Logging

splunk

Splunk SOAR Playbook of the Month: Cisco Umbrella DNS Denylisting

Apr 12, 2024 By Coty Sugg In Splunk
Given the recent exciting news of Splunk becoming part of Cisco, for this edition of Splunk SOAR Playbook of the Month, we thought what better way to showcase how the combination of Cisco and Splunk can help users achieve more comprehensive security than through a playbook that combines the power of Cisco Umbrella and Splunk SOAR.
Read Post
graylog

The Ultimate Guide to Sigma Rules

Apr 9, 2024 By Jeff Darrington In Graylog
In cybersecurity as in sports, teamwork makes the dream work. In a world where security analysts can feel constantly bombarded by threat actors, banding together to share information and strategies is increasingly important. Over the last few years, security operations center (SOC) analysts started sharing open source Sigma rules to create and share detections that help them level the playing field.
Read Post
elastic

5 reasons why observability and security work well together

Apr 8, 2024 By Jennifer Ellard, In Elastic
Site reliability engineers (SREs) and security analysts — despite having very different roles — share a lot of the same goals. They both employ proactive monitoring and incident response strategies to identify and address potential issues before they become service impacting. They also both prioritize organizational stability and resilience, aiming to minimize downtime and disruptions.
Read Post
splunk

UEBA Superpowers: Enhance Security Visibility with Rich Insights to Take Rapid Action Against Threats

Apr 5, 2024 By Fernando Jorge In Splunk
As the cybersecurity landscape continually evolves, SOCs must quickly identify, evaluate, and counteract cyberattacks. In the heat of a security investigation or incident response, achieving rapid visibility and rich contextual insights about the attack are not merely advantageous, but essential.
Read Post
devo

Does Your SIEM Offer Enough Flexibility? Questions to Ask

Apr 2, 2024 By Devo In Devo
When evaluating a SIEM, two key factors stand out: flexibility in data handling and open architecture. These two elements significantly enhance a platform’s efficiency and adaptability in managing cybersecurity threats. Whether you’re evaluating your current SIEM or looking for a more modern solution, here are five questions to ask to gauge its flexibility.
Read Post

SIEM in Seconds - Splunk Enterprise Security Auto Refresh and Timeline of Notable Events

Mar 28, 2024 By Splunk In Splunk
SOC analysts are overwhelmed sifting through a sea of notable events. They are unable to prioritize events and act fast. With Auto Refresh in the Incident Review interface, users will not have to re-run the Incident Response search or refresh the page. Furthermore, an interactive timeline for notable events within the Incident Response interface enables the SOC to quickly prioritize critical incidents.
View Video

SIEM in Seconds - Splunk Enterprise Security Enhanced Risk Analysis Dashboard

Mar 28, 2024 By Splunk In Splunk
With the enhanced risk analysis dashboard in Splunk Enterprise Security, security analysts can now monitor user entity risk events from detections across risk-based alerting and behavioral analytics, which provides a deeper, and more holistic, layer of visibility across all detection events.
View Video
Subscribe to Logging

Copyright © 2024 OpsMatters™. All rights reserved.