Discussions, questions and news about SIEM from cybersecurity professionals on Cyberr.
0 members · 157 posts
Jordan Hadley — Senior Security Consultant
Has successfully verified SentinelOne Sales Engineer Expert (SentinelOne), SentinelOne Paladin Certified (SentinelOne) and 1 more certification
· 0 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
What happens when the internet-facing part of your business becomes the target of a traffic tsunami? DDoS attacks are becoming increasingly difficult to ignore. Cloudflare reported a 519% increase in hyper-volumetric DDoS attacks during the first half of 2026, with attacks incre…
· 4 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your EDR says “no malware detected.” Should you be relieved? Not necessarily. CrowdStrike's 2026 Global Threat Report found that 82% of detections in 2025 were malware-free. It also reported an 89% increase in attacks by AI-enabled adversaries. This tells us something important…
· 2 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
You can secure your company perfectly—and still be compromised through someone you trusted. That's the uncomfortable reality of modern supply-chain attacks. Your organization may have: MFA. EDR. Firewalls. SIEM. Strong passwords. Security policies. But what happens when a truste…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
[PERFORMANCE BENCHMARK] ETB PayShield Achieves 4,980.54 TPS Under High-Concurrency Load Matrix A core critique of deterministic pre-execution validation gates is that out-of-band input inspection introduces unacceptable processing overhead to high-throughput financial environmen…
· 5 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
What happens when vulnerabilities are discovered faster than organizations can patch them? We may be approaching that reality. Google Threat Intelligence reports that monthly vulnerability disclosures more than doubled in 2026—from 5,045 in January to 10,477 in July, reaching 10…
· 1 reactions · 0 comments
Alborz Nazari — Cybersecurity Engineer | Technical Writer
Let's assume a hardening chain of thought. Suppose that you got hired to harden a business that appeals to two distinct types of clients: public and private. Public clients' concerns include GDPR and PII protection, while private clients' concerns include legal disclosures, conf…
· 9 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Under the Hood: Real-Time STIX 2.1 Telemetry of a Blocked PHP2Shell Cascade When an automated exploit cascade hits your environment, you don’t have time to wait for a database write or an application-layer parsing loop. True security requires capturing, validating, and stripping…
· 4 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your security logs may already contain the evidence of a breach—you just haven't connected the dots. That's one of the hardest problems in cybersecurity. An attacker doesn't always trigger a dramatic alert. Sometimes it's: A login at an unusual time. A new MFA device. A privileg…
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Moving Validation Before Allocation: Securing Agentic Commerce at Layer Zero As automated transaction networks and autonomous AI agents take over global checkout paths, application security interfaces are facing a catastrophic engineering gap: traditional Web Application Firewal…
· 2 reactions · 0 comments
REEMA Nasser ALMUTAIRI — Cybersecurity Engineer
For those working in SOC L2 what are you guys seeing lately in real-world investigations? I’m curious about what’s actually changing in the way you investigate alerts, hunt for threats, and build detection rules. Any new techniques, tools, or approaches that have made a real dif…
· 5 reactions · 4 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
AI didn’t change what attackers want. It changed what it costs them to get it. People ask me whether AI is good or bad for security. I think that’s the wrong question. The better question is: who gets more out of each dollar spent on AI? Right now, the answer depends on where yo…
· 10 reactions · 5 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
🔐 Splunk SIEM INTEGRATION Generate → Collect → Forward → Parse → Index → Normalize → Search → Alert ⚠️ Collection fails = Splunk is blind. ⚠️ Forwarding/parsing fails = Detection can fail. 🏗️ SPLUNK CORE 🔹 UF → Endpoint log collection 🔹 HF → Optional parsing/routing 🔹 Index…
