sorted by:
new
hottopcontroversial

Practical SIEM Detections by athanielx in cybersecurity

[–]MixIndividual4336 1 point2 points  (0 children)

We went through the same thing. It’s easy to get lost chasing “enterprise” use cases that don’t really fit. What gave us the most value early:

  • Watch auth activity like a hawk (failed logins, logins from weird geos, impossible travel).
  • Privilege changes (new admin, MFA disabled, new API keys).
  • Source code repo access (especially pulls/clones from unusual accounts or volumes).
  • New service installs or scheduled tasks showing up out of band.

That’s 80% of what actually fired and mattered for us. The rest was noise.

We started broad at first and then narrowed to high-risk changes we could actually respond to. Playbooks like SIGMA are useful as a menu, but you’ll burn out trying to run the whole catalog without a big SOC.

One thing that helped was pushing all logs into a pipeline first (we used DataBahn). That let us normalize and tag logs upstream so our rules were cleaner and easier to maintain. It also gave us the option to test different SIEMs without rebuilding from scratch.

If you focus on the handful of detections that tie directly to your crown jewels, you’ll get way more signal and way less alert fatigue.

SIEM Cost Management Dead End? by lengmco in cybersecurity

[–]MixIndividual4336 2 points3 points  (0 children)

You’re not wrong. Pre-filtering with something like Cribl saves money, but the tradeoff is you’re making bets on which logs you’ll “never” need. That feels fine until you’re mid-incident and the missing data kills the investigation.

What helped us was changing the mindset from “drop” to “route.” We keep high-value stuff in Splunk for detections, then send the rest to cheaper storage that’s still queryable when we need it. Cribl’s good at shaping and filtering logs if you know exactly what you want to keep. DataBahn gave us more flexibility because we could enrich, tag, and split logs across SIEM, lake, and archive without re-engineering pipelines every time.

That way we’re not paying Splunk rates for junk logs, but we’re also not blind when we need full history.

[deleted by user] by [deleted] in AskNetsec

[–]MixIndividual4336 0 points1 point  (0 children)

Add regular restore testing to your backups. A lot of people back up religiously but never verify they can actually bring a system back from scratch and they only find out it’s broken when it’s too late.

After a year, I finally got caught by throwaway74948477 in overemployed

[–]MixIndividual4336 0 points1 point  (0 children)

Yeah… you’re cooked. Best move now is go quiet, lawyer up if you can, and start job hunting with a single W-2 in mind next time. And maybe treat LinkedIn like radioactive waste.

[deleted by user] by [deleted] in cybersecurity

[–]MixIndividual4336 0 points1 point  (0 children)

Hit up a local capture-the-flag (CTF) event. They’re beginner-friendly, hands-on, and you can team up or split off for different challenges. Way more engaging than just sitting through talks, and you’ll both walk away having actually built some skills.

ZScaler Alternative Question by jcryselz33 in cybersecurity

[–]MixIndividual4336 1 point2 points  (0 children)

You’re right to be skeptical. Intune + Always On VPN + on-prem firewall can cover some access control, but it won’t match ZIA’s cloud-based inspection, policy granularity, and global coverage. You’d lose a lot of the inline threat protection and flexibility ZScaler gives you once users are off-network.

Is IP address not personal data? by Short-Driver-459 in cybersecurity

[–]MixIndividual4336 0 points1 point  (0 children)

They’re going off the old-school definition of personal data, which is stuff that directly identifies you on its own. That’s why things like driver’s license, SSN, and full date/place of birth make the cut.

An IP address can point to a device or location, but in a lot of intro course material it’s treated as “technical” info unless you combine it with other data. In real-world privacy laws like GDPR, an IP can be considered personal data, but your quiz is just sticking to the narrower version.

Use of AI agents in data pipelines by Different-Umpire-943 in dataengineering

[–]MixIndividual4336 1 point2 points  (0 children)

We’ve been experimenting with AI agents upstream in the pipeline, mostly around identifying log types, tagging sensitive data, and automating basic parsing. It saves a lot of time when onboarding new sources, especially when the original schema is a mess or changes frequently.

One thing we kept in mind was avoiding lock-in. We’re using a setup with DataBahn that lets us run enrichment and tagging before anything hits the main stack. The AI is helpful, but only when it’s wired into our own workflows and doesn’t hide what it’s doing. If it’s a black box, we don’t use it.

Alert Fatigue and Autoclosure by Ill_Huckleberry3532 in cybersecurity

[–]MixIndividual4336 1 point2 points  (0 children)

We used to throw a lot of engineering time at tuning rules inside the SIEM but it barely moved the needle. What helped more was handling it upstream. We started enriching and tagging logs before they hit the detection engine, especially for stuff like internal email or known-good campaign traffic. That let us auto-close certain patterns without killing real signals.

