Companies Push AI Use But Skip Training and Official Policy
Many employees are using AI at work without formal training. 43% of knowledge workers—office employees whose jobs center on information rather than manual work—say their…
Category: ThreatIntelligence-IncidentResponse
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
The threats that most often knock companies off balance rarely match the flashy ones dominating cyber headlines. If you run a small or mid-sized organization,…
Elastic Security opens public detection rules repo
At Elastic, we believe in the power of open source and understand the importance of community. By putting the community first, we ensure that we…
Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)
Last month, we hosted a webinar, Hunting for persistence using Elastic Security, where we examined some techniques that attackers use in the wild to maintain…
Collecting Cobalt Strike Beacons with the Elastic Stack
Overview Cobalt Strike is a premium offensive security tool leveraged by penetration testers and red team members as a way to emulate adversary behavior. The…
Practical security engineering: Stateful detection
Detection engineering at Elastic is both a set of reliable principles — or methodologies — and a collection of effective tools. In this series, we’ll…
Detection and response for the actively exploited ProxyShell vulnerabilities
Blog In the last week, Elastic Security has observed the exploitation of Microsoft Exchange vulnerabilities associated with ProxyShell. Review the post to find newly released…
Linux endpoint management without MDM via Elastic Workflows
Our mobile device management (MDM) covers macOS and Windows but not Linux. So, for Linux endpoint management, we turned to Elastic Agent and Elastic Defend,…
Testing your Okta visibility and detection with Dorothy and Elastic Security
When approached by stakeholders in their organization, few security teams can confidently demonstrate that logging and alerting capabilities are working as expected. Organizations have become…
Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate
How reliability scoring keeps risky patches out of zero-touch jobs, and how one blocking rule stops a paused update across your environment. Executive Summary Microsoft…
Ransomware, interrupted: Sodinokibi and the supply chain
Last month, the Elastic Security Protections Team prevented an attempted ransomware attack targeting an organization monitored by one of our customers, an IT Managed Service…
Okta and LAPSUS$: What you need to know
Readers Note: Elastic has undergone a series of investigations internally and has not yet identified malicious actions that may pertain to this event. Okta has…