# siem Published articles for siem. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines DevFeed: [Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines]() Original publisher: [Read original article]() Author: Zara Boddula; Danielle Park Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [Datadog | The Monitor blog]() Topics: [observability pipelines](), [SIEM, Security](), [Security](), [log management](), [Microsoft]() Tags: [azure](), [cisco-meraki](), [devsecops](), [fortigate](), [log-management](), [logs](), [observability-pipelines](), [pipelines](), [security](), [siem](), [telemetry](), [threat-detection]() ### AI overview Datadog's Observability Pipelines Packs transform firewall, VPN, and network detection logs into Microsoft Sentinel table schemas before ingestion. The post describes Packs for Palo Alto Networks, Fortinet, Cisco ASA, Cisco Meraki, and ExtraHop, including filtering and noise reduction to help control Sentinel ingest volume while retaining visibility. ### Source excerpt Learn how Observability Pipelines Packs map security logs to Microsoft Sentinel schemas and help control downstream ingest volume. ## One audit trail for every coding agent, and what it proves DevFeed: [One audit trail for every coding agent, and what it proves]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-13T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [audit trail](), [audit](), [coding](), [Claude Code](), [codex](), [OpenClaw](), [SIEM, Security, Observability](), [MCP]() Tags: [agent](), [agents](), [api](), [audit](), [audit-trail](), [claude](), [claude-code](), [code](), [codex](), [coding](), [logging](), [mcp](), [siem](), [streaming](), [visibility]() ### AI overview This article describes WorkOS audit logging for Claude Code, Codex, OpenClaw, and pi. Its shared plugin and harness capture agent session, prompt, and tool lifecycle events, resolve activity to people, and make events queryable through a console, Export API, SIEM streaming, and MCP. ### Source excerpt We built audit logging for Claude Code, Codex, OpenClaw and pi with no API key on any laptop. Use it to get total visibility into your entire org's agentic activity. ## HTTP QUERY: the method that was missing between GET and POST DevFeed: [HTTP QUERY: the method that was missing between GET and POST]() Original publisher: [Read original article]() Author: Matteo Baccan Published: 2026-07-29T12:26:29Z Content type: article Language: en Sources: [Backend Job: skill, salary and insights - Codemotion Magazine]() Topics: [HTTP](), [Back end](), [Web](), [Security](), [Caching]() Tags: [backend](), [caching](), [firewall](), [http](), [http-query](), [ietf](), [load-balancing](), [post](), [security](), [siem](), [web]() ### AI overview This article examines the proposed HTTP QUERY method, which is intended to combine the safety and idempotency of GET with the ability to carry an extended request body like POST. It discusses the limitations and security risks of putting complex or sensitive queries in URLs, and considers the method's effects on caching, infrastructure compatibility, and future backend implementation. ### Source excerpt For nearly thirty years, the Web has lived with a semantic paradox that anyone developing for the backend knows well: how do you execute a complex, voluminous query, or one containing sensitive data, if the only "safe" method available does not allow a request body? Think about when we need to send a structured search... Read more The post HTTP QUERY: the method that was missing between GET and POST appeared first on Codemotion Magazine. ## What is an Agentic Data Plane? DevFeed: [What is an Agentic Data Plane?]() Original publisher: [Read original article]() Author: Marc Millstone Published: 2026-07-09T00:00:00Z Content type: article Language: en Sources: [Redpanda]() Topics: [Artificial Intelligence](), [agent observability](), [Amazon API Gateway](), [AWS IAM](), [observability](), [SIEM, Security](), [Amazon Web Services]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [api](), [api-gateway](), [aws](), [bedrock](), [enterprise](), [governance](), [iam](), [identity](), [identity-management](), [llm](), [models](), [observability](), [siem](), [thought-leadership](), [token](), [tool](), [tools]() ### AI overview The article defines an Agentic Data Plane as a governed governance and runtime layer between enterprise AI agents and the data, tools, identities, and models they access. It explains why existing IAM, API gateways, and observability or SIEM systems do not adequately govern agent-specific actions, identity propagation, model selection, token