AD Security 101: SIEM Tools and AD Monitoring

Why some AD attacks leave no trace: DCShadow injects changes through the replication stream, malicious GPO edits like Ryuk's lack log detail, and ZeroLogon used crafted Netlogon messages—so SIEM-only monitoring misses them.

Defending against DCShadow (part 2): test in isolated labs, watch privileged access, and alert on transient server objects under CN=Sites,CN=Configuration—registration artifacts it leaves behind.

A guide to secure logging in Golang covering the standard log package, structured JSON logging with Apex/log and logrus, log level strategy, and why to avoid log.Fatal in production.

Part 3 of the AWS shared responsibility series covers logging, monitoring, and alerting, explaining how CloudTrail, VPC Flow Logs, and CloudWatch combine to deliver high-value alerts to analysts.

Wiz deepens its Google Security Operations integration with a shared data model and a Content Pack, letting analysts investigate Wiz Defend alerts with cloud context in either platform.

A SIEM log curation checklist: nine log source categories ranked by investigation value into tiers, guiding parser work, retention spending, and detection engineering.