Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the ever-evolving landscape of digital security, staying ahead of threats and ensuring organizational protection is paramount. Enter OpenSSL3.0—a major step forward in modernizing cryptographic standards and compliance. OpenSSL3.0 is redefining how organizations and developers safeguard their digital environments.

Let’s be real—running Security Operations is like trying to drink from a firehose while juggling chainsaws blindfolded at the same time. The threats don’t take weekends, the alerts never stop, and just when you think you’ve seen it all, some new attacker decides to get creative. And let’s not forget we are simultaneously managing the needs of the business and managing a global team seated all over the world.

Sequenced event templates are pretty cool, but they were developed around the time that Risk-based Alerting (RBA) was developed in Splunk Enterprise Security. Additionally, they don’t have all the great context we can generate with the holistic picture provided by risk, so I want to provide guidance on how we would implement its equivalent in the RBA context as they are now deprecated in Splunk Enterprise Security 8.0. There are two approaches we can utilize that do slightly different things.

When people hear “SOAR,” they often think of Security, Orchestration, Automation and Response, a powerful solution for streamlining security operations. But SOAR’s capabilities don’t stop there. By driving efficiency and automation in IT operations, infrastructure management and cloud optimization, SOAR empowers teams across the organization to work smarter and respond faster.

In the final entry of this blog series, we will discuss the challenges of managing assets and risks across multiple data systems. Then, we will discuss how Asset and Risk Intelligence integrates with multiple platforms to provide centralized visibility. From there, we will summarize the content of this blog post and go into a step by step guided demo. If you haven’t already, be sure to check out the first, second, and third entries in this series for more deep dives into Splunk ARI and its features.

When it comes to your cybersecurity and daily security operations, a security operations center (SOC) is the central place for all these activities. In this in-depth SOC explainer, we’ll look at: And if you’re wondering whether you really need an SOC for your organization, the answer is probably yes. Read on and you’ll see why — and how.

SQL Server is more than just a database—it's a powerful platform that can be leveraged by attackers for system access, persistence, and code execution. While organizations focus on protecting their valuable data, they often overlook the inherent capabilities within SQL Server that make it an attractive target for adversaries looking to establish footholds in Microsoft environments.

Over the past few years, cyberattacks have escalated to unprecedented heights. Just last year, in 2024, 94% of organizations reported being the victims of phishing attacks. And in the first five weeks of 2025, ransomware attacks increased by 149% in the first 5 weeks of 2025. Organizations and users need help understanding and navigating these changing risks to fight against the rising tide of cybercrimes. Thankfully, that is exactly what The OWASP Foundation aims to do.

Success in threat hunting is vastly different from incident response. Incident responders can measure success in criteria like ticket volume, mean time to close, or escalations. For threat hunting, the number of hunts vs. incidents is not comparable because hunts take longer, and the average time to complete a hunt can vary wildly. More importantly, most hunts will not result in incidents. We can’t use the same metrics! Our critical metrics of success are our outputs/deliverables and documentation.

When it comes to cyber attacks, it’s no longer a question of if but when. Threat actors aren’t discriminating between the public or private sector — each organization has valuable data, which means every organization is a viable target. In this new threat landscape, digital resilience — the ability to defend against, withstand, and recover from attacks — has become an operational imperative.