We all know David Bianco Pyramid of Pain, a classic from 2013. The focus of this famous visual is on indicators that you “latch onto” in your detection activities. This post will reveal a related mystery connected to SIEM…

Beware: Clown-grade SOCs Still Abound

I have written a lot about building and running Security Operations Centers (SOCs) in the…

Living with Multiple SIEMs

In a perfect world, nobody will run two SIEM tools in the same environment. Because if you dream of a single…

So, Why Did I Join Chronicle Security?

As I mentioned a few days ago, I recently joined Chronicle, the Alphabet security company…

Let’s start from the boring subject of log retention … and then evolve to some exciting topics like perhaps hunting (promise!). Our old friend PCI DSS reminds us that we need to keep security logs for one year. Now, the same friend is mum about using…

About Threat Intel Retro-Matching

Please believe me that I was meaning to write this post for my old blog, somewhere in March. It is a…

Let me ask you this: do smaller businesses (say, SMBs) get more security vendor lies than large enterprises? My past analyst experience certainly seems to suggest so. When I was an analyst, the most…

So years ago I was a big fan of doing (and reading) security predictions and did them pretty religiously every year (for example 2007, 2008, 2011). Apart from most other “predictioneers”, I’d actually check how I did next year (2007, 2008, 2010 checked). BTW, in…