Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Coffee Talk with SURGe: 2023-APR-18 NSO Group, LockBit macOS Encryptors, AI in CTI, MSFT Taxonomy

Apr 19, 2023 By Splunk In Splunk
Grab a cup of coffee and join Ryan Kovar, Mick Baccio, and Audra Streetman for another episode of Coffee Talk with SURGe. The team from Splunk will discuss the latest security news, including: Mick and Ryan competed in a 60 second charity challenge about how generative artificial intelligence could be used in cyber threat intelligence, with proceeds benefiting the ACLU. The trio also discussed Microsoft's new threat actor naming taxonomy and the role of attribution in cyber threat intelligence.
View Video
splunk

Are you a good or great boxer? Real-world approaches of building cyber resilience in 2023

Apr 18, 2023 By James Hanlon In Splunk
You must have been asleep not to have heard about Splunk’s new mission - ‘to build a safer and more resilient digital world’. Why have we chosen this? Well, not because it is a snappy little tagline, but because we know how important digital resilience is to all of our customers in our ever changing times.
Read Post
splunk

Introducing the PEAK Threat Hunting Framework

Apr 18, 2023 By David Bianco In Splunk
Cybersecurity is an ever-evolving game of cat and mouse. As security experts come up with new ways to protect valuable digital assets, cybercriminals develop craftier techniques to bypass these defenses. Enter threat hunting – the proactive practice of ferreting out those sneaky cyber-rodents.
Read Post
splunk

Send Your SOAR Events to Splunk

Apr 14, 2023 By Endri Teme In Splunk
During a recent Proof of Concept (PoC) for Splunk SOAR with an existing customer of Splunk Enterprise Security (ES), I was asked if it was possible to send events/containers available in Splunk SOAR to Splunk ES as a Notable Event. While the reverse process of sending ES Notable Events to Splunk SOAR is highly documented, I was surprised to find hardly any documentation about the use case my customer brought up during the PoC. Hence, my cue to write my first ever Splunk blog!
Read Post

Splunk SOAR Playbooks - Dynamic Identifier Reputation Analysis (Part 1)

Apr 13, 2023 By Splunk In Splunk
The Dynamic Identifier Reputation Analysis playbook is an essential tool for any security operations center (SOC) team looking for a comprehensive view of their environment’s threat landscape. By leveraging MITRE DEFEND's approach for dynamic identifier reputation analysis, SOC teams can quickly identify potential threats and vulnerabilities and take proactive steps towards mitigating risk before it causes damage.
View Video

Splunk SOAR Playbooks - Dynamic Identifier Reputation Analysis (Part 2)

Apr 13, 2023 By Splunk In Splunk
The Dynamic Identifier Reputation Analysis playbook is an essential tool for any security operations center (SOC) team looking for a comprehensive view of their environment’s threat landscape. By leveraging MITRE DEFEND's approach for dynamic identifier reputation analysis, SOC teams can quickly identify potential threats and vulnerabilities and take proactive steps towards mitigating risk before it causes damage.
View Video
splunk

Endpoint Monitoring: The Ultimate Guide for Enterprise Security & Compliance

Apr 13, 2023 By Kayly Lange In Splunk
You keep your organization’s computers, devices and servers safe, but what about your employees’ devices? The security of their mobile phones, laptops, tablets and other devices is just as critical to your overall security posture. As company endpoints grow, so does their vulnerability. In fact, 66% of organizations are experiencing a growth in endpoint threats.
Read Post
splunk

These Are The Drivers You Are Looking For: Detect and Prevent Malicious Drivers

Apr 13, 2023 By Splunk Threat Research Team In Splunk
The Windows kernel driver is an interesting space that falls between persistence and privilege escalation. The origins of a vulnerable driver being used to elevate privileges may have begun in the gaming community as a way to hack or cheat in games, but also has potential beginnings with Stuxnet.
Read Post
splunk

Level Up Your Cybersecurity with Risk-Based Alerting

Apr 12, 2023 By Haylee Mills In Splunk
In our first blog in the Splunk RBA series, we introduced Risk-Based Alerting (RBA) and covered the basic principles of RBA. In the rest of this series, we explain how you can plan and then implement RBA within your organization. Are your security teams drowning in data and overwhelmed with alerts? Are you thinking that there must be a better way, some esoteric or forbidden knowledge, to produce higher-fidelity alerts and keep your team from burning out?
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.