Security Blogs
Security
3 Min Read
Announcing the availability of Cisco Talos Incident Response services to Splunk customers.
Latest Articles
Don’t Get a PaperCut: Analyzing CVE-2023-27350
The Splunk Threat Research team shares insights on the CVE-2023-27350 vulnerability, proof of concept scripts, setting up Splunk logging, and detecting adversaries for secure printing.
Splunk SOAR Playbook of the Month: Tackling Phishing Attempts with Identifier Reputation Analysis
Learn how you can use Splunk's identifier reputation analysis playbooks to implement a workflow that will help your team automate the alert and quarantine processes for potential threats based on key identifiers.
Do Not Cross The 'RedLine' Stealer: Detections and Analysis
The Splunk Threat Research Team provides a deep dive analysis of the RedLine Stealer threat and shares valuable insights to help enable blue teamers to defend against and detect this malware variant.
Staff Picks for Splunk Security Reading May 2023
Welcome to the Splunk staff picks, featuring a curated list of presentations, whitepapers, and customer case studies that our Splunk security experts feel are worth a read.
OCSF Goes Into High Gear with Amazon Security Lake Launch and New OCSF Release Candidate
Splunk's Paul Agbabian shares two new major OCSF developments – the general availability of Amazon Security Lake and Splunk Add-On for AWS v.7.0, and Release Candidate 3 launching for public review.
Your Roadmap to Success with Risk-Based Alerting
Splunker Haylee Mills dives deeper into the four levels of the Splunk Risk-Based Alerting journey.
Trust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates
In this blog post, we dive into our recent research project, in which the Splunk SURGe team analyzed more than five billion TLS certificates to find out if the CAs we rely on are really worthy of our trust.
Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework
Welcome to the third entry in our introduction to the PEAK Threat Hunting Framework! Taking our detective theme to the next level, imagine a tough case where you need to call in a specialized investigator. For these unique cases, we can use algorithmically-driven approaches called Model-Assisted Threat Hunting (M-ATH).
Splunk Field Hashing & Masking Capabilities for Compliance
Satisfy internal and external compliance requirements using Splunk standard components.
Security Content from the Splunk Threat Research Team
The blog explains how STRT develops Splunk Security Content, aiding detection engineering and threat research teams to efficiently detect and respond to potential threats, using ESCU App amidst growing security incidents and system complexity.
Hypothesis-Driven Hunting with the PEAK Framework
Details on hypothesis-driven threat hunting with the PEAK framework.
Planning for Success with Risk-Based Alerting
In our last RBA blog post, we talked about some of the problems RBA can help solve. In this post, we explain the methodology we use with Splunk customers as their security teams start working with RBA.
Machine Learning in Security: Detect Suspicious TXT Records Using Deep Learning
The Splunk Machine Learning for Security (SMLS) team introduces a new detection to detect DNS Tunneling using DNS TXT payloads.
7 questions all CxOs should ask to increase cyber resilience before buying more software
Here are 7 questions you should always ask to help your organisation to make the best possible purchase and increase its cyber resilience at the same time.
Paws in the Pickle Jar: Risk & Vulnerability in the Model-sharing Ecosystem
As AI / Machine Learning (ML) systems now support millions of daily users, has our understanding of the relevant security risks kept pace with this wild rate of adoption?
Staff Picks for Splunk Security Reading April 2023
Hello, everyone! Welcome to the Splunk staff picks blog. Each month, Splunk security experts curate a list of presentations, whitepapers, and customer case studies that we feel are worth a read. We hope you enjoy.
Open Cybersecurity Schema Framework (OCSF) Gains Momentum
Splunk's Paul Agbabian shares a look back at the key developments and enhancements to the Open Cybersecurity Schema Framework (OCSF) since its launch in August 2022.
Threat Update: AwfulShred Script Wiper
The Splunk Threat Research Team shares their findings on the Linux-targeted destructive payload AwfulShred.
Subscribe to our blog
Get the latest articles from Splunk straight to your inbox.
Connect with Splunk on X
Follow @Splunk
Connect with Splunk on Instagram
Follow @Splunk
