De acordo com uma pesquisa internacional, a participação de mercado de veículos sem motorista e altamente automatizados está crescendo rapidamente. Os analistas estimam que os próximos 10 a 15 anos marcarão uma grande mudança de projetos-piloto para a adoção em massa do transporte autônomo. O impulso está crescendo em todo o mundo: a Europa já implementou mais de 35 projetos-piloto de veículos autônomos, enquanto os EUA e a China registram mais de 450 mil e 250 mil viagens comerciais respectivamente por semana. No entanto, o relatório observa vários obstáculos que retardam esse progresso. Uma dessas barreiras é a incerteza em torno da responsabilidade legal e da regulamentação, inclusive nas áreas de segurança e proteção. A alocação de responsabilidade entre fornecedores, fabricantes, clientes corporativos e usuários finais continua sendo um ponto importante de discussão.

Cada player do mercado vê a questão de garantir a segurança de veículos autônomos de forma diferente. Para as montadoras, significa assumir a responsabilidade por como um veículo se comporta na estrada e por verificar seus fornecedores. Para os próprios fornecedores, significa projetar mecanismos de segurança diretamente na sua arquitetura de solução desde o primeiro dia e garantir sua adequação. Para as seguradoras, isso significa revisar completamente seus modelos de risco para considerar não apenas acidentes, mas também possíveis falhas de software e ataques cibernéticos. Em última instância, todos concordam em um ponto fundamental: a segurança deve ser um recurso fundamental do veículo, não um complemento opcional.

Como garantir a segurança veicular na era moderna

Durante anos, as discussões sobre segurança automotiva se concentraram estritamente na segurança funcional. Em outras palavras, o objetivo era garantir que os sistemas veiculares funcionassem corretamente e que os riscos associados a possíveis falhas fossem totalmente mitigados ou reduzidos a um nível aceitável. A norma ISO 26262 “Veículos rodoviários — Segurança funcional” ajuda a enfrentar esse desafio e serve como parâmetro para a indústria automotiva.

No entanto, o veículo conectado moderno é um sistema ciberfísico complexo que armazena e processa grandes quantidades de dados, incluindo informações confidenciais. Como consequência, isso leva ao surgimento de novas necessidades fundamentais. Para traçar uma analogia com dois níveis da hierarquia de necessidades de Maslow, um veículo moderno deve:

• Satisfazer a necessidade de “estima”. Isso significa que o sistema deve armazenar de forma segura e confiável os dados do perfil do usuário, como credenciais da conta, dados biométricos, detalhes de pagamento e muito mais.
• Satisfazer as necessidades cognitivas do usuário, o que significa que o sistema deve fornecer conectividade segura com a internet, transmitir a telemetria do veículo e enviar lembretes para manutenção programada ou de emergência.

Tudo isso significa equipar os veículos com uma ampla gama de interfaces (telemática, Bluetooth, Wi-Fi, conectividade celular, atualizações OTA e V2X), o que abre as portas para ataques remotos. Portanto, é necessário garantir não apenas a segurança funcional, mas também a segurança das informações no veículo. Como resultado, normas especializadas do setor que ajudam a enfrentar os desafios de segurança cibernética automotiva surgiram na maioria dos países. As principais normas internacionais são ISO/SAE 21434 “Veículos rodoviários — Engenharia de segurança cibernética”, UNECE R155 e UNECE R156.

As regulamentações na China também estão evoluindo. Em 2024, o país publicou a norma nacional GB 44495-2024 “Requisitos Técnicos para Segurança Cibernética de Veículos”, que entrou em vigor em 1º de janeiro de 2026. O documento introduz requisitos obrigatórios de segurança cibernética para veículos, incluindo proteção de comunicações, gerenciamento de eventos de segurança, monitoramento de ameaças e interação segura do veículo com a infraestrutura externa.

Compreender e aplicar essas normas está se tornando absolutamente crítico. A pesquisa mostra que os riscos de segurança cibernética estão aumentando diariamente e o impacto na segurança funcional pode eventualmente desencadear incidentes muito mais perigosos do que uma falha interna do sistema. O que acontece se um invasor obtiver acesso ao sistema de controle remoto de um caminhão autônomo ou conseguir atualizar uma unidade de controle eletrônico crítica durante uma sessão de diagnóstico não autorizada?

Um dos principais componentes para mitigar esses cenários é um gateway de segurança, que isola a arquitetura do veículo em diferentes domínios com base na criticidade, ao mesmo tempo em que fornece roteamento, filtragem e controle de tráfego seguros. Desenvolver esse tipo de solução de software é precisamente o foco de nossa equipe à medida que criamos o Kaspersky Automotive Secure Gateway com base em KasperskyOS.

Qual o diferencial do Kaspersky Automotive Secure Gateway?

O objetivo principal do Kaspersky Automotive Secure Gateway (KASG) é proteger o domínio CAN do veículo, pois o barramento CAN é usado para transmitir uma grande quantidade de comandos de controle críticos. Isso afeta quase 80% das unidades de controle eletrônico dentro do veículo, que lidam com o gerenciamento do motor, frenagem, eletrônica da carroceria e muito mais. Por isso, utilizamos a abordagem de Cibersegurança Protetiva, uma arquitetura unificada que considera os requisitos de segurança funcional e de segurança cibernética.

Por exemplo, os mecanismos padrão de Proteção de ponta a ponta (E2E) são normalmente usados para mitigar os riscos associados a mensagens CAN perdidas, fora de ordem ou corrompidas. No entanto, esses mecanismos não foram originalmente projetados para combater ciberataques direcionados. Se um invasor conseguir construir um quadro malicioso que esteja em conformidade com o formato E2E necessário, o sistema poderá aceitá-lo como válido.

Isso introduz um novo fator: é fundamental não apenas verificar se uma mensagem foi entregue sem erros, mas também garantir que foi realmente gerada por uma unidade de controle eletrônico (ECU) confiável e não foi alterada em trânsito. Isso é particularmente vital para transmitir comandos de controle, como aqueles enviados ao sistema de frenagem do veículo, ou para implementar sistemas de entrada sem chave (NFC).

Para enfrentar esse desafio, os mecanismos de Comunicação Segura A Bordo (SecOC) são integrados à arquitetura do veículo. Esses sistemas usam métodos criptográficos para verificar a autenticidade e a integridade da mensagem, protegendo o sistema contra ataques de spoofing e repetição de mensagens. O KASG implementa com sucesso esses mecanismos, que, além da verificação de mensagens, executam a função crucial de gerenciamento centralizado de chaves. Isso permite que as chaves de criptografia sejam distribuídas e atualizadas a partir de um único ponto dentro do veículo, reduzindo o custo e a carga de processamento nas ECUs envolvidas na troca de dados apoiada pelo SecOC.

