How long does it realistically take to onboard a new log source?
I'm trying to get a realistic baseline for log-source onboarding. We use a central rsyslog server that receives logs from the whole estate. After taking over another site,…
SIEM
How do you quickly identify which devices are driving a sudden syslog spike?
Our syslog volume increased from roughly 2.4 million events per day to 7.2 million over about a week, despite no configuration changes or new equipment. The collector only…
How do you quickly identify which devices are driving a sudden syslog increase?
Our syslog volume jumped from roughly 2.4 million events per day to 7.2 million over about a week, even though there were no configuration changes or new devices.…
Are Paid Threat Intelligence Feeds Worth It If They Don’t Produce Detections?
We subscribe to several paid threat intelligence feeds marketed as operational and actionable. Most deliver long reports or blog-style analysis, sometimes with STIX bundles or CSV files containing…
What are you using to monitor SharePoint, Entra ID, and on-premises Active Directory in a hybrid HIPAA environment?
We've used SolarWinds for on-premises logging, but we're moving from an on-premises file share to SharePoint. What tools or services are you using to collect and review SharePoint…
Is Monitoring SaaS Configuration Changes as Important as Monitoring Logins?
Do organizations need governance and activity monitoring for SaaS applications beyond identity and access-management role assignments? For example, if an administrator changes Salesforce tenant settings, grants someone elevated…
How can I effectively control software installations on Windows endpoints?
I'm a sysadmin managing around 200 Windows endpoints and need some advice on handling two main issues. First, while standard users can't install software in Program Files, they…
What Evidence Stands Up to Audits and Incident Reviews Months Later?
I'm looking to figure out what types of evidence really hold up under scrutiny 6 to 12 months after an audit, incident, or insurance review. My focus is…
How to Manage High Volume of Security Logs on Domain Controllers?
I've enabled auditing on my Windows Domain Controllers, but now the Security log is getting overwhelmed with Event IDs 5156, 5157, and 5158, logging about 50 events per…
Is Netwrix Still the Go-To Auditing Tool?
I'm checking out some auditing tools and Netwrix seems to be the most well-known option. However, we don't use any online services like 365; everything is on-premises. I…
How to Handle This New Security Policy?
I've come across a new requirement in our security policy that seems a bit concerning. It says we need to ensure that all actions by individual users can…
Looking for Free SIEM Options Compatible with AWS
I'm diving into my first security project on AWS, and I need to do some log analysis. I'm in search of a solid Security Information and Event Management…
How to Track Password Reset Flags Cleared by Helpdesk?
I'm trying to figure out how to identify helpdesk personnel who are disabling the "Must change password at next logon" flag for users. We've had instances where users…
How Do You Handle Suspicious Login Alerts in Google Admin Console?
Hey everyone! I'm a Google Workspace admin and I've been inundated with alerts about suspicious login attempts on a shared Google account that several users access. I want…