Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Security Incident and Event Management.

Ep 30: What is data pipeline management, and why does it matter for security?

On this episode of Masters of Data, we're joined by Eric Avery, Sumo Logic's head of infrastructure and data, to break down data pipeline management: efficiently moving massive data volumes from multiple sources to one usable location. We explore how pipelines fuel analytics and AI, the role of data transformation, and where OpenTelemetry fits in. Eric shares insights from processing 3.5 exabytes daily and how AI has reignited excitement around data. We also cover pipeline security, the shift from data lakes to AI-powered platforms, and practical digital security tips.

Customer Insights with Clark Pichon, Security Operations Center Manager

In this video, Clark Pichon, Security Operations Center Manager, shares how they're leveling up security operations with the help of AI and automation. From building queries faster using Dojo AI to cutting down time-to-detection and closing alerts more efficiently with SIEM automation, see how these tools are helping the team work smarter and respond faster than ever before.

Detecting Notepad++ CVE-2025-49144 Using Sysmon Logs

Text editors rarely show up in threat models. Installers show up even less. CVE-2025-49144 changes that. The issue is a local privilege escalation in the Notepad++ Windows installer that can allow a low-privileged user to gain SYSTEM-level execution by abusing insecure executable search behavior during installation. Affected versions include Notepad++ 8.8.1 and earlier, per the NVD record.

Why Endpoint, SIEM, and EDR Fail Against Defense Evasion Without Context

Defense evasion is one of the main reasons cyberattacks go undetected for days or weeks. Attackers avoid breaking systems now. They prefer to hide inside them. For that, they use defense evasion techniques that allow them to blend into normal activity and avoid alerts. Tools like EDR and SIEM can detect parts of an attack, but cannot provide the complete picture. This creates detection blind spots. Teams also face alert fatigue, which prevents them from recognizing real threats.

Exabeam Agent Behavior Analytics: First-of-Its-Kind Behavioral Detections for AI Agents

AI agents are moving into real workflows faster than most teams expected. According to PwC’s 2025 AI Agent Survey, 79% of companies are already adopting AI agents, and 88% of executives expect to increase AI-related budgets in the next year. These agents are now handling research, summarization, customer engagement, and operational tasks at a scale humans can’t match.

The Human-AI Alliance in Security Operations

Picture a SOC analyst starting an investigation. A suspicious spike in authentication activity appears on their dashboard, and they need to understand what’s happening quickly. To do that, they move through a familiar sequence of tools. What begins as a single investigation quickly turns into a chain of context switches: That’s nine steps to investigate one event. This isn’t accidental. Security tools have evolved to solve isolated problems, but together they have created fragmentation.

Ep 29: From detection to post-mortem: The complete incident cycle

On this episode of Masters of Data, we break down incident response from detection through containment, forensics, recovery, and postmortem. The foundation? Comprehensive logging. Without it, you're blind. We explore building cross-functional teams and a blame-free culture where people actually report issues. Communication is key: what you tell engineering isn't what you tell executives or customers. AI is accelerating investigations, but the fundamentals still rule: proper tool access, the right people on call, and translating technical chaos into business-speak. The takeaway?

Enrich logs with ServiceNow CMDB context before routing to any SIEM or logging tool

Many DevOps and security teams rely on ServiceNow CMDB (Configuration Management Database) as the system of record for metadata about infrastructure assets, application and service ownership, and dependencies. ServiceNow CMDB captures which team owns each service, what business unit the service supports, the environment where it runs, and how assets relate to each other.

AI Agents Are The New Detection Problem Nobody Designed For

AI agents now operate as core identities in enterprise environments, authenticating, accessing data, and executing workflows at machine speed. Their flexibility and scale introduce a detection challenge traditional security models were never built to solve. Exabeam has seen this pattern before with insider threat and workload identities. AI agents accelerate the need for identity-centric detection.