Search

Timeplus
Timeplus @timeplusdata ·
The reality of most #SOC pipelines: #Detection happens after ingestion & storage. By the time you query logs in your #SIEM, the attack is already underway. 💡 In our CEO Ting Wang's latest blog, we explore why you need a #realtime context & control layer: timeplus.com/post/from-logs…
From Logs to Context: Why Your SOC Detection Needs a Real-Time Context and Control Layer

In the traditional pipeline, every step after ingestion is retroactive. The SIEM owns the data, and all analysis depends on querying stored records. Alternatively, the new architecture inserts a...

From timeplus.com
12
Borne Systems
Borne Systems @BorneSystems ·
Replying to @BorneSystems
For detection, monitor logs for suspicious sudo command executions. Use Windows Event ID 4672 or relevant Linux log files. Set up alerts in your SIEM (e.g., Splunk) for abnormal patterns. #Detection
1
11
Vali Cyber
Vali Cyber @vali_cyber ·
#Detection helps you respond. #Prevention helps you avoid impact. When time and budget get tight, teams are forced to prioritize. Poll: Which capability do you find most valuable in the event of an #cyberattack?
Block actions at runtime 0.0%
Detecting and triaging 0.0%
Containing systems fast 0.0%
Restoring from backups 0.0%
0 votes · 2 days left
12
Borne Systems
Borne Systems @BorneSystems ·
Replying to @BorneSystems
Set up detection rules in your SIEM (like Wazuh) to monitor for unusual access patterns. Windows Event ID 4624 (successful login) can help you identify potential breaches tied to this CVE. #Detection #SIEM
1
21