Resources Blog

Enterprise SIEMs Detect Fewer Than 5 of Top 14 MITRE ATT&CK Adversary Techniques Used in the Wild

Topics: Featured, Threat Management, Security Engineering, MITRE ATT&CK, SecOps

Posted by Phil Neray on May 18, 2022

"Organizations need to become more intentional about detection in their SOCs. What should we detect? Do we have use cases for those scenarios? Do they actually work? Do they help my SOC analysts effec... Read More>>

Dr. Anton Chuvakin answers questions about SIEM, EDR, and XDR — from our recent SANS webinar on the future of SIEM

Topics: News, Featured, Threat Management, Security Engineering, MITRE ATT&CK, SecOps, Cloud

Posted by Phil Neray on April 29, 2022

Dr. Anton Chuvakin Discusses “20 Years of SIEM – What’s Next?” Learn what Dr. Anton Chuvakin, Head of Security Solution Strategy at Google Cloud and former Gartner Research VP, has to say about questi... Read More>>

Spring into action (with SIEM detection rules for Spring4shell)

Topics: News, Featured, Threat Management, MITRE ATT&CK, SecOps

Posted by Liran Ravich and Yosi Magor on April 1, 2022

Spring into action (with SIEM detection rules for Spring4shell) The Spring Framework is an open source application framework that provides infrastructure support for developing Java applications. The ... Read More>>

Lapsus$ vs the world: SIEM detection rules with ATT&CK mapping

Topics: News, Featured, Threat Management, MITRE ATT&CK, SecOps

Posted by Liran Ravich on March 24, 2022

Image credit: World of Dictionary A new player has entered the game The ”Lapsus$” group, unknown before December 2021, has made multiple headlines in recent weeks, following multiple data breaches in ... Read More>>

How do Russian threat groups avoid "friendly cyber fire"? (TL;DR – By installing a Russian language pack)

Topics: Featured, Threat Management, MITRE ATT&CK, SecOps

Posted by Yosi Magor and Phil Neray on March 21, 2022

Welcome to cyber-physical conflict The current situation in Ukraine demonstrates once again how the lines have blurred between cyber and physical conflict.  Read More>>

SC Magazine Covers CardinalOps Threat Coverage Gap: SIEM Rules Ignore Bulk of MITRE ATT&CK

Topics: Featured, MITRE ATT&CK

Posted by Jason Matlof on February 25, 2021

SC Magazine Coverage of CardinalOps: SIEM Rules Ignore Bulk of MITRE ATT&CK Read More>>

The Comforting (or Discomforting?) Feeling of Objective Data Validation

Topics: Featured, Threat Management, Security Engineering, MITRE ATT&CK, SecOps

Posted by Yair Manor on February 10, 2021

It’s always nice to have conviction in your assumptions and hypotheses, but in the world we currently occupy there is a huge premium on truth, data and facts. I am, therefore, happy to announce the re... Read More>>

Hats Off to MITRE ATT&CK For Continuously Improving the Framework!

Topics: Threat Management, Security Engineering, MITRE ATT&CK, SecOps

Posted by Michael Mumcuoglu on November 3, 2020

HATS OFF to MITRE ATT&CK for not only establishing the industry’s best and most comprehensive framework to measure #threatdetection coverage, but also keep raising the bar by continuously improvin... Read More>>