Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SIEM

The latest News and Information on Security Incident and Event Management.

Integrating PAM with SIEM: Enhancing threat detection and response

When we think about privilege access management (PAM), we typically think about it first as preventive control. PAM solutions manage who has privileged access to systems, enforce least-privilege principles and monitor and record privileged user activity. This is crucial for preventing misuse of high-level permissions and ensuring accountability.

How To Stop A DDoS Attack

On a Friday afternoon at 5 PM, you’re cruising along the backroads in your car, listening to your favorite music. You’re on vacation and making excellent time to your destination until you notice the long stream of red tail lights a few miles ahead. After sitting in standstill traffic for over an hour, you realize that highway construction created a detour to the two-lane backroad that you were using to skip the rush hour traffic.

Elastic AI Assistant and Attack Discovery integrate with Google Vertex AI to help drive further AI adoption

AI-driven security analytics reduces analyst burnout Most SIEM technologies in today’s market have not kept up with the pace of innovation and place a heavy burden on security analysts to perform manual, labor-intensive tasks in order to maintain defenses. Generative AI is helping security professionals address today’s dynamic threat landscape and prepare for future threats.

Addressing security practitioner burnout: A vital step for security leaders

The “Three Pillars” (people, process, and technology) management framework requires a delicate balance in order to achieve successful operations outcomes. Despite the technology pillar dominating the conversation as of late, cybersecurity practitioners are the backbone of your organization's defense against cyber threats.

Building Better Use Cases for Your SIEM

Deploying a next-gen cloud-native security information and event management (SIEM) in your security operations center (SOC) is a big step in the right direction toward significantly improving your organization’s security capabilities. But once you have that state-of-the-art SIEM in your SOC, how do you get the most out of it? One key step is building and executing specific SIEM use cases designed to meet the particular needs of your organization.

MITRE ATT&CK: API-based Enterprise Techniques and Sub-techniques

Imagine you have a backpack with a granola bar buried at the bottom and a tenacious tiny dog who loves snacks. Even though the dog shouldn’t be able to reach that granola bar stored away carefully, it managed to open a zipper and snoop through the contents to eat the snack. From an IT environment standpoint, Application Programming Interfaces (APIs) are the backpack carrying sensitive – but appealing to attackers – data.

Enhanced Compliance Monitoring with NIST 800-53 Integration

Illuminate 5.1.0 is now available, bringing substantial improvements to our compliance capabilities. This update represents a significant step forward, with NIST 800-53 as the cornerstone of our compliance framework. Let’s explore the key features and improvements implemented to support your organization’s security and compliance needs. Important Note: To run Illuminate 5.1.0, your environment must run Graylog 6.0 or higher.

NEW in Elastic Security 8.15: Automatic Import, Gemini models, and AI Assistant APIs

Elastic Security 8.15 is now available, enhancing our mission to modernize security operations with AI-driven security analytics. Key features include the brand new Automatic Import to streamline data ingestion and onboarding, support for Google’s Gemini 1.5 Pro and Flash large language models (LLMs), a new set of APIs for the Elastic AI Assistant, on-demand file scans for the Elastic Defend integration, and a redesigned way of pivoting between different contexts.

Elastic launches Express Migration program for Splunk customers

Level up to Elastic’s AI-driven security analytics, now with incentives to ease and accelerate your SIEM migration The SIEM is evolving again. Traditional SIEM solutions will be displaced in modern security operations centers (SOCs) by AI-driven security analytics, which uses the power of Search AI to replace largely manual SOC processes with automation.

Monitor Akamai Zero Trust and Application Security with Datadog Cloud SIEM

Akamai is a cloud content delivery and security platform that helps organizations secure their applications, APIs, network access, and credentials that workforces and customers use every day. Akamai Zero Trust provides enhanced security for users, devices, and data across an organization by securing access to the corporate network, SaaS applications, email, and other resources.