Operations | Monitoring | ITSM | DevOps | Cloud

Modern day Security Information and Event Management (SIEM) tooling enterprise security technology combine systems together for a comprehensive view of IT security. This can be tricky, so we’ve put together a simple SIEM tutorial to help you understand what a great SIEM provider will do for you. A SIEM’s responsibility is to collect, store, analyze, investigate and report on log and other data for incident response, forensics and regulatory compliance purposes.

Availability and quality are the biggest differentiators when people opt for a service or product today. You should be aware of the impact of your customers alerting you to your own problems, as well as how to stop this from becoming the norm. To make sure you don’t become an organization known for its bugs, understanding the organizational changes required to deliver a stable service is key.

Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies.

Several weeks ago, my good friend Katie Nickels (Director of Intelligence at Red Canary extraordinaire) and I were chatting about Ransomware. She was super interested and passionate about some new uses of a ransomware variant named “Ryuk” (first detected in 2018 and named after a manga/anime character) [1]. I was, to be honest, much less interested. It turns out, as usual, Katie was right; this was a big deal (although as you will see, I’m right too… still dull stuff!).

With the promise of unprecedented potential, artificial intelligence (AI) and predictive analytics have permeated into every field of business. Due to their ability to help retail staff serve customers better, personalize video recommendations based on users’ preferences, reduce employee churn, and detect fraud and security threats, AI and predictive analysis are rapidly being adapted across industry verticals.

Sleuth is a deployment tracking tool that gives you a deeper level of insight into your CI/CD workflows by tracking all of your team’s deployment tools from a single dashboard. Sleuth integrates with different components of your deployment pipeline and develops an understanding of your development processes. It can then automatically alert you as to when code is shipping, when manual approvals are needed, and when failures occur.

Amazon SQS is a message queuing service that allows you to send and receive huge numbers of messages from a queue using a simple API. Using Amazon SQS, without setting up any infrastructure, you can have a distributed and fault tolerant queuing system. Since SQS is a managed service, you have less visibility with traditional monitoring tools. As such, it becomes even more important to take advantage of the available monitoring tools in AWS.

Across the technology and IT infrastructure domain, log files are recognized as often time-stamped files that can virtually record all critical information about events occurring within the purview of your IT network, OS, or other software applications. Some log files are humanly interpretable, while others are largely meant for machines to consume.

All databases provide a place to run applications. Monitoring an infrastructure is usually based on its technical components which goes on to extrapolate the health of its applications and programs. However, wouldn’t it be more efficient to monitor the application’s functionality itself? So imagine you have an Order application that consists of a Web UI frontend, Web API backend, business service and an Oracle Database.

Monitoring information that matters to you will often come from disparate sources – whether you are a server engineer, a SQL database administrator, or an application owner wanting a 360 view of your applications’ health. For example, you may want to visualise your server metrics from SCOM alongside historical trends from the SCOM Data Warehouse.