Blog
Guides to log management, SIEM and security operations
Plain-language explanations of SIEM, SOC, file integrity monitoring and threat detection, with practical steps security teams can use every day.
SIEM
What Is SIEM? How It Works and How to Choose One
What is SIEM? How security information and event management works, how it differs from log management, common use cases and how to choose one.
10 min readRead
Threat Intelligence
Threat Intelligence Platforms: How Enrichment Speeds Up Investigations
What a threat intelligence platform does, which indicators matter, and how enriching logs with threat data and risk scores speeds up threat detection.
8 min readRead
Log management
Syslog Server Guide: Centralizing Logs from Network Devices
What a syslog server does, RFC 5424 vs RFC 3164, UDP, TCP and TLS transport, how to send firewall, switch and server logs, and the step to log management.
8 min readRead
SIEM
SIEM Tools: How to Evaluate a SIEM Platform
How to evaluate SIEM tools: log source coverage, correlation and detection, scale, cloud vs self-hosted deployment, pricing models and questions for vendors.
11 min readRead
SIEM
Open Source SIEM vs Commercial SIEM
Open source SIEM or commercial SIEM software? Compare total cost, detection content, scaling, support and compliance, and see when each one fits.
8 min readRead
Log Management
Log Retention: How Long Should You Keep Security Logs?
How long to keep security logs: retention periods in PCI DSS, CIS Controls, HIPAA, GDPR and Law 5651, hot and cold storage, and proving log integrity.
7 min readRead
File integrity monitoring
File Integrity Monitoring Tools: What to Look For
What file integrity monitoring is and what to look for in FIM software: hashing, diffs, user and process context, Linux and Windows support, SIEM integration.
9 min readRead