News

Avoiding Silent Automation
Avoiding Silent Automation
See how you can work with Python's flexible logging system to create an overall monitoring system that includes the messages from your network devices, your infrastructure applications, and your automation scripts.
May 25, 2021
The Power of Logging in Incident Response
The Power of Logging in Incident Response
A deep dive into logging as an often-overlooked but powerful tool for incident detection and response “Lack of instrumentation or insufficient logging” is often a phrase used on incident response...
Feb. 28, 2018
Using a “Playbook” Model to Organize Your Information Security Monitoring Strategy
Using a “Playbook” Model to Organize Your Information Security Monitoring Strategy
CSIRT, I have a project for you. We have a big network and we're definitely getting hacked constantly. Your group needs to develop and implement security
Nov. 1, 2013
To SIEM or Not to SIEM? Part II
To SIEM or Not to SIEM? Part II
The Great Correlate Debate SIEMs have been pitched in the past as "correlation engines" and their special algorithms can take in volumes of logs and filter everything down to just...
Oct. 24, 2013
To SIEM or Not to SIEM? Part I
To SIEM or Not to SIEM? Part I
Security information and event management systems (SIEM, or sometimes SEIM) are intended to be the glue between an organization's various security tools. Security and other event log sources export their...
Oct. 22, 2013
Getting a Handle on Your Data
Getting a Handle on Your Data
When your incident response team gets access to a new log data source, chances are that the events may not only contain an entirely different type of
Oct. 18, 2013
Making Boring Logs Interesting
Making Boring Logs Interesting
This post centers around the practice of logging data - data from applications, devices, and networks - and how the components of data logging can help in the identification and remediation of network events.
Oct. 9, 2013
Big Security—Mining Mountains of Log Data to Find Bad Stuff
Big Security—Mining Mountains of Log Data to Find Bad Stuff
Your network, servers, and a horde of laptops have been hacked. You might suspect it, or you might think it's not possible, but it's happened already.
Oct. 3, 2013
Security Logging in an Enterprise, Part 2 of 2
Security Logging in an Enterprise, Part 2 of 2
We first logged IDS, some syslog from some UNIX hosts, and firewall logs (circa 1999). We went from there to dropping firewall logging as it introduced some overhead and we didn’t have any really good uses for it. (We still don’t.) Where did we go next?
May 6, 2013