Tag: siem
-
Centralize Like You Mean It, Federate Like You Have To
Tags: ai, api, attack, automation, breach, cloud, compliance, control, data, detection, dns, endpoint, identity, infrastructure, network, PCI, radius, regulation, resilience, risk, saas, service, siem, soc, technology, threat, tool, windows, worm(by Anton Chuvakin & Usman Chaudhary) Prologue: Three Years After “The End Is Nigh” Back in 2023, one of us wrote “Log Centralization: The End Is Nigh?””Š”, “Šan admittedly incomplete-thought blog with a scary premise: after 20+ years of yelling “centralize your logs!” (the earliest surviving deck is from 2003), we may be running out of…
-
Centralize Like You Mean It, Federate Like You Have To
Tags: ai, api, attack, automation, breach, cloud, compliance, control, data, detection, dns, endpoint, identity, infrastructure, network, PCI, radius, regulation, resilience, risk, saas, service, siem, soc, technology, threat, tool, windows, worm(by Anton Chuvakin & Usman Chaudhary) Prologue: Three Years After “The End Is Nigh” Back in 2023, one of us wrote “Log Centralization: The End Is Nigh?””Š”, “Šan admittedly incomplete-thought blog with a scary premise: after 20+ years of yelling “centralize your logs!” (the earliest surviving deck is from 2003), we may be running out of…
-
Stop Building a 2003 SOC with AI: Local Context, Failure Modes and Your Path (Part 3)
In Part 1 of this series, we dumped a pile of uncomfortable questions on you and promised answers. In Part 2 of the series, we talked about why 1990s-2000s alert triage must die. The core thesis, if you recall: if you add AI agents into a legacy, swivel-chair SOC structure, you are essentially building a robotic…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
Stress-Testing Your SIEM: Is Your Environment Actually Catching the Bad Guys?
In today’s security landscape, we have more tools than ever (EDR, XDR, SOAR, SIEM) and very little time to learn each one fully. Every tool out there advertises “we use MITRE” and “we are a Gartner top X” and now since 2025 “We have AI!”. All of these are well and good, however they […]…
-
7AI Launches Federated SIEM and Build Tools Ahead of Black Hat USA 2026
7AI has launched 7AI Federated SIEM and 7AI Build, two capabilities designed to give security teams a distributed foundation for AI-assisted operations. The company said both will be showcased at Black Hat USA 2026. 7AI Federated SIEM connects to security data across existing SIEMs, data lakes and cloud platforms. It lets teams query, investigate and..…
-
Realm Security Debuts Detection Integrity and Unmetered Data Haven Search
Realm Security is introducing two capabilities ahead of Black Hat USA 2026: Detection Integrity and search inside its Data Haven retention layer. The company said the tools are intended to help security teams reduce SIEM data volume without losing visibility into the detections that depend on that data. Detection Integrity reads the detections running in..…
-
SIEM Limitations: The External Signals Your’re Missing
Nisos SIEM Limitations: The External Signals Your’re Missing If you run an insider threat program, your Security Information and Event Management platform (SIEM) is probably doing its job… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/siem-limitations-the-external-signals-yourre-missing/
-
7AI expands platform with Federated SIEM and AI workflow builder
7AI has announced two major platform capabilities: 7AI Federated SIEM, which lets security teams query, investigate, and act on data wherever it lives, including within 7AI, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/27/7ai-expands-platform-with-federated-siem-and-ai-workflow-builder/
-
Sophos Fusion brings endpoint, SIEM, identity and MDR into one security system
First seen on scworld.com Jump to article: www.scworld.com/news/sophos-fusion-brings-endpoint-siem-identity-and-mdr-into-one-security-system
-
Cribl Acquires CardinalOps In Move To Expand Into Security Operations
Cribl acquires CardinalOps in move to strengthen its presence in the cybersecurity space for threat detection, providing an alternative to legacy SIEM products. First seen on crn.com Jump to article: www.crn.com/news/security/2026/cribl-acquires-cardinalops-in-move-to-expand-into-security-operations
-
How to Evaluate an AI SOC Platform in 2026: 6 Capabilities That Separate Leaders from Bolt-On AI solutions
Building a shortlist for an AI SOC evaluation can be tough. SIEM, SOAR, and pureplay AI SOC vendors are all saying the same thing. But behind the identical label sit very different products, from chat assistants bolted onto a legacy SIEM to agent platforms that run detection, triage, investigation, and response on their own data…
-
How to Evaluate an AI SOC Platform in 2026: 6 Capabilities That Separate Leaders from Bolt-On AI solutions