IDS automotivo

No entanto, em sistemas complexos, não é mais suficiente aplicar mecanismos de segurança somente a mensagens individuais ou segmentos de rede separados. É essencial fornecer monitoramento e controle em todo o veículo, rastreando anomalias comportamentais, interações incomuns entre domínios e tentativas de adulteração não autorizadas. No domínio de TI, isso é conhecido como um Sistema de Detecção de Intrusão (IDS). Esses sistemas também foram adotados com sucesso pela indústria automotiva.

Ao mesmo tempo, é importante perceber que, para um veículo moderno, um IDS não é um único ponto mágico de coleta e análise de dados. O veículo requer um sistema de monitoramento distribuído. O monitoramento é realizado em vários níveis de arquitetura: dentro dos domínios, no nível do controlador individual e nos limites da rede.

O gateway de segurança se torna um ponto de monitoramento crítico porque toda a interação entre domínios passa por ele. Além disso, o gateway fornece visibilidade da troca de dados em diferentes segmentos da rede veicular. Sua missão é detectar desvios do comportamento normal e gerar eventos de segurança.

Quando se trata do monitoramento do domínio CAN implementado no KASG, o IDS observa os seguintes critérios para análise de tráfego:

• Alinhamento dos parâmetros da mensagem CAN (CAN ID, DLC) com suas descrições na especificação DBC.
• Frequência e periodicidade das mensagens CAN.
• Faixas permitidas para sinais CAN.

Na prática, no entanto, uma limitação importante fica clara: mesmo com um IDS integrado, é necessário mais contexto para determinar as características exatas de um ataque. Além disso, ao operar veículos altamente automatizados, onde o monitoramento de toda a frota é essencial, essa análise isolada torna-se inerentemente insuficiente.

Conectar um veículo a um SIEM

O monitoramento de múltiplos objetos, a correlação de dados e a análise de dados podem ser tratados externamente com eficiência, especificamente em sistemas SIEM (Gerenciamento de Eventos e Informações de Segurança), que são tradicionalmente usados em centros de operações de segurança cibernética corporativos e industriais. Portanto, utilizar um sistema SIEM em toda a frota é uma etapa lógica que torna possível:

• Coletar eventos de segurança de vários veículos.
• Correlacione eventos ao longo do tempo e entre contextos.
• Detecte ataques avançados e distribuídos.
• Fornecer auditoria e investigação de incidentes.
• Responda a incidentes individuais e gerencie os riscos cibernéticos em toda a frota.

Ao integrar com sistemas SIEM externos, várias tarefas críticas devem ser abordadas: garantir uma conexão segura, ajustar o processo de transmissão de eventos de segurança e estabelecer regras de linha de base para o processamento e a correlação de eventos. Estamos trabalhando ativamente em todos esses desafios usando nosso próprio sistema SIEM Kaspersky Unified Monitoring and Analysis Platform como plano-base.

Ainda há muitos desafios pela frente que precisam ser resolvidos. Este artigo abordou apenas uma fração das metodologias atualmente usadas no KASG para garantir a segurança e proteção veicular. No entanto, mesmo esta pequena seção demonstra que a segurança automotiva não pode ser alcançada resolvendo um único problema ou aplicando um único mecanismo. Alcançar a proteção eficaz requer uma abordagem que permita o desenvolvimento metódico da arquitetura, equilibrando diversos requisitos para a funcionalidade, segurança e confiabilidade veicular.

Enterprise adoption of Claude across teams, workflows, and business functions is happening at a pace unlike virtually any technology before it. While the innovation opportunity is obvious, so are many of the risks. From the exposure of sensitive data and secrets through shadow IT to new attack vectors like prompt injection, security teams need the visibility, governance, and response capabilities to ensure AI innovation is done safely and securely.

SentinelOne® helps organizations comprehensively secure Claude adoption by bringing AI usage directly into the security platforms teams already rely on. This helps protect the entire ecosystem from the underlying infrastructure to the application layer and end-user interactions. By bringing together SentinelOne and Claude, security teams can apply policies to user prompts, ingest Claude activity into the Singularity AI SIEM for investigation, and utilize frontier AI-powered services to identify real-world risks before attackers can exploit them.

Govern, Detect & Secure with SentinelOne’s Anthropic Compliance API Integrations

Security and compliance platforms utilize the Claude Compliance API to help organizations monitor AI activity within their existing tools. SentinelOne provides purpose-built Claude Compliance API integrations for its Prompt Security and Singularity AI SIEM offerings.

Prompt Security Integration

Scan AI prompts and responses against enterprise policies to flag violations without requiring a browser extension or endpoint agent. This agentless approach helps organizations extend their security coverage to unmanaged devices and external environments. Prompt Security enforces safe use by blocking high-risk prompts and preventing data leakage in real time. Additionally, the platform provides continuous risk assessment for agentic AI by securing Model Context Protocol (MCP) gateway connections between AI applications and known MCP servers.

Singularity AI SIEM Integration

Ingest audit and activity data directly from Claude rather than treating AI interactions as isolated events. With the integration, security operations center (SOC) teams can correlate Claude activity against existing security telemetry. This allows analysts to incorporate AI usage data into their broader security workflows and improve investigation, detection, and response across all their attack surfaces.

AI Visibility to AI-Ready Defense with Wayfinder Frontier AI Services

The partnership between SentinelOne and Anthropic extends beyond the Compliance API. SentinelOne has been a participating member in Anthropic’s Project Glasswing and has had early access to Anthropic’s most capable Mythos-class models. By continuously testing these models against real-world security workflows, SentinelOne helps ensure defenses keep pace with the modern adversary. Additionally, SentinelOne recently announced Wayfinder Frontier AI Services, a managed offering that pairs elite human security experts with frontier models, including Anthropic’s Claude Security.

Frontier AI is changing vulnerability discovery, giving both defenders and attackers the advantage of speed and scale. However, raw vulnerability counts rarely map cleanly to real-world risk, as many theoretical exposures are mitigated by existing architectural controls. Wayfinder Frontier AI Services evaluates findings against actual environmental context to deliver an exploitability-grounded prioritization. Instead of treating vulnerabilities in isolation, the service maps how exposures connect into end-to-end attack paths.

The Frontier AI models then provide targeted remediation guidance, including architectural changes or identity controls, designed to break the exploitation chain where it costs the adversary the most. With the service providing a continuous human-and-AI partnership across endpoint, cloud, identity, data, and AI attack surfaces, Frontier AI ensures that organizational security posture remains current as models and threats evolve.

