Moving to Detection-as-Code starts with making existing detection data reliable and machine-readable. In Part 2, we explain how we validated documents, built deployment tooling, scripted the migration, and used dry runs to verify that generated artefacts matched the existing setup.
How do you introduce Detection-as-Code into an environment where detections are already being developed and deployed? This customer case study examines the technical challenges and migration steps involved in improving detection engineering while keeping existing operations running.
Firewall network traffic logs are the largest driver of Microsoft Sentinel ingestion costs. Yet they remain a critical source of information for threat detection, investigations & incident response. Explore how Sentinel Summary Rules can reduce the cost of ingesting firewall traffic events while retaining the visibility SecOp teams need to detect threats & investigate incidents.
This blog is the first in a series exploring how Summary Rules, together with Auxiliary or Data Lake storage, can help organizations optimize SIEM costs without compromising core threat detection and monitoring capabilities.
Adversaries have always relied on legitimate tools to carry out their attacks. These tools are already trusted by security solutions, which allows them to blend in with normal activity, maintain a low footprint, and make detection much harder for defenders. By using these legitimate tools, adversaries can carry out a wide range of actions, such as moving laterally across networks, establishing C2 channels, or maintaining persistence, all without triggering any alerts.
Keyloggers: A Persistent Threat Nowadays, virtually all digital services rely on logins and authentication, from email inboxes to help desks. These involve login credentials to prove identity, typically at least a username and a password. Initially, this information is confidential from a potential attacker. While a username can be relatively easy to guess in a … Continue reading Security’s Blind Spot: Physical Keyloggers That Bypass Antivirus Entirely
