Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Splunk

SIEM vs. SOAR in 2024: What's The Difference?

The threat landscape today is complex and constantly changing. Organizations require robust cybersecurity solutions to protect their networks and systems. SIEM and SOAR are two technologies that are pivotal in strengthening security operations. In this article, I’ll look at both technologies, SIEM and SOAR, to help you understand the importance of strengthening your organization’s SecOps.

Coffee Talk with SURGe: 2023-OCT-03 WS_FTP RCE, Exim Scope, ChatGPT, Cybersecurity Awareness Month

Grab a cup of coffee and join Mick Baccio, Ryan Kovar and Audra Streetman for another episode of Coffee Talk with SURGe. The team from Splunk will discuss the latest security news, including: Mick and Ryan competed in a 60 second charity challenge to share the pros and cons of Cybersecurity Awareness Month.

See More, Act Faster, and Simplify Investigations with Customizable Workflows from Splunk Enterprise Security 7.2

In our latest release of Splunk Enterprise Security 7.2, we are excited to introduce capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making. The majority of these updates and new features were requested directly from Splunk Enterprise Security (ES) users and submitted through the Splunk Ideas portal.

Coffee Talk with SURGe: The Interview Series featuring Sherrod DeGrippo

Join Ryan Kovar and special guest Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft, for a discussion about crimeware, threat actor naming conventions, and Sherrod's essay in a new book by SURGe titled, "Bluenomicon: The Network Defender's Compendium.".

Revisiting the Big Picture: Macro-level ATT&CK Updates for 2023

Based on the popularity of last year's Macro-level ATT&CK Trending, we’ve updated the dataset for another year’s worth of insights. This data summarizes the frequency of MITRE ATT&CK technique observations across thousands of cyber incidents over the past four years. In this post, we’ll look at the contents of the updated dataset, using Splunk to pull out trends based on this ultra large-scale attacker landscape!

Addition of Syslog in Splunk Edge Processor Supercharges Security Operations with Palo Alto Firewall Log Reduction

Now generally available, Splunk Edge Processor supports syslog-based ingestion protocols, making it well-equipped to wrangle complex and superfluous data. Users can deploy Edge Processor as an end-to-end solution for handling syslog feeds such as PAN logs, including the functionality to act as a syslog receiver, process and transform logs and route the data to supported destination(s).

Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT

Ave Maria RAT (remote access trojan), also known as “Warzone RAT,” is a malware that gains unauthorized access or remote control over a victim’s or targeted computer system. This RAT operates stealthily and grants attackers access to various functionalities within the compromised system. Its malicious activity includes data theft, privilege escalation, remote desktop control, email credential collections, browser credential parsing and more.

The Quantum Threat: Options for Migrating to Quantum Safe Cryptography

What are my quantum options? And what has Goldilocks’ porridge got to do with it? You’ve heard that eventually you’ll need to migrate to quantum-safe cryptography. Perhaps you’re raring to go. And yet, here I am, ready to tell you one thing: don’t do anything yet. Your options really depend on your quantum problem, but if you’re looking to migrate your cryptography today, you’re moving way too soon.

Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs

On September 4, 2023, CERT-UA revealed a meticulously planned cyberattack targeting Ukraine's critical energy infrastructure. The attack's modus operandi was distinct; it utilized deceptive emails containing bait links, luring victims into downloading a seemingly innocuous ZIP archive. This archive, however, harbored malicious files designed to hijack the victim's computer, redirecting data flows and exfiltrating sensitive information using services like mockbin.org and mocky.io.

OMB M-21-31: Your Complete Guide

Imagine that you work in IT and security for a federal entity. How do you manage your event data across different systems and networks? When something goes wrong, how do you detect, investigate and remediate these security incidents? That’s what the Office of Management and Budget (OMB) addresses in M-21-31: a memorandum that provides guidance for federal agencies to increase their visibility and response capabilities before, during and after a cybersecurity incident.