· 4 reactions · 0 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
https://youtu.be/1Z0vLZ7PnSA?si=20iKqu8QPtsYY87F Is SOC really the right starting point for anyone looking to build a career in Cybersecurity? In this episode of Open Discussion, we take a practical look at the SOC and Blue Team career path and discuss what a SOC Analyst actuall…
· 2 reactions · 15 comments
samuel watua Soita — Full Stack Software Engineer
The attacker doesn't have to be smarter than your security team. They just need to be quieter. Most organizations invest heavily in prevention. Firewalls. EDR. MFA. SIEM. WAF. IDS/IPS. And rightly so. But security controls don't eliminate risk. They create signals. The real ques…
· 3 reactions · 1 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
When Machines Fight Machines: AI Is Reshaping Both Sides of Cybersecurity The next phase of cybersecurity may involve far fewer people at the keyboard. Security researchers increasingly expect future digital conflicts to be fought mainly between autonomous AI systems: one set bu…
· 4 reactions · 2 comments
🚨 Something is taking shape behind the scenes… I’ve been quietly working on a my own independent cybersecurity project that’s evolving well beyond what I originally imagined. It started with a simple question: What if I could build my own environment to observe, investigate and…
· 4 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
1,416 Reasons the Patching Paradigm Just Died. To everyone triaging the massive Ivanti Connect Secure bypass (CVE-2026-104935) on my trending thread: Look at your calendar. It gets worse. On October 13, the industry quietly hit a tragic milestone. Microsoft dropped a historic 1,…
· 4 reactions · 0 comments
Samantha Swift — Product, Go-to-Market & Marketing Leadership
ASOS has confirmed a data breach after customers received an unauthorised notification through its own app claiming attackers had compromised company data. The incident involves third-party platforms ASOS uses to communicate with customers. The retailer says names and contact de…
· 8 reactions · 1 comments
samuel watua Soita — Full Stack Software Engineer
Your firewall can be working perfectly while an attacker is already inside. That sounds contradictory. It isn't. Modern attacks don't always look like attacks. A compromised employee account can authenticate normally. A stolen session token can bypass the login process entirely.…
· 2 reactions · 1 comments
Schomer — Principal Security Solutions Architect & Founder
THE DOOM LOOP OF DOWNSTREAM DETECTION: WHY REACTIVE SECURITY IS COLLAPSING The industry is currently drowning in an administrative "patch tsunami." Frontier AI is being weaponized by threat actors to generate thousands of polymorphic zero‑click variants every single cycle, and s…
· 4 reactions · 1 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
🚨 𝟮𝟬 𝗦𝗢𝗖 𝗧𝗼𝗼𝗹𝘀 𝗧𝗼 𝗚𝗼 𝗙𝗿𝗼𝗺 𝗕𝗲𝗴𝗶𝗻𝗻𝗲𝗿 → 𝗘𝘅𝗽𝗲𝗿𝘁 🚀 If you're serious about becoming a SOC Analyst, Blue Teamer, or Threat Hunter. Learning the right tools matters more than learning random theory. These tools are used for: ✅ SIEM & Log Analysis ✅ Thr…
· 3 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
The most dangerous alert in a SOC might be the one that looks completely normal. An employee logs in. A legitimate PowerShell command executes. A service account accesses a database. An administrator creates a new API token. Nothing immediately looks malicious. But cybersecurity…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
ENTERPRISE ADVISORY NOTE: The Hierarchical Inversion of Risk ManagementTitle: Beyond CWE-1000: Why Edge-Detection Workflows Fail Against Pre-System Layer-Zero GatesAuthor: Justin Schomer, Founder & Lead Architect | Eternal BoundariesTarget Audience: Enterprise CISOs, AppSec Dire…
· 3 reactions · 5 comments
samuel watua Soita — Full Stack Software Engineer
Cybersecurity is changing — and the attacker doesn't always need malware anymore. One of the most important shifts in the current threat landscape is the move from “break in” to “log in.” Attackers increasingly target: → Stolen credentials → Session tokens and cookies → MFA enro…
· 3 reactions · 0 comments