Why SentinelOne is Built for the AI Security Era

SentinelOne operates from a clear conviction: A safer future for humanity and to give the advantage to those who secure our future. That conviction is what drives how SentinelOne approaches AI security — not as an isolated capability, but as part of the autonomous platform, expert services, and SOC workflows that defenders already use. SentinelOne has collaborated with frontier AI labs for years, including Anthropic, OpenAI, and Google DeepMind. These partnerships inform the capabilities embedded across the SentinelOne platform.

Operating at machine speed is necessary to counter modern threats, rather than relying strictly on manual triage. Over the past quarter, the SentinelOne Singularity Platform autonomously blocked novel zero-day and supply-chain attacks against widely used components, such as LiteLLM, Axios, and CPU-Z. Wayfinder Frontier AI Services takes this operational model further left in the security lifecycle to discover exposures before attackers can leverage them. This multi-model foundation reflects the understanding that no single AI model is the definitive answer for cybersecurity; the advantage belongs to defenders who can orchestrate the right intelligence and validate outputs with human expertise.

This is how SentinelOne enables business growth and innovation safely, giving security teams the ability to say yes to AI adoption while maintaining full control of the risk surface. Stronger protection with fewer incidents and less operational overhead.

Learn More

Ready to adopt Claude safely across your organization? Connect with SentinelOne to learn how Prompt Security, Singularity AI SIEM, and Wayfinder Frontier AI Services help security teams govern, monitor, and defend AI usage at enterprise scale.

• For Claude governance and monitoring: Contact SentinelOne to learn about the Anthropic Compliance API integrations for Prompt Security and Singularity AI SIEM.
• For proactive AI-driven exposure management: Learn more about Wayfinder Frontier AI Services.
• For broader AI security: Request a demo of SentinelOne’s AI security capabilities.

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.

Em termos simples, a lógica do sistema SIEM funciona assim: se o evento A ocorrer seguido do evento B, isso pode indicar um ataque, e um especialista em segurança da informação deverá ser notificado. Mas, no cenário atual, esse modelo simples está se mostrando cada vez menos eficaz. Recentemente, nossos especialistas analisaram um incidente de grande repercussão: invasores comprometeram a infraestrutura de atualização do popular software Notepad++ e distribuíram malware por meio do mecanismo de atualização. É simplesmente impossível ter regras previamente definidas e especificamente projetadas para neutralizar cenários desse tipo.

Os próprios ataques tornaram-se mais sofisticados: os invasores usam ferramentas legítimas, atacam a cadeia de suprimentos comprometendo softwares fora do perímetro corporativo, estendem seus cenários ao longo do tempo e disfarçam suas ações como atividades normais. Em outras palavras, eles não “invadem” a infraestrutura; na maioria das vezes, eles fazem login e usam software legítimo. Como resultado, as regras fixas clássicas do passado não são acionadas ou geram muitos alertas falsos. Foi isso que levou à mudança para cenários de correlação mais flexíveis.

Conteúdo SIEM atualizado dinamicamente

Atualmente, o conteúdo de correlação não é mais um conjunto estático de regras, mas sim um processo: ele evolui e se adapta constantemente às ameaças atuais. Somente em 2025, lançamos 55 atualizações de pacotes de regras para diferentes versões e idiomas do nosso sistema Kaspersky SIEM. Em apenas um ano, adicionamos 10 novos pacotes de regras, além de 250 regras de detecção e diversas melhorias no conteúdo existente. Neste ano, já adicionamos 43 novas regras e refinamos outras 63. No total, isso equivale a mais de 850 regras que abrangem uma parte significativa da estrutura MITRE ATT&CK.

As regras do Kaspersky SIEM são desenvolvidas com base nos insights de nossos especialistas, que analisam ataques recentes no mundo real, principalmente a partir das descobertas do nosso serviço de detecção e resposta gerenciada (MDR) e das nossas pesquisas sobre ameaças. Como resultado, nossas regras abrangem cenários (do reconhecimento à escalação de privilégios) que envolvem as abordagens mais recentes utilizadas pelos invasores. Por exemplo, detectamos o uso de novas técnicas de ataque, como a campanha ToolShell.

Além das atualizações programadas, a equipe também lança regularmente o chamado conteúdo emergencial: conjuntos de regras voltados à resposta rápida a técnicas de ataque novas e inesperadas. Em fevereiro, por exemplo, regras de detecção foram lançadas para contornar a autenticação em produtos Fortinet por meio do mecanismo de SSO: os invasores usaram solicitações SAML especialmente elaboradas para obter acesso a sistemas sem credenciais.

De eventos a cadeias de ataque

Além disso, as regras SIEM modernas não descrevem mais eventos individuais, mas sequências de ações. Os cenários são estruturados em torno das etapas de um ataque: desde o acesso inicial até a escalação de privilégios e a persistência. A eficácia do Kaspersky SIEM é ampliada por meio da integração com o Kaspersky EDR e de conjuntos de regras dedicados ao Active Directory, que implementam dezenas de cenários de detecção de ataques em diferentes estágios. Essa abordagem nos permite ver não apenas sinais individuais, mas o quadro completo.

Integração e visibilidade interna

Outra maneira de melhorar a eficácia de um sistema SIEM é expandir as fontes de dados. Um SIEM clássico agrega eventos de diferentes níveis da infraestrutura: desde logs até telemetria de endpoints e sistemas internos. Além disso, nosso sistema SIEM inclui conjuntos especializados de regras para nossas outras soluções (Kaspersky Security Center, Kaspersky Security for Mail Groups, plataforma Kaspersky Anti Targeted Attack), que permitem o monitoramento de ações de administradores, autenticação e status do serviço. Como resultado, o sistema se torna uma ferramenta não somente para detectar ataques, mas também para monitorar a atividade interna.

No geral, o SIEM deixou de ser apenas um conjunto de regras e evoluiu para um sistema de detecção continuamente atualizado. A eficácia é determinada não pela quantidade de detecções, mas sim pela relevância delas, pela coerência e pela precisão com que refletem as ações reais dos invasores. Acompanhe as novidades sobre nossa solução Kaspersky Unified Monitoring and Analysis Platform (SIEM) na página oficial do produto.

In the past week, the global cyber threat landscape has once again demonstrated how rapidly attackers are evolving shifting from isolated intrusions to coordinated, multi-stage campaigns targeting identities, supply chains, and service providers. From large-scale identity data exposure to sophisticated token abuse and ransomware-driven disruptions, these incidents highlight a critical reality: attackers are increasingly exploiting

The post Global Cyber Threat Brief: Identity Breaches, Supply Chain Attacks, and the Rise of Organized Cybercrime appeared first on Seceon Inc.

