Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Security Incident and Event Management.

Ranking the top 10 SIEM platforms in 2026

Security information and event management, or SIEM, remains one of the foundational technologies in the security operations center. Gartner defines SIEM as a configurable system of record that collects, aggregates, and analyzes security event data from on-premises and cloud environments to support threat detection, investigation, and response, along with compliance requirements.

The New CISO Ep. 151 - Sean Murphy | Complacency Kills: Why More Discomfort Might Fix Your Burnout

Sean Murphy spent more than twenty years in the CISO chair and walked away from it while things were going well. In this episode of The New CISO, he returns to talk with Steve Moore about trading the operational seat for a field CISO role at F5 — and why getting too good at the job was the warning sign.

Extend Investigations with Falcon Next-Gen SIEM Federated Search and Snowflake

See how CrowdStrike Falcon Next-Gen SIEM Federated Search extends investigations to security data stored in Snowflake without requiring the entire dataset to be ingested into the SIEM. In this demo, an analyst pivots from suspicious endpoint activity in Falcon to Corelight network telemetry retained in Snowflake. Using remoteTable(), the analyst searches the remote data directly from Advanced Event Search, retrieving only the context needed to investigate the affected host and understand the broader scope of the incident.

Try Sumo Logic in minutes: see SIEM and Dojo AI agents in action

You already know the feeling. An alert fires, and you’re the one digging through logs to figure out if it matters. A query takes three tries to get right. A tool demo looked great, but you still cannot picture it running against your own environment. Before dedicating too much of your over-committed schedule to a proof of concept, you want to know one thing: does this actually work the way they say it does?

CISA's Logging Reference Architecture for OMB M-26-14: What federal agencies should do next

On August 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published its Logging Reference Architecture (LRA), the implementation guidance federal civilian executive branch (FCEB) agencies have been waiting for since the Office of Management and Budget's Memorandum M-26-14 reset the requirements for enterprise logging.

Sumo Logic MCP server: bringing SIEM and log data into Claude and other AI clients

More security and operations work now happens inside an AI client instead of a dedicated console. That shift creates a gap for any platform that isn’t part of the conversation. Every time an analyst needs to triage an insight or check a log, they have to leave the AI client and go open a different tool. Sumo Logic closes that gap with a Model Context Protocol (MCP) server.

The only perfect Endpoint Prevention and Response (EPR) score in 2026 belongs to Elastic

Elastic sits at the very top of this year’s AV-Comparatives' CyberRisk Quadrant within the 2026 Endpoint Prevention and Response (EPR) test with the only protection scores at 100%, combined with both the lowest modelled operational footprint of any tested product and zero false alerts.

The industry turned XDR and SIEM into categories. Sophos turned them into outcomes.

Sophos Next-Gen SIEM, now generally available as part of Sophos Fusion, brings security operations and compliance together through shared context. For years, the cybersecurity industry has blurred the lines between XDR and SIEM. As capabilities converged, organizations were left trying to connect separate security operations and compliance solutions, often moving the same data between different tools, workflows, and teams.