Cisco Blog

Operational Security Intelligence

Security

Jeff Bollinger
December 3, 2013 - 1 Comment

Security intelligence, threat intelligence, cyber threat intelligence, or “intel” for short is a popular topic these days in the Infosec world. It seems everyone has a feed of “bad” IP

Using a “Playbook” Model to Organize Your Information Security Monitoring Strategy

Security

Brandon Enright
November 1, 2013 - 2 Comments

CSIRT, I have a project for you. We have a big network and we’re definitely getting hacked constantly. Your group needs to develop and implement security monitoring to get our

To SIEM or Not to SIEM? Part II

Security

Jeff Bollinger
October 24, 2013 - 6 Comments

The Great Correlate Debate SIEMs have been pitched in the past as “correlation engines” and their special algorithms can take in volumes of logs and filter everything down to just

To SIEM or Not to SIEM? Part I

Security

Jeff Bollinger
October 22, 2013 - 0 Comments

Security information and event management systems (SIEM, or sometimes SEIM) are intended to be the glue between an organization’s various security tools. Security and other event log sources export their

Getting a Handle on Your Data

Security

Matt Valites
October 18, 2013 - 0 Comments

When your incident response team gets access to a new log data source, chances are that the events may not only contain an entirely different type of data, but may

Making Boring Logs Interesting

Security

Matt Valites
October 9, 2013 - 0 Comments

This post centers around the practice of logging data – data from applications, devices, and networks – and how the components of data logging can help in the identification and

Big Security—Mining Mountains of Log Data to Find Bad Stuff

Security

Jeff Bollinger
October 3, 2013 - 3 Comments

Your network, servers, and a horde of laptops have been hacked. You might suspect it, or you might think it’s not possible, but it’s happened already. What’s your next move?

csirt-playbook

Operational Security Intelligence

Using a “Playbook” Model to Organize Your Information Security Monitoring Strategy

To SIEM or Not to SIEM? Part II

To SIEM or Not to SIEM? Part I

Getting a Handle on Your Data

Making Boring Logs Interesting

Big Security—Mining Mountains of Log Data to Find Bad Stuff

Connect with Cisco Blogs

csirt-playbook

Operational Security Intelligence

Using a “Playbook” Model to Organize Your Information Security Monitoring Strategy

To SIEM or Not to SIEM? Part II

To SIEM or Not to SIEM? Part I

Getting a Handle on Your Data

Making Boring Logs Interesting

Big Security—Mining Mountains of Log Data to Find Bad Stuff

Subscribe to Cisco Blogs

Connect with Cisco Blogs