The post Global Cyber Threat Brief: Identity Breaches, Supply Chain Attacks, and the Rise of Organized Cybercrime appeared first on Security Boulevard.

In today’s cyber threat landscape, attacks are no longer always loud or immediate. Many of the most damaging incidents begin quietly hidden within normal network activity, disguised as legitimate traffic, and evolving over time into full-scale compromises. Modern security requires more than just detection; it requires context, behavioral intelligence, and early intervention. This article highlights

The post Invisible Threats Within: Detecting Botnet Activity and Data Exfiltration Before It’s Too Late appeared first on Seceon Inc.

The post Invisible Threats Within: Detecting Botnet Activity and Data Exfiltration Before It’s Too Late appeared first on Security Boulevard.

The Problem: Achieving Threat Detections at Scale  

At SOC Prime, we have spent over a decade making detection engineering easier for organizations of every size. Each year, as threats multiply and environments grow more complex, the traditional approach puts SOC Managers in an impossible position — responsible for coverage they cannot achieve with the tools and team they have. DetectFlow offers a path to deploying detections at scale without the engineering overhead. Here is what it solves:

• Your team is drowning in noise, not finding threats: False positives overwhelm analysts and real signals get missed. Alert fatigue isn’t a people problem, it’s a systems problem
• Your detection coverage has hard limits you can’t engineer around: Running under 512 rules means your team has blind spots across the MITRE ATT&CK matrix that no amount of headcount can close
• By the time your team sees a threat, the attacker has already moved: Batch processing creates detection delays measured in minutes to hours, turning a containable incident into a breach
• Your SIEM budget is consumed by data you never needed: Forced ingestion of raw logs at terabyte scale drives storage costs that are impossible to justify to leadership

DetectFlow Applied: Cut Costs and add Speed

DetectFlow fundamentally changes the economics and speed of threat detection. Rather than ingesting raw chaos and sorting it out later, DetectFlow:

• compresses terabytes of raw log data into gigabytes of clean, labeled events (instantly, before anything touches your SIEM). 
• detection happens in-flight, at wire speed, applying 50,000+ in real time and driving mean time to detect down to 0.005–0.01 seconds
• the entire data pipeline is governed and filtered before ingestion, so your SIEM only receives normalized, tagged, and pre-validated events resulting in dramatic optimization of your SIEM spend: you’re paying to store and analyze signal, not noise.

The Endgame: Attack Chains That Tell the Full Story

Where DetectFlow truly separates itself is in how it surfaces what matters. Instead of handing analysts thousands of disjointed, low-context alerts to manually correlate, DetectFlow: 

• collapses that noise into a prioritized queue of high-probability Attack Chains, complete with AI-generated executive summaries that condense gigabytes of adversary activity into a clear brief. 
• Threat inference happens in real time, automatically correlating activity across different vectors and hostnames without requiring any manual investigation. 
• The output isn’t a list of alerts: it’s a decision. Any analyst, regardless of experience level, can immediately understand the full scope of a breach and move directly to remediation.

 To learn more about DetectFlow head to our overview page.

The post DetectFlow: Deploying Detections at Scale Without the Engineering Overhead appeared first on SOC Prime.

When More Tools Create More Problems For years, organizations have approached cybersecurity with a simple mindset-add more tools to strengthen defenses. Firewalls, endpoint solutions, intrusion detection systems, and monitoring platforms have all been layered together to create what appears to be a comprehensive security posture. Yet, despite this growing investment, security outcomes have not improved

The post Why Traditional Security Tools Fail-and How Unified AI Platforms Solve the Problem appeared first on Seceon Inc.

The post Why Traditional Security Tools Fail-and How Unified AI Platforms Solve the Problem appeared first on Security Boulevard.

63% of SIEM alerts go uninvestigated every day. Learn the five structural root causes of alert fatigue and how autonomous investigation covers 100% of alerts in under 2 minutes — without replacing your SIEM.

The post SIEM Alert Fatigue Has Five Root Causes. Tuning Fixes Zero of Them. appeared first on D3 Security.

The post SIEM Alert Fatigue Has Five Root Causes. Tuning Fixes Zero of Them. appeared first on Security Boulevard.

Analysts take 56 min per alert. 40% of alerts go uninvestigated. The problem isn't SIEM — it's the investigation layer that was never built.

The post Your SIEM Isn’t Broken. Your Investigation Layer Is Missing. appeared first on D3 Security.

The post Your SIEM Isn’t Broken. Your Investigation Layer Is Missing. appeared first on Security Boulevard.

With 52% of U.S. employers adopting hybrid models, traditional perimeters are failing. Discover how to build a robust hybrid work security architecture using Secure SD-WAN, SASE, Zero Trust Network Access (ZTNA), and automated threat detection (SIEM/SOAR) to protect a dispersed workforce in 2026.

The post Security Architecture for Hybrid Work: Enterprise Guide  appeared first on Security Boulevard.

AI is transforming the SOC, but without explainability analysts can’t trust it. Why transparency is becoming a critical security control.

The post AI in the SOC: Why Explainability is the New Security Control appeared first on Security Boulevard.

In the world of cybersecurity, a single data point is rarely the whole story. Modern attackers don’t just knock on the front door; they probe your APIs, flood your network with "noise" to distract your team, and attempt to slide through applications and servers using stolen credentials.

To stop these multi-vector attacks, you need the full picture. By using Cloudflare Log Explorer to conduct security forensics, you get 360-degree visibility through the integration of 14 new datasets, covering the full surface of Cloudflare’s Application Services and Cloudflare One product portfolios. By correlating telemetry from application-layer HTTP requests, network-layer DDoS and Firewall logs, and Zero Trust Access events, security analysts can significantly reduce Mean Time to Detect (MTTD) and effectively unmask sophisticated, multi-layered attacks.

Read on to learn more about how Log Explorer gives security teams the ultimate landscape for rapid, deep-dive forensics.

The flight recorder for your entire stack

The contemporary digital landscape requires deep, correlated telemetry to defend against adversaries using multiple attack vectors. Raw logs serve as the "flight recorder" for an application, capturing every single interaction, attack attempt, and performance bottleneck. And because Cloudflare sits at the edge, between your users and your servers, all of these events are logged before the requests even reach your infrastructure. 

Cloudflare Log Explorer centralizes these logs into a unified interface for rapid investigation.