spending, policy enforcement, and end-to-end tracing. ### Source excerpt The Agentic Data Plane is the governance and runtime layer that connects your AI agents to everything they act on. Learn what it does, why existing tools can't replace it, and what to look for in an enterprise-grade one. ## Audit trails are a feature, not a compliance tax DevFeed: [Audit trails are a feature, not a compliance tax]() Original publisher: [Read original article]() Author: Mohit Bansal Published: 2026-06-04T00:00:00Z Content type: article Language: en Sources: [Webflow Blog]() Topics: [Logging](), [log management](), [SIEM, Security](), [Security]() Tags: [compliance](), [critical-infrastructure](), [logging](), [logs](), [nis2](), [security](), [siem](), [soc-2]() ### AI overview The article argues that audit logging has evolved from an overlooked compliance requirement into a product capability. Queryable, timestamped logs can support sales, vendor evaluations, accountability for AI agents, and more complete breach reconstruction. ### Source excerpt Logging used to satisfy auditors. Now it closes deals, holds AI agents accountable, and decides whether you can reconstruct a breach. ## Stytch & Latacora: A Security Partnership Retrospective DevFeed: [Stytch & Latacora: A Security Partnership Retrospective]() Original publisher: [Read original article]() Published: 2026-05-22T16:00:00Z Content type: article Language: en Sources: [Latacora]() Topics: [Security](), [Authentication](), [Incident response](), [SIEM, Security, Observability](), [supply chain attacks](), [MFA]() Tags: [2025](), [acquisition](), [authentication](), [incident-response](), [integration](), [partnership](), [retrospective](), [security](), [siem](), [supply-chain-attacks]() ### AI overview A retrospective on Stytch and Latacora's security partnership from 2021 through Stytch's acquisition by Twilio. It describes building security into passwordless authentication infrastructure, scaling detection and response, addressing SAML vulnerabilities and supply chain attacks, and maintaining monitoring during the acquisition. ### Source excerpt From growing startup to Twilio integration # Stytch and Latacora worked side by side to ensure that the developers and end users relying on Stytch's platform benefited from a security program built for the sensitivity and criticality of the data involved. This journey, which began in February 2021, saw Stytch grow from an ambitious startup building passwordless authentication infrastructure into a mature platform, ultimately acquired by Twilio. ## How to Design SIEM Alerts for Real-Time Application Security Monitoring DevFeed: [How to Design SIEM Alerts for Real-Time Application Security Monitoring]() Original publisher: [Read original article]() Author: Muhammed Ali Published: 2026-05-21T07:00:00Z Content type: tutorial Language: en Sources: [Honeybadger]() Topics: [SIEM, Security](), [Security](), [Application Security](), [Monitoring](), [threat detection](), [real-time]() Tags: [application-security](), [devops](), [devops-articles](), [how-to](), [monitoring](), [real-time](), [security](), [security-events](), [siem](), [threat-detection]() ### AI overview This tutorial explains SIEM alerts, their role in application security, and how SIEM platforms aggregate and correlate logs and security events to identify suspicious behavior. It also provides practical alert examples and describes configuring simple alerts with Honeybadger Insights. ### Source excerpt SIEM alerts help you detect suspicious behavior before it becomes a breach. But security monitoring can quickly turn into noisy dashboards and missed threats without the right approach. Read this article to learn how to design effective SIEM alerts and implement real-time security monitoring. ## Кто выпустил гончую. Ищем следы коллекторов BloodHound в логах Windows DevFeed: [Кто выпустил гончую. Ищем следы коллекторов BloodHound в логах Windows]() Original publisher: [Read original article]() Author: StepVolg ("Лаборатория Касперского") Published: 2026-04-24T12:37:53Z Content type: tutorial Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [Endpoint Security & XDR](), [Windows](), [SOC]() Tags: [active-directory](), [bloodhound](), [enumerate](), [red-teaming](), [sharphound](), [siem](), [soc](), [windows](), [windows-1ad1db2b7e3a]() ### AI overview The article examines traces left by BloodHound collectors in Windows logs and discusses detecting Active Directory reconnaissance activity. ### Source excerpt Служба каталогов Active Directory остается одной из самых популярных целей как среди злоумышленников, так и