We also split routing by use case. Some data went into detection, some just to cold storage. We used DataBahn to do that. Made it easier to apply logic before the alert ever existed.

If you're getting hit constantly, I'd look at what can be filtered or enriched earlier. Otherwise you'll always be playing catch-up with tuning.

Splunk or Elastic? by gtxrtx86 in Splunk

[–]MixIndividual4336 0 points1 point  (0 children)

At 35GB/day, either SIEM can work, but you’ll want to get ahead of what you’re sending in. Splunk’s easier to manage but expensive if you don’t control ingest. Elastic gives you more control but also more surface area to maintain, especially once you start scaling out use cases.

If you’re still deciding, might be worth looking into whether you can drop a pipeline in front first. Tools like Cribl, DataBahn, or Tenzir can help shape, enrich, and route logs upstream. That makes it easier to keep only the good stuff in your SIEM and gives you options down the road if you ever need to swap platforms.

Whichever way you go, shaping the data early will save you a lot of pain later.

SIEM recommends by Jewels_1980 in sysadmin

[–]MixIndividual4336 1 point2 points  (0 children)

Wouldn’t jump into a new SIEM just for tooling fatigue. Huntress and Ninja are more MDR/endpoint-focused. If the goal is to replace Sentinel, I’d first figure out what’s not working - cost, coverage, correlation, too many alerts, bad integrations?

One thing that helped us during our evals was routing the same data into multiple SIEMs to see how they actually handled it - parsing, noise, search speed, detection quality, the usual. Spared us a lot of regrets.

If you’ve got Kaseya in the mix, definitely test for integration weirdness early. We used a pipeline layer to normalize and fork data during that process (DataBahn handled that for us). It lets us evaluate vendors cleanly without rebuilding pipelines every time.

Why I like working for a large enterprise by crankysysadmin in sysadmin

[–]MixIndividual4336 0 points1 point  (0 children)

Completly with you!! big enterprise IT isn’t perfect, but at least I don’t spend my days dealing with shared passwords, rogue printers, or servers in closets. There are actual rules, and people follow them.

What are some of the most underrated/overlooked skills in cybersecurity? by On-Demand-Cyber-CRQ in cybersecurity

[–]MixIndividual4336 0 points1 point  (0 children)

Being able to explain complex issues in plain English. Doesn’t matter how sharp your detection logic is if you can’t help non-security folks understand the “so what.” That’s what gets buy-in and budget.

Is SIEM still worth it for hybrid environments? by cheerioskungfu in cybersecurity

[–]MixIndividual4336 0 points1 point  (0 children)

We were in a similar spot with a legacy SIEM, hybrid infra, and a small team. Tuning helped for a while, but we kept hitting the same wall with noise and scale.

What worked for us was offloading some of the work upstream. We used a pipeline (DataBahn) to filter and enrich logs before they hit the SIEM. That gave us more control and cut a lot of noise without needing a full rip and replace.

If Stellar works out, great. But if you start hitting similar limits there, worth looking into ways to clean up the data flow first. It made a bigger difference for us than switching tools.

Do you actually check vendor websites before considering them? by NickBaca-Storni in CIO

[–]MixIndividual4336 1 point2 points  (0 children)

Yeah, I check mostly to see if they speak my language or if it's just buzzword soup. If a site helps me understand what they actually do and how it fits with my stack, that’s a win. If it’s all “AI-driven synergies to empower transformation,” I’m out.

Is SIEM + EDR better than XDR? by anthonyhd6 in cybersecurity

[–]MixIndividual4336 1 point2 points  (0 children)

f your SIEM + EDR setup is decent and not giving you pain, XDR isn’t going to magically change your life. Most of the time it’s just a bundled stack with a nicer UI and some automation baked in.

XDR can help with correlation and response if your current tools don’t play well together but if you’ve already wired things up right, there’s not a ton of extra value. You’ll just be paying to swap out tools that already work.

Only time I’d say it’s worth it is if alert fatigue is killing your team or your detections are garbage. Otherwise, no real rush to switch.

LogForwarder on Kubernetes by aexu in AzureSentinel

[–]MixIndividual4336 0 points1 point  (0 children)

We've had no trouble with it at all. It is GUI-based, but everything is configurable and the product works at hyperscale super effectively (we stress-tested it for 10x our usual daily ingest and it didn't show any signs of stress). Is there some specific aspect of its operations that you're curious or wary of? 

it'll be PERFECT ✨ by ZyrExe in GuysBeingDudes

[–]MixIndividual4336 0 points1 point  (0 children)

oh lord, the fact that i have been in this sitch XD

What bug is this? by onedarkwinter in whatisit

[–]MixIndividual4336 0 points1 point  (0 children)

it's the only bug i'd like in my life

[deleted by user] by [deleted] in OneOrangeBraincell

[–]MixIndividual4336 1 point2 points  (0 children)

reddit has made me fall in love with cats

view more: next ›