Tag

#siem

232 posts21 followers

Explore Hashnode

Alternatives

Hazel Chirinda50m ago · 12 min read

The Visibility Gap: What Your Security Tools Could Be Overlooking

Organisations invest in security tools to detect threats, monitor activity, and protect their users, devices, and data. They may have endpoint detection and response (EDR), a security information and

hazelsec.hashnode.dev

Kgosi_CS19h ago · 9 min read

OCSF Explained: One Schema for Every Security Event

How the Open Cybersecurity Schema Framework gives security data a common language, and how to start using it. Security teams collect more data than ever, but much of it doesn't line up. A firewall, an

kgositshepo.hashnode.dev

Yash Gulati3d ago · 7 min read

Chakravyuha: I'm Building a Purple Team AD Lab - Here's the Plan

I've spent years building things - applications, websites, personal projects - but always from the builder's side. Make it work, ship it, move on. Security was never part of how I thought about those

yashgulatii.hashnode.dev

shadowsongOct 15 · 6 min read

Inside a SOC: What Happens After a Security Alert Is Triggered?

Once a security alert comes into a Security Operations Center (SOC), the investigation is just starting. An alert could be a suspicious sign-in, a malicious application is running, unfamiliar connecti

shadowsec.hashnode.dev

Anonymous EndpointOct 12 · 9 min read

Your Security Product Can Be Great and Still Lose the Deal Because of ServiceNow

A security product can detect the right issue, generate an accurate finding, and still create a problem for the customer. The reason is simple: detection is only the beginning of the remediation proce

cyberpod.hashnode.dev

Zero Trust ThreadsOct 9 · 7 min read

More Alerts Don't Mean Better Security

Imagine two security operations teams. Team A receives: 20,000 alerts every day. Team B receives: 300 alerts every day. Which team has better security? There is no way to know. Alert volume does n

zerotrustthreads.hashnode.dev

odufuwababajide77Sep 29 · 4 min read

Network Discovery Detection: Visualizing Scans in Elastic SIEM

If you are training for a SOC analyst role knowing what a network scan won't be enough. You have to know exactly what it looks like in the logs and how to hunt for it. I recently tackled the "Network

kay-security-labs.hashnode.dev

JebitokSep 23 · 28 min read

Agent Discovery (TryHackMe)

Link to the challenge on TryHackMe: Agent Discovery Introduction AI agents can analyse information, use tools, retrieve knowledge, and complete multi-step work. These capabilities make them useful for

sharonjebitok.com

HugoSep 22 · 11 min read

ValtersIT CVE + Threat-IP API: Integration Guide for Firewalls, SIEM and CI/CD" subtitle: "Working code for five real integrations: firewall blocklists, SIEM enrichment, CI/CD gates, change tracking, and detection rules — all checked against the live API.

Your firewall vendor publishes a critical advisory. Days later NVD assigns a score, a PoC lands on GitHub, and CISA adds it to KEV. Correlating those sources by hand is a tooling problem, not a knowle

hugovalters.hashnode.dev

HugoSep 22 · 6 min read

Why Security Teams Are Replacing Manual CVE Tracking With the ValtersIT API

Every security team has a CVE problem. Not a shortage of CVE data — a surplus of it, scattered across sources that disagree, update at different rates, and give you no way to prioritize. NVD publishes