Log Types Supported

Zone-Scoped Logs

Focus: Website traffic, security events, and edge performance.

Account-Scoped Logs

Focus: Internal security, Zero Trust, administrative changes, and network activity.

Log Explorer can identify malicious activity at every stage

Get granular application layer visibility with HTTP Requests, Firewall Events, and DNS logs to see exactly how traffic is hitting your public-facing properties. Track internal movement with Access Requests, Gateway logs, and Audit logs. If a credential is compromised, you’ll see where they went. Use Magic IDS and Network Analytics logs to spot volumetric attacks and "East-West" lateral movement within your private network.

Identify the reconnaissance

Attackers use scanners and other tools to look for entry points, hidden directories, or software vulnerabilities. To identify this, using Log Explorer, you can query http_requests for any EdgeResponseStatus codes of 401, 403, or 404 coming from a single IP, or requests to sensitive paths (e.g. /.env, /.git, /wp-admin). 

Additionally, magic_ids_detections logs can also be used to identify scanning at the network layer. These logs provide packet-level visibility into threats targeting your network. Unlike standard HTTP logs, these logs focus on signature-based detections at the network and transport layers (IP, TCP, UDP). Query to discover cases where a single SourceIP is triggering multiple unique detections across a wide range of DestinationPort values in a short timeframe. Magic IDS signatures can specifically flag activities like Nmap scans or SYN stealth scans.

Check for diversions

While the attacker is conducting reconnaissance, they may attempt to disguise this with a simultaneous network flood. Pivot to network_analytics_logs to see if a volumetric attack is being used as a smokescreen.

Identify the approach 

Once attackers identify a potential vulnerability, they begin to craft their weapon. The attacker sends malicious payloads (e.g. SQL injection or large/corrupt file uploads) to confirm the vulnerability. Review http_requests and/or fw_events to identify any Cloudflare detection tools that have triggered. Cloudflare logs security signals in these datasets to easily identify requests with malicious payloads using fields such as WAFAttackScore, WAFSQLiAttackScore, FraudAttack, ContentScanJobResults, and several more. Review our documentation to get a full understanding of these fields. The fw_events logs can be used to determine whether these requests made it past Cloudflare’s defenses by examining the action, source, and ruleID fields. Cloudflare’s managed rules by default blocks many of these payloads by default. Review Application Security Overview to know if your application is protected.

^{Showing the Managed rules Insight that displays on Security Overview if the current zone does not have Managed Rules enabled}

Audit the identity

Did that suspicious IP manage to log in? Use the ClientIP to search access_requests. If you see a "Decision: Allow" for a sensitive internal app, you know you have a compromised account.

Stop the leak (data exfiltration)

Attackers sometimes use DNS tunneling to bypass firewalls by encoding sensitive data (like passwords or SSH keys) into DNS queries. Instead of a normal request like google.com, the logs will show long, encoded strings. Look for an unusually high volume of queries for unique, long, and high-entropy subdomains by examining the fields: QueryName: Look for strings like h3ldo293js92.example.com, QueryType: Often uses TXT, CNAME, or NULL records to carry the payload, and ClientIP: Identify if a single internal host is generating thousands of these unique requests.

Additionally, attackers may attempt to leak sensitive data by hiding it within non-standard protocols or by using common protocols (like DNS or ICMP) in unusual ways to bypass standard firewalls. Discover this by querying the magic_ids_detections logs to look for signatures that flag protocol anomalies, such as "ICMP tunneling" or "DNS tunneling" detections in the SignatureMessage.

Whether you are investigating a zero-day vulnerability or tracking a sophisticated botnet, the data you need is now at your fingertips.

Correlate across datasets

Investigate malicious activity across multiple datasets by pivoting between multiple concurrent searches. With Log Explorer, you can now work with multiple queries simultaneously with the new Tabs feature. Switch between tabs to query different datasets or Pivot and adjust queries using filtering via your query results.

When you correlate data across multiple Cloudflare log sources, you can detect sophisticated multi-stage attacks that appear benign when viewed in isolation. This cross-dataset analysis allows you to see the full attack chain from reconnaissance to exfiltration.

Session hijacking (token theft)

Scenario: A user authenticates via Cloudflare Access, but their subsequent HTTP_request traffic looks like a bot.

Step 1: Identify high-risk sessions in http_requests.

Step 2: Copy the RayID and search access_requests to see which user account is associated with that suspicious bot activity.

Post-phishing C2 beaconing

Scenario: An employee clicked a link in a phishing email which resulted in compromising their workstation. This workstation sends a DNS query for a known malicious domain, then immediately triggers an IDS alert.

Step 1: Find phishing attacks by examining email_security_alerts for violations. 

Step 2: Use Access logs to correlate the user’s email (To) to their IP Address.

Step 3: Find internal IPs querying a specific malicious domain in gateway_dns logs.

Lateral movement (Access → network probing)

Scenario: A user logs in via Zero Trust and then tries to scan the internal network.

Step 1: Find successful logins from unexpected locations in access_requests.

Step 2: Check if that IPAddress is triggering network-level signatures in magic_ids_detections.

Opening doors for more data 

From the beginning, Log Explorer was designed with extensibility in mind. Every dataset schema is defined using JSON Schema, a widely-adopted standard for describing the structure and types of JSON data. This design decision has enabled us to easily expand beyond HTTP Requests and Firewall Events to the full breadth of Cloudflare's telemetry. The same schema-driven approach that powered our initial datasets scaled naturally to accommodate Zero Trust logs, network analytics, email security alerts, and everything in between.

More importantly, this standardization opens the door to ingesting data beyond Cloudflare's native telemetry. Because our ingestion pipeline is schema-driven rather than hard-coded, we're positioned to accept any structured data that can be expressed in JSON format. For security teams managing hybrid environments, this means Log Explorer could eventually serve as a single pane of glass, correlating Cloudflare's edge telemetry with logs from third-party sources, all queryable through the same SQL interface. While today's release focuses on completing coverage of Cloudflare's product portfolio, the architectural groundwork is laid for a future where customers can bring their own data sources with custom schemas.

Faster data, faster response: architectural upgrades

To investigate a multi-vector attack effectively, timing is everything. A delay of even a few minutes in the log availability can be the difference between proactive defense and reactive damage control.

That is why we have optimized our ingestion for better speed and resilience. By increasing concurrency in one part of our ingestion path, we have eliminated bottlenecks that could cause “noisy neighbor” issues, ensuring that one client’s data surge doesn’t slow down another’s visibility. This architectural work has reduced our P99 ingestion latency by approximately 55%, and our P50 by 25%, cutting the time it takes for an event at the edge to become available for your SQL queries.