среди специалистов по Red Teaming и пентестеров. С выходом новых версий операционных систем семейства Windows продолжают появляться новые векторы атак на AD, например атаки на Delegated Managed Service Accounts (dMSA) в 2025-м. В ходе каждой атаки есть этап сбора информации, обнаружение которого является более сложной задачей, чем кажется на первый взгляд. Согласно аналитическому отчету нашего сервиса MDR за 2025 год в целом обнаружение данного этапа атак затруднено из-за большого количества ложных срабатываний, что снижает качество обнаружения и уменьшает вероятность предотвращения атаки, особенно в больших инфраструктурах с тысячами активов. Меня зовут Степан Ляхов, я работаю старшим инженером SOC в "Лаборатории Касперского". В этой статье я хочу рассмотреть один из самых популярных инструментов для сбора информации о домене Active Directory, разобрать, какие следы он оставляет в журналах и как обнаружить его активность. Читать далее ## PCI DSS Compliance: What Digital Businesses Need to Know DevFeed: [PCI DSS Compliance: What Digital Businesses Need to Know]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-04-15T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [Security](), [Social engineering](), [Network Segmentation](), [TLS (Transport Layer Security)](), [vulnerability management](), [SIEM, Security](), [Software as a service](), [tokenization]() Tags: [compliance](), [digital-products](), [firewalls](), [mfa](), [network-segmentation](), [pci-dss](), [saas](), [scope](), [security](), [siem](), [tls](), [tokenization](), [vulnerability-management]() ### AI overview This guide explains how PCI DSS applies to digital businesses that accept card payments, including SaaS companies and sellers of digital products. It outlines the standard's 12 requirements and discusses controls for networks, account data, vulnerabilities, access, monitoring, and information security. It also covers card-not-present transactions, recurring billing, and tokenization. ### Source excerpt PCI DSS compliance explained for digital businesses. Understand the 12 requirements, compliance levels, and how to reduce your scope when selling digital products online. ## Logging for Detection and Response: How We Build Security Signals at Cockroach Labs DevFeed: [Logging for Detection and Response: How We Build Security Signals at Cockroach Labs]() Original publisher: [Read original article]() Author: Munir Jaber Published: 2026-01-15T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [Logging](), [Security](), [Incident response](), [CockroachDB](), [Architecture & Design](), [SIEM, Security]() Tags: [architecture](), [cockroachdb](), [incident-response](), [logging](), [security](), [siem](), [testing]() ### AI overview Cockroach Labs describes a security logging architecture for Detection and Response around CockroachDB and its supporting cloud services. The approach prioritizes logs that capture meaningful behaviors, support event reconstruction, and provide useful signals for detection and incident response, with detection rules reviewed and tested like software. ### Source excerpt Modern applications rely on CockroachDB for workloads where resilience, correctness and availability are absolutely critical. Whether it's being deployed for payment systems, identity provider systems, or transactional systems, one thing is certain: If the underlying database platform of these applications isn't secure, nothing built on top of it can be truly secure, either. ## Bit by bit: how Latacora helped Notion build security that scales DevFeed: [Bit by bit: how Latacora helped Notion build security that scales]() Original publisher: [Read original article]() Published: 2025-08-29T16:55:00Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Notion](), [Security](), [Application Security](), [cloud-infrastructure](), [GitHub](), [Google Cloud Platform (GCP)](), [SIEM, Security]() Tags: [application-security](), [aws](), [azure](), [cloud](), [cloud-infrastructure](), [github](), [google-cloud](), [security](), [siem]() ### AI overview A case study of how Notion partnered with Latacora from 2019 to build a security program while the company was growing, designing an API, and responding to customer security questions. The engagement covered foundational security work, hiring decisions, cloud and developer platforms, and SIEM tooling. ### Source excerpt Security rarely tops the priority list for startups - but that doesn't make it optional. Running a startup is no small feat. Facing enormous pressure to address a never-ending list of priorities (finding market fit, fundraising, launching new features, scaling