White Papers & Videos Archives

Detection Engineering Best Practices for Implementing a Threat-Informed Defense

In this paper, SANS Director of Emerging Security Trends, John Pescatore, compiles data from the recent SANS survey of 267 cybersecurity professionals to determine the state of practice in detection engineering.

A CISO’s Perspective on Improving SecOps Effectiveness

Repsol aims for net-zero emissions by 2050 but faces growing cybersecurity challenges. Read this executive summary to learn how they use automation, threat intelligence and CardinalOps for enhanced security.

Insights from the 2023 State of Cloud Threat Detection and Response Report

Black Hat Webinar Executive Summary It probably comes as no surprise that most organizations already conduct the majority of their computing in the cloud. In fact, according to the “State of Cloud Threat Detection and Response”

Gartner® Report: Hype Cycle™️ for Security Operations, 2023

Read this complimentary report from Gartner® – Hype Cycle for Security Operations for 2023. Learn about Automated Security Control Assessment and how it can strengthen your security posture.

2023 Report on State of SIEM Detection Risk

In our third annual report, CardinalOps set out to gain visibility into the current state of use case development and threat detection coverage in enterprise SOCs. We analyzed, aggregated and anonymized data from production SIEM

SANS 2023 SOC Survey

Download the 2023 SOC Survey from the SANS Institute to gain insights from active SOC managers and analysts around best practices for running a SOC.

Learn how to identify and fix a rule you don’t know is broken

Based on analyzing thousands of detections, our research team has compiled the top 10 ways that SIEM rules break (silently) over time.

Noisy rules give adversaries an easy path to exploit weaknesses in your defenses

This research summary lists the top causes of noisy rules in your SIEM, followed by 5 best practices to help minimize noise.

Eliminate coverage gaps with automation and MITRE ATT&CK

Watch this 3-minute video to learn how CardinalOps continuously ensures you have the detections that matter most.

How to implement a threat-informed defense with MITRE ATT&CK

Download this ESG analyst report to learn about top ATT&CK use cases and how detection posture management can help.

Quantifying the ATT&CK Coverage Gap in Production SIEMs

Benchmark your SIEM against the average state of detection coverage and rule health in real-world SIEMs.

Addressing the complexity challenge of multiple SIEMs

Learn how to ensure consistent detections and gain a federated view of MITRE ATT&CK coverage and rule health across multiple SIEM/XDR instances.