^{Grafana chart displaying the drop in ingest latency after architectural upgrades}

Follow along for more updates

We're just getting started. We're actively working on even more powerful features to further enhance your experience with Log Explorer, including the ability to run these detection queries on a custom defined schedule. 

^{Design mockup of upcoming Log Explorer Scheduled Queries feature}

Subscribe to the blog and keep an eye out for more Log Explorer updates soon in our Change Log. 

Get access to Log Explorer

To get access to Log Explorer, you can purchase self-serve directly from the dash or for contract customers, reach out for a consultation or contact your account manager. Additionally, you can read more in our Developer Documentation.

Security teams are no longer short on data. They are drowning in it. Cloud control plane logs, endpoint telemetry, identity events, SaaS audit trails, application logs, and network signals keep expanding, while the SOC is still expected to deliver faster detection and cleaner investigations. That is why SIEM vs log management is not just a tooling debate. It is a telemetry strategy question about what to retain as evidence, what to analyze for real-time detection, and where to do the heavy lifting.

Observability programs accelerate the flood. More telemetry can mean better visibility, but only if the SOC can trust it, normalize it, enrich it, and query it fast enough to keep pace with active threats. At scale, the cost and operational burden show up quickly across both SIEM and log management. PwC highlights how rising data volumes and cost models can push teams to limit ingestion and create blind spots, while alert overload and performance constraints make it harder to separate real threats from noise. Speed is also unforgiving. Verizon reports the median time for users to fall for phishing is less than 60 seconds, while breach lifecycles remain measured in months.

That is why many SOCs are adopting a security data pipeline mindset. It means processing telemetry before it lands in your tools, so you control what gets stored, what gets indexed, and what gets analyzed. Solutions like SOC Prime’s DetectFlow add even more value by turning a data pipeline into a detection pipeline through in-flight normalization and enrichment, running thousands of Sigma rules on streaming data, and supporting value-based routing. Low-signal noise can stay in lower-cost log storage for retention, search, and forensics, while only enriched, detection-tagged events flow into the SIEM for triage and response. The outcome is lower SIEM ingestion and alert noise costs without sacrificing investigation history.

SIEM vs Log Management: Definitions

Before comparing tools, it helps to align on what each category is designed to do, because overlapping feature checklists can hide fundamentally different objectives.

Gartner defines SIEM around a customer need to analyze event data in real time for early detection and to collect, store, investigate, and report on log data for detection, investigation, and incident response. In other words, SIEM is a security-focused system of record that expects heterogeneous data, correlates it, and supports security operations workflows.

Log management has a different center of gravity. NIST describes log management as the process and infrastructure for generating, transmitting, storing, analyzing, and disposing of log data, supported by planning and operational practices that keep logging consistent and reliable. In fact, log management is how you keep the raw evidence searchable and retained at scale, while SIEM is where you operationalize security analytics and response.

The practical difference shows up when you ask two questions:

• What is the unit of value? For log management, it is searchable records and operational visibility. For SIEM, it’s detection fidelity and incident context.
• Where does analytics happen? In log management, analytics often supports exploration and troubleshooting. In SIEM, analytics is built for threat detection, alerting, triage, and case management

What Is a Log Management System?

A log management system is the operational backbone for ingesting and organizing logs, so teams can search, retain, and use them to understand what happened.

Log management is often the first place teams see the economics of telemetry. Many organizations don’t need to run expensive correlation on every log line. Instead, they store more data cheaply and retrieve it quickly when an incident demands it. That’s why log management is frequently paired with data routing and filtering approaches that reduce noise before it reaches higher-cost analytics layers.

For security teams, log management becomes truly valuable when it produces high-integrity, well-structured telemetry that downstream detections can rely on, without forcing the SIEM to act as a catch-all storage sink.

What Is a SIEM?

A SIEM stands for Security Information and Event Management. It is designed to centralize security-relevant telemetry and turn it into detections, investigations, and reports. Normally, SIEM is described as supporting threat detection, compliance, and incident management through the collection and analysis of security events, both near real-time and historical, across a broad scope of log and contextual data sources.

But SIEMs face structural pressures as telemetry grows. Common pain points in traditional SIEM approaches include skyrocketing data volumes and cost, alert overload, and scalability and performance constraints when searching and correlating large datasets in real time. Those pressures matter because defenders already operate on unfavorable timelines. IBM’s Cost of a Data Breach report shows breach lifecycles still commonly span months, which makes efficient investigation and reliable telemetry critical.

So while SIEM remains central for security analytics and response, many teams now treat it as the destination for curated, detection-ready data, not the place where all telemetry must land first.

SIEM vs Log Management: Main Features

A useful way to compare SIEM and log management is to map them to the security data lifecycle: collect, transform, store, analyze, and respond. Log management does most of the work in collect through store, with fast search to support investigations. SIEM concentrates on analyzing through response, where correlation, enrichment, alerting, and case management are expected to work under pressure.

Log management features typically cluster around collect, transform, store, and search:

• Ingestion at scale: agents, syslog, API pulls, cloud-native integrations
• Parsing and field extraction: schema mapping, pipeline transforms, enrichment for searchability
• Retention and storage controls: tiering, compression, cost governance, access policies
• Search and exploration: fast queries for troubleshooting and forensic hunting
  
  

SIEM features concentrate on analyzing and responding:

• Security analytics and correlation: rules, detections, behavioral patterns, cross-source joins
• Context and enrichment: identity, asset inventory, threat intel, entity resolution
• Alert management: triage workflows, suppression, prioritization, reporting
• Case management: investigations, evidence tracking, compliance reporting
  

In other words, log management optimizes for retention and retrieval, and SIEM optimizes for detection and action. Yet, traditional SIEM approaches strain when the platform becomes both the telemetry lake and the correlation engine, especially under rising ingestion costs and alert noise. That is why many teams treat log management as the evidence layer, SIEM as the decision layer, and a pipeline layer as the control plane that shapes what flows into each.

Benefits of Using Log Management and SIEMs

Log management and SIEM are most effective when they’re treated as complementary layers in a single security data strategy.

Log management delivers depth and durability. It helps teams retain more raw evidence, troubleshoot operational issues that look like security incidents, and preserve the grounds needed for later forensics. This becomes essential when threat hypotheses emerge after the fact (for example, learning a new indicator days later and needing to search back in time).

SIEM delivers security outcomes: detection, prioritization, and incident workflows. A well-tuned SIEM program can reduce “needle-in-a-haystack” work by correlating events across identities, endpoints, networks, and cloud control planes.

