SIEM data export: how six vendors compare
Your security data is the most important asset in your SOC. Not the dashboards, not the detections, not the AI features on the roadmap slide.…
Category: ThreatIntelligence-IncidentResponse
STIXy Situations: ECSaping your threat data
Preamble Organizations that use threat indicators or observables consume, create, and/or (ideally) publish threat data. This data can be used internally or externally as information…
Unveiling malware behavior trends | Elastic Security Labs
Preamble When prioritizing detection engineering efforts, it’s essential to understand the most prevalent tactics, techniques, and procedures (TTPs) observed in the wild. This knowledge helps…
Kernel ETW is the best ETW
Preamble A critical feature of secure-by-design software is the generation of audit logs when privileged operations are performed. These native audit logs can include details…
Elevate Your Threat Hunting with Elastic
We are excited to announce a new resource in the Elastic Detection Rules repository: a collection of hunting queries powered by various Elastic query languages!…
How to achieve full-spectrum financial risk detection with AI and unified data
Financial services organizations are drowning in data. From emails and Bloomberg chats to WhatsApp messages and calls, the need to review communications data to detect…
Elastic changes the SIEM game with AI-driven security analytics
Traditional SIEMs have heavily relied on the human behind the screen for success. Alerting, dashboarding, threat hunting, and finding context among a deluge of signals…
Huntress Employee Spotlight: Meet Ben Bernstein
Huntress was founded in 2015 by former NSA cyber operators who believe enterprise-grade protection shouldn’t be reserved for the 1%. Since those early days, we’ve…
Elastic and Keep join forces to help users manage alerts and automate workflows
We are thrilled to announce today that Elastic has entered into an agreement to acquire Keep Alerting Ltd (“Keep”), an open source AIOps company. The…
Huntress API Update: New Endpoints, Webhooks, and Automation
When we launched the Huntress API in 2022, the goal was straightforward: give partners a way to pull their Huntress data without logging into the…
How AI and contextual search enhance defence cybersecurity
In today’s defence environment, information is abundant, yet insight often remains elusive. While data pours in from every connected system, every edge device, and every…
Agentic Frameworks Summary | Elastic Security Labs
Security teams and SOC analysts still face the same tier-1 response challenges since the early 2000s, from alert volumes to missed threats. While generative AI…