From Qradar to Elastic: Automate your Detection Rule Migration
Migrating to a new SIEM is often viewed as a daunting task. The sheer volume of legacy detection rules, dashboards, and custom configurations can keep…
Category: ThreatIntelligence-IncidentResponse
Automating GOAD and Live Malware Labs
Introduction: The Need for a Scalable, Automated Simulation Range In modern security operations, detection engineering is no longer a “set it and forget it” discipline.…
DYNOWIPER: Destructive Malware Targeting Poland’s Energy Sector
Summary li]:list-disc”> 30+ wind and solar farms across Poland A major CHP plant supplying heat to nearly half a million customers A manufacturing sector company…
SolarWinds Web Help Desk Exploitation – February 2026
Summary li]:list-decimal”> Apply the latest SolarWinds Web Help Desk patches. Rotate all service and administrative credentials that are associated with SolarWinds Web Help Desk. Conduct…
Make The Most of Network Firewall Logs with Elastic Security
This is Part 1 of a two-part series on leveraging firewall data in Elastic Security. In this post, we cover the fundamentals of firewall logs,…
Manage your Elastic security stack as code with the Elastic Stack Terraform provider
The Elastic Stack Terraform provider has reached a significant milestone. Starting with release v0.13.1, you can manage your Elastic security posture – detection rules, exception…
Get started with Elastic Security from your AI agent
Get started with Elastic Security from your AI agent Elastic Agent Skills are open source packages that give your AI coding agent native Elastic expertise.…
Streamlining the Security Analyst Experience
The term Agentic SOC (Security Operations Center) is one of the most popular concepts in security today. But what does it truly mean in practice,…
Investigating from the Endpoint Across Your Environment with Elastic Security XDR
Preamble Security investigations rarely stay confined to a single host. Today’s attackers increasingly use automation and AI to compress multi-stage attacks into minutes, turning what…
Elastic releases detections for the Axios supply chain compromise
Elastic Security Labs is releasing an initial triage and detection rules for the Axios supply-chain compromise. We have released a detailed analysis on the Axios…
Elastic Security Integrations Roundup: Q1 2026
A quarterly look at Elastic’s security integrations ecosystem Security teams can only protect what they can see. Gaps in coverage, like a macOS fleet generating…
Elastic Conversational Entity Analytics for threat hunting
Entity Analytics is a core security analytics capability that extends Elastic Security from event-centric to entity-centric investigation. By focusing on critical entities, such as users,…