The best security programs get three benefits from combining both:

• Cost control: store more, analyze less expensively by default, and route high-value data to SIEM.
• Better investigations: keep deep history in log platforms while SIEM tracks detections and cases.
• Higher signal quality: normalize and enrich logs so detections fire on consistent fields rather than brittle strings.

How SOC Prime Can Improve the Work of SIEM & Log Management

SOC Prime brings the SIEM and log management story together as a single end-to-end workflow.

You start with Attack Detective to audit your SOC and map gaps to MITRE ATT&CK, so you know which telemetry and techniques you are missing. Then, Threat Detection Marketplace becomes the sourcing layer where you pull context-enriched detections aligned to those gaps and the latest TTPs. Uncoder AI acts as a detection-engineering booster, making the content operational and portable to any native formats your SIEM, EDR, or Data Lake actually runs, while also helping refine and optimize the logic so it performs at scale.

DetectFlow is the final layer that turns a data pipeline into a detection pipeline and enables full detection orchestration. Running tens of thousands of Sigma rules on live Kafka streams with sub-second MTTD using Apache Flink, DetectFlow tags and enriches events in flight before they reach your security stack and routes outcomes by value. This removes the need for SIEM min-maxing around rule limits and performance tradeoffs, because detection scale shifts to the stream layer, where it grows with your infrastructure, not vendor caps. For SIEM, it delivers cleaner, enriched, detection-tagged signals for triage and response. For log management, it preserves deep retention while making searches and investigations faster through normalized fields and attached detection context.

The post SIEM vs Log Management: Observability, Telemetry, and Detection appeared first on SOC Prime.

Dan Petrillo, VP of Product at BlueVoyant 

As artificial intelligence (AI) becomes more deeply embedded in security operations, a divide has emerged in how its role is defined. Some argue the security operations centre (SOC) should be fully autonomous, with AI replacing human analysts. Others believe that augmentation is the right path, using AI to support and extend existing teams. 

Augmentation probably reflects how SOCs operate in practice. It helps analysts triage alerts, investigate incidents faster, and it brings better context into their work, while still ensuring humans are accountable for decisions.  

Complete autonomy assumes a level of reliable, end-to-end decision-making that can operate without continuous human oversight. That’s a high bar. In real SOC environments, the technology, data quality, and operational constraints rarely support that assumption. Detection pipelines are noisy, context is fragmented across tools, and threat signals often require human judgment to interpret correctly. Even the most advanced automation struggles with edge cases, ambiguous alerts, and the dynamic nature of attacker behaviour. 

Why an Autonomous SOC Falls Short 

Delving deeper and examining why AI cannot fully replace SOC analysts; in short, it comes down to the oversimplification of the complexities inherent in what security operations involve. Investigation is only one part of a functioning SOC. Organisations also depend on experienced practitioners to interpret ambiguous signals, manage escalation, and communicate risk to senior leadership. When incidents become business issues, that same expertise is required to apply judgement, coordinate stakeholders, and produce reporting that stands up to scrutiny. 

When something goes wrong, such as a logging failure, a broken parser following a third-party firewall update, or months of missing telemetry, automated systems cannot resolve the issue alone. Human expertise is needed to understand context, reconstruct events, and guide remediation. 

Governance is another constraint. The cost of false negatives remains unacceptably high, and security leaders are unlikely to deploy solutions that act without clear oversight. Even where AI can execute parts of a workflow, organisations still require process controls, quality checks, and human validation for complex or unfamiliar scenarios. A fully autonomous model cannot reliably make the right judgement call in every situation, particularly when decisions carry real business impact. 

Accuracy risks also remain. AI systems can make mistakes, draw incorrect conclusions, or miss important signals if left unchecked. Human oversight therefore remains essential to spot errors early and prevent them from turning into operational problems. 

Ultimately, fully autonomous SOC models ask organisations to trade human judgement and accountability for AI that is still maturing. That trade-off is impractical in an environment where consequences are measured in real-world disruption. 

Why AI in the SOC Is Still Essential 

However, none of the above suggests that AI does not have a place in the SOC. When implemented with purpose it delivers measurable improvements in the areas where teams are under the most pressure. 

AI can take on repetitive, high-volume tasks such as alert triage and enrichment, allowing analysts to focus on more complex investigations, decision-making, and response. Deployed effectively, AI in the SOC is essential to reclaiming human time from low value activity, enabling teams to apply expertise where it has the greatest operational payoff. 

Some of the most significant benefits of integrating AI agents into human-led SOC teams include: 

• Workload reduction: AI can handle repetitive, high-volume tasks such as alert triage, dynamic enrichment, and report generation, reducing analyst fatigue and operational backlog. 
• Process consistency: AI helps standardise workflows across varying skill levels, smoothing differences in tool syntax and operating procedures so teams perform more consistently. 
•  Improved alert quality: By incorporating external threat intelligence, control telemetry, and asset context, AI can reduce false positives and support more accurate prioritisation. 
• Faster decision-making: Attack timelines, path mapping, and context-rich summaries enable analysts to assess scope, impact, and containment options more quickly. 
• Knowledge retention: AI working alongside human analysts captures operational insights over time, mitigating the impact of staff churn and preserving institutional knowledge. It can also identify patterns that may be missed by individuals and recommend rules or remediations accordingly. 
• Always on: AI doesn’t need breaks, get tired, fall ill, take holidays, or turn up late. It becomes a consistently reliable coworker for stretched teams working under pressure. 

Where Augmentation Delivers the Most Value 

AI delivers the greatest value when applied to SOC activities that are slow, manual, or prone to inconsistency, while keeping humans accountable for decisions and execution. 

Augmentation should be introduced first in areas where AI can speed up analysis, surface insight, and support judgement, without removing human oversight. Below are a few areas where you might consider using AI to augment your team:

• Alert triage: False-positive reduction, dynamic enrichment, and contextual prioritisation using threat intelligence, asset criticality, and exposure data. 
• Augmented investigations: Natural language querying, attack path and timeline visualisation, and suggested queries that speed root-cause analysis. 
• Incident and case summarisation: Automated executive- and GRC-ready reporting that consolidates findings with clear, decision-ready context. 
• Hypothesis generation: Continuous pattern and behaviour analysis to surface new detections, investigative approaches, and remediation opportunities for human approval. 
• Operational oversight: AI that learns expected procedures and flags process deviations, bottlenecks, or underperformance for leadership attention. 
• Response recommendations: Context-aware guidance and playbook generation, with optional integration-driven execution remaining under human control. 

