumo Logic SOC Agent in streamlining investigations and accelerating response.

Cyber Resilience: The Key to Maintaining Business Operations

As a child, rubber bands almost seemed magical. They would stretch to fit a size or shape. They could be flung across a room, although not ever at another person and certainly not a sibling. Their resilience means that they would always return to their original shape after being stretched, flung, or twisted.

Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender

CrowdStrike is expanding CrowdStrike Falcon Next-Gen SIEM to support third-party endpoint detection and response (EDR) solutions — beginning with Microsoft Defender — with no Falcon sensor required. This evolution will enable organizations to modernize their SOC without replacing existing endpoint agents. Adversaries are moving faster than ever, exploiting cross-domain gaps across endpoint, identity, network, and cloud.