Building a shortlist for an AI SOC evaluation can be tough. SIEM, SOAR, and pureplay AI SOC vendors are all saying the same thing. But behind the identical label sit very different products, from chat assistants bolted onto a legacy SIEM to agent platforms that run detection, triage, investigation, and response on their own data…
-
AI Researchers Target SIEM Migration Bottleneck
System Translates Detection Rules Across Security Platforms. Researchers developed an AI framework that converts threat detection rules between major SIEM platforms including Splunk, Microsoft Sentinel and QRadar. The system uses LLMs and automated validation steps to preserve detection logic during migrations that often require months of manual work. First seen on govinfosecurity.com Jump to article:…
-
Your Purple Team Isn’t Purple, It’s Just Red and Blue in the Same Room
Defending a network at 2 am looks a lot like this: an analyst copy-pasting a hash from a PDF into a SIEM query. A red team script is being rewritten by hand so the blue team can use it. A patch waiting on a change-approval window that’s longer than the exploitation window itself.Nobody in that…
-
Bots in translation: Can AI really fix SIEM rule sprawl across vendors?
Not everyone agrees that the problem requires AI: Some practitioners argue that much of the challenge can still be solved through deterministic engineering approaches rather than AI.”With a good understanding of both schemas, it’s just a body of work,” said Rahul Yadav, founder of cybersecurity firm CyberEvolve.Xu disagreed that rule translation can be reduced to…
-
Cutting the cost of SIEM rule conversion
You inherit two thousand detection rules from an acquisition. They are written for a platform your company does not use. Your senior detection engineer estimates six months to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/06/arulecon-siem-rule-conversion/
-
Singapore boffins get diverse SIEMs singing in harmony with agentic rule translation
Vendors all use different formats. This tech translates them all so you can smooth your SOC First seen on theregister.com Jump to article: www.theregister.com/2026/05/05/arulecon_siem_rule_conversion/
-
How CISOs should utilize data security posture management to inform risk
Tags: access, ai, automation, business, ciso, compliance, control, cyber, data, detection, finance, iam, incident response, monitoring, open-source, remote-code-execution, risk, service, siem, software, tool, update, vulnerabilityApplying the principles at any maturity level: Whether you’re working with a full DSPM platform, a lightweight open-source scanner or even manual data inventories, CISOs can use this thinking to apply quantification (or at least an order of magnitude) to risk decisions. For example, you may have a written policy in place that a database…
-
Security Data Lake vs SIEM vs Data Pipeline
What’s the difference between a security data lake, SIEM, and data pipeline? Learn how each one works, and how they fit together to cut SIEM cost and retain logs long-term. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/security-data-lake-vs-siem-vs-data-pipeline/
-
Dismantle implicit trust in OT networks, CISA tells critical infrastructure operators
Tags: access, ai, cisa, communications, control, data-breach, detection, firewall, guide, infrastructure, network, open-source, siem, tactics, tool, vpn, zero-trustWhat it means for security teams: The publication closes a gap that CISA’s Zero Trust Maturity Model 2.0 acknowledged, having stated it did not address challenges specific to operational technology. It follows February’s Barriers to Secure OT Communications and earlier CISA warnings that exposed VPNs, firewalls, and legacy edge devices remain the dominant entry points…
-
Diagnostic Fatigue: Why the Visibility Industry Just Hit Its Limit
For more than a decade, cybersecurity has sold one product under a thousand names: visibility. SIEM for events. EDR for endpoints. ASM for the attack surface. CNAPP for the cloud. Exposure management for everything else. Every category promised the same thing: if we could just see enough, we would finally secure enough. The visibility industry…The…
-
SIEM Pricing 2026: Leading SIEM Providers Compared ( How To Reduce the Price of SIEM Ownership)
Compare 2026 SIEM pricing for Splunk, Microsoft Sentinel, Sumo Logic, CrowdStrike NG-SIEM & Cortex XSIAM. See real rates and how to cut SIEM costs 40%+. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/siem-pricing-2026-leading-siem-providers-compared-how-to-reduce-the-price-of-siem-ownership/
-
SIEM Pricing 2026: Leading SIEM Providers Compared ( How To Reduce the Price of SIEM Ownership)
Compare 2026 SIEM pricing for Splunk, Microsoft Sentinel, Sumo Logic, CrowdStrike NG-SIEM & Cortex XSIAM. See real rates and how to cut SIEM costs 40%+. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/siem-pricing-2026-leading-siem-providers-compared-how-to-reduce-the-price-of-siem-ownership-2/
-
You’re Not Watching MCPs. Anthropic’s Vulnerability Shows Why You Should Be.