What This Means for Security Teams 

Security teams manage millions of investigations every year, even after automating many routine cases. While automation can streamline these routine tasks, full autonomy remains unrealistic. The most critical stages of an investigation still rely on human judgement, context and accountability.  

AI will continue to enhance the speed, scale and consistency of security operations, but the SOC of the future will remain human led, with AI augmenting, not replacing, analysts. Organisations that adopt AI in targeted, outcome driven ways will scale more effectively, reduce risk and preserve institutional knowledge. As threats evolve, AI augmented SOC teams will not only keep pace but stay ahead of adversaries.

The post AI in the SOC: Why Complete Autonomy Is the Wrong Goal appeared first on Security Boulevard.

Um número significativo dos incidentes modernos tem início com o comprometimento de contas. Como os agentes de acesso inicial se tornaram uma indústria criminosa plenamente estabelecida, ficou muito mais fácil para invasores organizarem ataques à infraestrutura das empresas simplesmente comprando conjuntos de logins e senhas de funcionários. A ampla adoção de diferentes métodos de acesso remoto tornou essa tarefa ainda mais simples. Ao mesmo tempo, as fases iniciais desses ataques se assemelham com frequência a ações perfeitamente legítimas de colaboradores e permanecem indetectáveis pelos mecanismos tradicionais de segurança por longos períodos.

Confiar apenas nas medidas de proteção da conta e nas políticas de senha não é uma opção. Sempre existe a possibilidade de que invasores obtenham credenciais de funcionários por meio de ataques de phishing, malware do tipo infostealer ou, simplesmente, pela falta de cuidado de usuários que reutilizam a mesma senha em contas profissionais e pessoais e não dão muita atenção a vazamentos ocorridos em serviços de terceiros.

Assim, a detecção de ataques à infraestrutura de uma empresa exige ferramentas que identifiquem não apenas assinaturas isoladas de ameaças, mas também mecanismos de análise comportamental que reconheçam desvios do comportamento normal de usuários e processos do sistema.

Uso de IA no SIEM para detectar comprometimento de contas

Como mencionamos na postagem anterior, para detectar ataques envolvendo comprometimento de contas, o SIEM da Kaspersky Unified Monitoring and Analysis Platform foi equipado com regras UEBA para identificar anomalias em autenticação, atividades de rede e execução de processos em estações de trabalho e servidores Windows. Na atualização mais recente, seguimos desenvolvendo o sistema nessa mesma direção, incorporando abordagens baseadas em IA.

O sistema cria um modelo do comportamento normal dos usuários durante a autenticação e passa a monitorar desvios em relação aos cenários habituais, como horários de login atípicos, cadeias de eventos incomuns e tentativas de acesso anômalas. Essa abordagem permite que SIEM identifique tanto tentativas de autenticação com credenciais roubadas quanto o uso de contas já comprometidas, inclusive em cenários complexos que antes poderiam passar despercebidos.

Em vez de buscar indicadores isolados, o sistema analisa desvios em relação a padrões normais. Isso possibilita a detecção mais precoce de ataques complexos, reduz o número de falsos positivos e diminui significativamente a carga operacional das equipes de SOC.

Anteriormente, ao utilizar regras UEBA para detectar anomalias, era necessário criar diversas regras responsáveis por executar etapas preliminares e gerar listas adicionais nas quais os dados intermediários eram armazenados. Agora, na nova versão do SIEM, com um correlacionador atualizado, é possível detectar o sequestro de contas por meio de uma única regra especializada.

Outras atualizações na Kaspersky Unified Monitoring and Analysis Platform

Quanto mais complexa é a infraestrutura e maior o volume de eventos, mais críticos se tornam os requisitos de desempenho da plataforma, a flexibilidade no gerenciamento de acessos e a facilidade de operação no dia a dia. Um sistema SIEM moderno deve não apenas detectar ameaças com precisão, mas também permanecer resiliente, sem precisar de atualizações constantes de hardware ou de reestruturação de processos. Por isso, na versão 4.2, demos mais um passo para tornar a plataforma mais prática e adaptável. As atualizações impactam a arquitetura, os mecanismos de detecção e a experiência do usuário.

Inclusão de funções flexíveis e controle de acesso granular

Uma das principais inovações da nova versão do SIEM é o modelo flexível de funções. Agora, os clientes podem criar funções personalizadas para diferentes usuários do sistema, duplicar funções existentes e configurar conjuntos específicos de permissões de acordo com as atividades de cada especialista. Isso permite uma diferenciação mais precisa de responsabilidades entre analistas de SOC, administradores e gestores, reduz o risco de concessão excessiva de privilégios e reflete de forma mais fiel os processos internos da empresa nas configurações do SIEM.

Novo correlacionador e, como resultado, maior estabilidade da plataforma

Na versão 4.2, introduzimos uma versão beta de um novo mecanismo de correlação (2.0). Ela processa eventos com maior velocidade e exige menos recursos de hardware. Para os clientes, isso se traduz em:

• operação estável mesmo sob cargas elevadas;
• capacidade de processar grandes volumes de dados sem a necessidade de expansão imediata da infraestrutura;
• desempenho mais previsível.

Cobertura de TTPs de acordo com a matriz MITRE ATT&CK

Também seguimos ampliando sistematicamente a cobertura da matriz de técnicas, táticas e procedimentos MITRE ATT&CK: atualmente, o Kaspersky SIEM cobre mais de 60% de toda a matriz. As regras de detecção são atualizadas regularmente e acompanhadas de recomendações de resposta. Isso ajuda os clientes a entenderem quais cenários de ataque já estão sob controle e a planejarem a evolução das suas defesas com base em um modelo amplamente aceito pelo setor.

Outras melhorias

A versão 4.2 também introduz a possibilidade de realizar backup e restauração de eventos, além da exportação de dados para arquivos seguros com controle de integridade, algo especialmente importante para investigações, auditorias e conformidade regulatória. Consultas em segundo plano foram implementadas para facilitar o trabalho dos analistas. Agora, pesquisas complexas e que consomem muitos recursos podem ser executadas em segundo plano sem impactar tarefas prioritárias. Isso acelera a análise de grandes volumes de dados.

Continuamos atualizando regularmente o Kaspersky SIEM, expandindo suas capacidades de detecção, aprimorando a arquitetura e incorporando funcionalidades de IA para que a plataforma atenda cada vez melhor às condições reais enfrentadas pelas equipes de segurança da informação. O objetivo é não apenas responder a incidentes, mas também ajudar a construir um modelo de proteção sustentável para o futuro. Acompanhe as atualizações sobre o sistema SIEM, a Kaspersky Unified Monitoring and Analysis Platform, na página oficial do produto.