SIEM
17 articles
strategy
SIEM
What events help an MDR service detect attacks?
What information does an MDR service need to protect a company from complex targeted attacks?
Hardware for SIEM systems
How to estimate what and how much hardware will be needed for a SIEM system to assess the costs before deployment?
Malicious modules and the LSA process
Detection of tactics involving malicious DLL registration and other Kaspersky SIEM improvements in Q4 2024.
Kaspersky SIEM: early threat detection and other improvements
Rules for detecting atypical behavior in container infrastructure at the data collection stage, and other updates to our SIEM system.
Expanding the functionality of our SIEM system
Detection of techniques for disabling or modifying a local firewall, and other enhancements to the Kaspersky Unified Monitoring and Analysis Platform.
What SIEM is and how it protects medium-sized businesses
Medium-sized businesses increasingly find themselves on the receiving end of targeted attacks. What tools does one need when basic security proves inadequate?
The evolution of the SIEM system
We’re expanding the capabilities of the Kaspersky Unified Monitoring and Analysis SIEM system by adding new normalizers and correlation rules.
How to increase the efficiency of SIEM
What’s new in Kaspersky Unified Monitoring and Analysis Platform 3.0.3.
Top 10 cyberattack techniques used against organizations
What are the most common MITRE ATT&CK techniques encountered in real-world incidents — and how to neutralize them? We investigate using statistics from Incident Response and MDR services!
How to prepare for Living Off the Land (LotL) attacks
To go undetected, attackers can operate in your network without any malware at all. How to detect them and prevent damage?
The top-10 mistakes made when configuring enterprise IT systems
Mistakes commonly found in almost every large organization. What should the inforsec team look out for, and what protective measures should they take?
How to lessen the workload on the CISO and their team
What tasks needlessly overload infosec experts, and how to break the curse of overtime.
APTTriangleDB: the spyware implant of Operation Triangulation
APT operators are showing increasing interest in mobile devices. Our experts have studied one of their tools.
Evaluating threat intelligence sources
To protect themselves, businesses need to take a proactive approach, constantly adapting their security controls to the ever-changing threat environment.
securityTeach your SIEM to detect more threats
Using the Machine-Readable Threat Intelligence Platform fits well with our general position on security: multilayeredness everywhere.