infrastructure, etc.) security often becomes a "later" issue......until it can't be. Even when companies know they need help, the breadth of the problem can be intimidating. Application security, cloud infrastructure, third-party vendors, compliance, cryptography: any resource-constrained startup will be hard-pressed to find a unicorn hire who can own all these responsibilities equally well. ## AI Agents in Cybersecurity: Revolutionizing AppSec DevFeed: [AI Agents in Cybersecurity: Revolutionizing AppSec]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2025-08-14T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Agent](), [Cybersecurity](), [Application Security](), [Security](), [incident](), [SIEM, Security]() Tags: [agents](), [ai](), [ai-agents](), [application-security](), [blog](), [cybersecurity](), [incident-response](), [interest](), [security](), [siem](), [telemetry]() ### AI overview This article explains how autonomous AI agents are changing application security and cybersecurity. It contrasts them with traditional AI and SIEM-based workflows, describing adaptive threat analysis, multi-modal data processing, autonomous countermeasures, and integration with endpoint protection, network monitoring, and incident response. It also introduces the BDI model and notes that many organizations are still implementing and testing these systems. ### Source excerpt We are witnessing a shift from reactive to proactive application security, with AI agents operating in autonomy. What are the benefits, risks & best practices of AI agents implementation in AppSec? ## Know your tools: The full range of Elastic Security's detection engineering capabilities DevFeed: [Know your tools: The full range of Elastic Security's detection engineering capabilities]() Original publisher: [Read original article]() Author: Kseniia Ignatovych Published: 2024-11-12T05:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Detection engineering](), [Security](), [SIEM, Security](), [threat detection](), [alert triage](), [Tooling]() Tags: [alert-fatigue](), [alert-triage](), [automated](), [automated-threat-protection-cybersecurity-defense-security-compliance](), [blog](), [detection-engineering](), [elastic](), [features](), [latest-features](), [quality](), [security](), [security-siem](), [siem](), [threat-detection](), [tools](), [workflows]() ### AI overview This Elastic Security blog provides an overview of detection engineering capabilities, including customizable prebuilt rules, alert suppression, manual rule runs, automated case creation, and machine learning jobs. ### Source excerpt This blog provides a comprehensive overview of the detection capabilities available in Elastic Security. Learn about the latest features and get useful tips and tricks for your detection practice! ## Frequently Asked Questions from Strange Loop 2023 DevFeed: [Frequently Asked Questions from Strange Loop 2023]() Original publisher: [Read original article]() Published: 2023-09-27T20:37:33Z Content type: opinion Language: en Sources: [Latacora]() Topics: [Security](), [Application Security](), [Security & compliance, Cloud security]() Tags: [application-security](), [cloud-security](), [conference](), [developer](), [incident-response](), [it-security](), [security](), [siem]() ### AI overview Latacora describes its sponsorship of Strange Loop 2023, the questions attendees asked at its booth, and its security consultancy and service offerings. The article says the sponsorship was intended to support a developer-focused conference and bring people together, rather than generate sales leads or job applicants. ### Source excerpt The last Strange Loop conference was held September 21-22, 2023 at St. Louis Union Station. The conference is targeted towards developers; the speakers are often sharing their knowledge on new and inventive ways to use technology. At our sponsor booth at Union Station, attendees asked two (okay, three) questions most often: What is Latacora? Your name is on the lanyards, and I'm curious to know what you do. Why sponsor Strange Loop? Can I take a plant? The first one isn't hard for the folks from our team: Latacora is a consultancy that bootstraps security for startups. We have a team of experts helping our clients with most security-related things: application security, cloud security, corporate security, compliance, and more. We also have a team of security architects, cryptographers, and project managers supporting our clients. These professionals are equipped with power tools built to make their jobs more efficient and to help our clients improve their security posture.