Operations | Monitoring | ITSM | DevOps | Cloud

Nearly all security experts agree that event log data gives you visibility into and documentation over threats facing your environment. Even knowing this, many security professionals don’t have the time to collect, manage, and correlate log data because they don’t have the right solution. The key to security log management is to collect the correct data so your security team can get better alerts to detect, investigate, and respond to threats faster.

Observability is the key to solving problems quickly, and organizations use many tools to try to increase visibility in their environments so they don’t miss anything. Typical sources of observability include metrics, logs, and traces. The foundation of monitoring, metrics are predictable counts or measurements that are aggregated over a specific period of time. Timestamped records of discrete events that can store outputs from applications, systems, and services.

When it comes to malware attacks, one of the more common techniques is “living off the land” (LOtL). Utilizing standard tools or features that already exist in the target environment allows these attacks to blend into the environment and avoid detection. While these techniques can appear normal in isolation, they start looking suspicious when observed in the parent-child context. This is where the ProblemChild framework can help.

Uptime.com is GDPR compliant as of 2021. Becoming GDPR compliant required an organization-wide dedication to maintaining privacy and security to meet these new standards. These updates impact everything from working with support to our team logging in for work each day. Today, we’ll tackle what GDPR means to our organization, how these changes affect your usage of Uptime.com, and what we’re doing now (and into the future) to protect your personal data.

What an exciting month, with PromCon Online 2021 and KubeCon EU 2021! These presentations were full of feature announcements, live demos, and inspiring use cases. Here are our highlights of the PromCon Online 2021!

The ransomware campaign against the Colonial Pipeline highlights the dangers and real-life consequences of cyberattacks. If you want to understand how to use Splunk to find activity related to the DarkSide Ransomware, we highly recommend you first read “The DarkSide of the Ransomware Pipeline” from Splunk’s Security Strategist team. In short, according to the FBI, the actors behind this campaign are part of the “DarkSide” group.