A wise person once said that you should use the lookup command before you go threat hunting. Or, as I hear it in my head, “Look it up before you go-go…hunting”, a la WHAM!:   In this must-read tutorial for hunting in Splunk, we’re looking at the lookup command, including what it does and how and where to use it for threat hunting. Let’s get started! (This article is part of our Threat Hunting with Splunk series. We’ve updated it recently to maximize your value.)

Vulnerability scanning is the process of identifying security weaknesses and flaws in systems and software running on them. It's part of a vulnerability management program that protects organizations from data breaches. IT departments or third-party security service providers scan for vulnerabilities using vulnerability scanning tools. Doing so helps predict how effective countermeasures are in case of a threat or attack.

The way we work has drastically changed since the start of the pandemic. With more companies adopting remote and hybrid work models, there has been a 600% increase in cybercrime and 65% of organizations have seen a measurable increase in attempted cyberattacks, which is particularly problematic since, according to the 2022 Splunk State of Security report, 78% say remote workers are harder to secure.

Bots have become integral to our lives, offering many benefits across various industries. Of all these bots, there are good bots, bots for telling dad jokes and (significantly less cool) bots focused on distributing malware. Understanding the types of bots out there should help you harness the power of good bots while helping you identify bots to avoid. This article will explore all types of bots, empowering you to make informed decisions and reap the rewards while keeping risks at bay.

HTTP Strict Transport Security (HSTS) plays an important role in web security — ensuring secure communication between websites and the web browsers of users. Read on to learn about the importance of HSTS, key features such as HSTS preloading, the threats that HSTS can mitigate, and some of the limitations of the protocol.

If you’ve been following our series on the PEAK threat hunting framework, you might already know that the purpose of threat hunting isn’t just to find security incidents your automated detection systems missed. Finding incidents is more like a helpful side effect. The real reason to hunt is to drive improvement to your security posture over time.

Modern enterprises are fraught with dangers and vulnerabilities that were rare even a decade ago. Cyber threats are becoming more frequent and sophisticated, and even the most secure organizations are falling victim to their attacks. In this landscape, a proactive security stance is crucial. That is where the 3Rs of enterprise security — Rotate, Repave, and Repair — offer your organization a critical advantage.