Tags: access, ai, api, attack, authentication, breach, control, credentials, cve, data, framework, hacker, infrastructure, injection, LLM, remote-code-execution, risk, saas, siem, supply-chain, threat, update, vulnerabilityLast week, researchers at OX Security published findings that should stop every security leader in their tracks. They discovered a critical vulnerability baked directly into Anthropic’s Model Context Protocol SDK, affecting every supported language: Python, TypeScript, Java, and Rust. The result: remote code execution on any system running a vulnerable MCP implementation, with direct access…
-
SIEM Alert Fatigue Has Five Root Causes. Tuning Fixes Zero of Them.
Tags: siem63% of SIEM alerts go uninvestigated every day. Learn the five structural root causes of alert fatigue and how autonomous investigation covers 100% of alerts in under 2 minutes, without replacing your SIEM. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/siem-alert-fatigue-has-five-root-causes-tuning-fixes-zero-of-them/
-
TDL 019 – The Psychology Behind a Cyber Breach and the Leaders Who Survive It – Nim Nadarajah
Tags: access, ai, apple, automation, breach, business, cctv, ceo, cio, ciso, cloud, computing, conference, control, corporate, crowdstrike, cve, cyber, cyberattack, cybersecurity, data, dns, edr, email, finance, firewall, governance, group, healthcare, incident, incident response, infrastructure, injection, insurance, Internet, jobs, law, LLM, metric, microsoft, msp, network, office, powershell, privacy, programming, psychology, risk, saas, service, siem, soar, soc, software, startup, strategy, supply-chain, switch, technology, threat, tool, training, usa, vulnerability, windows, zero-trustLeading Through the Cyber Abyss In Episode 019 of The Defender’s Log, host David Redekop sits down with Nim Nadarajah, CISO and Managing Partner of Critical Matrix, to explore the evolving landscape of cybersecurity leadership. From the “annual pilgrimage” of RSAC 2026 to the front lines of incident response, the conversation shifts from technical bits…
-
TDL 019 – The Psychology Behind a Cyber Breach and the Leaders Who Survive It – Nim Nadarajah
Tags: access, ai, apple, automation, breach, business, cctv, ceo, cio, ciso, cloud, computing, conference, control, corporate, crowdstrike, cve, cyber, cyberattack, cybersecurity, data, dns, edr, email, finance, firewall, governance, group, healthcare, incident, incident response, infrastructure, injection, insurance, Internet, jobs, law, LLM, metric, microsoft, msp, network, office, powershell, privacy, programming, psychology, risk, saas, service, siem, soar, soc, software, startup, strategy, supply-chain, switch, technology, threat, tool, training, usa, vulnerability, windows, zero-trustLeading Through the Cyber Abyss In Episode 019 of The Defender’s Log, host David Redekop sits down with Nim Nadarajah, CISO and Managing Partner of Critical Matrix, to explore the evolving landscape of cybersecurity leadership. From the “annual pilgrimage” of RSAC 2026 to the front lines of incident response, the conversation shifts from technical bits…