Blog Archives - CardinalOps

CardinalOps Launches TI-Ops to Operationalize Adversary Intelligence through AI and Automation

Turn real adversary behaviors (TTPs) into actionable detection Organizations are struggling to keep up with an evolving threat landscape and security teams are increasingly burdened with the pressure to build an effective cyber defense against

Safeguarding Azure Blobs: Detecting Public Network Access Configurations

Microsoft Azure utilizes blobs to house large amounts of unstructured data. An Azure blob can be configured to be accessed from specific IP addresses only. This is the common configuration and a known best practice

The Importance of Proactive Detection Engineering in Light of Ivanti’s VPN Vulnerabilities

Ivanti’s recent disclosure of a new high-severity flaw in its Connect Secure VPN devices marks the fifth such vulnerability revealed over the past couple of months. This alarming trend sheds light on a broader issue

SIEM Migration: Challenges and Strategies

In this exploration, we delve into the intricacies of SIEM migration, focusing on critical aspects like the SIEM style, data acquisition, correlation methods, securing the SIEM, and the imperative task of migrating SIEM detection coverage.

CardinalOps Contributes to MITRE ATT&CK for Fourth Consecutive Release

CardinalOps, the detection posture management company, announced today that it contributed updates to the latest version of MITRE ATT&CK, a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Gartner Identifies CardinalOps as a Sample Vendor for Automated Security Controls Assessment (ASCA)

CardinalOps, the detection posture management company, has been recognized as a Sample Vendor in two prestigious Gartner Hype Cycles – Gartner Hype Cycle for Security Operations, 2023 and Gartner Hype Cycle for Workload and Network

CardinalOps to Present at Splunk .conf23 on New Approach to Measuring Detection Posture Using MITRE ATT&CK

CardinalOps, the detection posture management company, is delivering an educational session about Splunk and MITRE ATT&CK at the Splunk .conf23 User Conference on Tuesday, July 18th at 1:30pm PDT in the Conference Theater.

Enterprise SIEMs Miss 76% of all MITRE ATT&CK Techniques Used by Adversaries

CardinalOps’ third annual report analyzes real-world data from production SIEMs covering nearly 4,000 detection rules across diverse industry verticals If you’re looking to benchmark your SIEM with respect to its MITRE ATT&CK coverage and rule

SOC Meets Cloud: What Changes and What Stays the Same?

Michael Mumcuoglu, CEO & co-founder of CardinalOps, explores critical questions facing security operations center (SOC) leaders charged with supporting their organization’s migration to a cloud operation model and their digital transformation initiatives.

CardinalOps Contributes Updates to MITRE ATT&CK Techniques Related to Abuse of Mail Transport Rules

Adversaries are hijacking corporate email systems such as Office 365 by abusing email transport rules. Learn how these sophisticated attacks work, plus how to detect them in Splunk, Microsoft Sentinel, IBM QRadar & Sumo Logic.

Security Layers — Measuring MITRE ATT&CK Detection Coverage Across Your Entire Attack Surface, Linked to Business Outcomes

If you’re like most of us in the defender community, you’re probably tired of seeing all the colored heat maps used to represent MITRE ATT&CK detection coverage.

Detecting Microsoft Outlook Vulnerability CVE-2023-23397 in Splunk, IBM QRadar & Microsoft Sentinel

Summary Discovered by the Ukrainian CERT and attributed to APT28 (aka Fancy Bear or Strontium, the Russian GRU threat actor), CVE-2023-23397 is being actively exploited in targeted attacks against government, transportation, energy, and military sectors