PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Log Curation 101

blog.sentry.security | research | #siem | #detection-engineering | #blue-team | #logging | #telemetry | #log-management
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A SIEM log curation checklist: nine log source categories ranked by investigation value into tiers, guiding parser work, retention spending, and detection engineering.
Published
Collected

Related coverage

blog · bugbunny.ai
Intrusion Detection Systems: What They Catch and Where They Fail
What intrusion detection systems catch and where they fail: coverage must span network, endpoint, identity, cloud and API; target attacker behaviors, and enrich alerts with asset and owner context.
research · projectblack.io
Automated Graylog Open Setup using Puppet
A zero-cost SIEM deployment automated with Puppet: single-node Graylog Open with OpenSearch and MongoDB, ingesting Windows Event logs and creating a key security detection for Essential Eight needs.
blog · bishopfox.com
Purple Teaming: Validating Cybersecurity Investments and Enhancing Efficiency
Bishop Fox explains Purple Teaming—merging Red Team offense with Blue Team defense—to validate security investments, establish measurable baselines and communicate evidence-based ROI.
blog · about.gitlab.com
Build an automated detection testing framework with GitLab CI/CD and Duo
GitLab's Signals Engineering team built WATCH, a breach and attack simulation framework that runs real malicious behavior to verify detections fire end-to-end from log source through SIEM and SOAR.
blog · aikido.dev
The dark figure of supply chain detection
Borrowing Wald's survivorship-bias lesson and the 'dark figure of crime', the author argues string rules only catch known artifacts, so behavioral detection is the only route to the unknown.
blog · crowdstrike.com
Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats
Falcon Platform IOAs bring CrowdStrike-managed, adversary-driven detections to Falcon Next-Gen SIEM, correlating telemetry across modules and third-party sources, auto-deployed as new threats emerge.
Back