# SIEM, Security Security information and event management (SIEM) is a security application that gathers security data from information-system components and presents actionable information through a single interface. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Architecting a secure landing zone in the AWS European Sovereign Cloud DevFeed: [Architecting a secure landing zone in the AWS European Sovereign Cloud]() Original publisher: [Read original article]() Author: Pablo Pagani Published: 2026-09-16T21:20:48Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Cloud](), [Architecture & Design](), [AWS IAM](), [Infrastructure as code](), [CI/CD](), [SIEM, Security](), [Incident response]() Tags: [advanced-300](), [aws](), [aws-identity-and-access-management-iam](), [ci-cd](), [cloud](), [eu](), [europe](), [incident-response](), [infrastructure-as-code-iac](), [partition](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article explains how to architect a secure, scalable landing zone in the AWS European Sovereign Cloud. It describes the aws-eusc partition boundary and covers governance, identity, logging, data protection, network design, CI/CD, artifact distribution, and incident response. ### Source excerpt The AWS European Sovereign Cloud is a new, independent cloud for Europe, physically and logically separate from existing AWS Regions and operated within the European Union (EU). It provides the same services, features, and APIs as AWS commercial Regions, but runs as a distinct AWS partition (aws-eusc), with its own control plane, AWS Identity and [...] ## Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines DevFeed: [Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines]() Original publisher: [Read original article]() Author: Zara Boddula; Danielle Park Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [Datadog | The Monitor blog]() Topics: [observability pipelines](), [SIEM, Security](), [Security](), [log management](), [Microsoft]() Tags: [azure](), [cisco-meraki](), [devsecops](), [fortigate](), [log-management](), [logs](), [observability-pipelines](), [pipelines](), [security](), [siem](), [telemetry](), [threat-detection]() ### AI overview Datadog's Observability Pipelines Packs transform firewall, VPN, and network detection logs into Microsoft Sentinel table schemas before ingestion. The post describes Packs for Palo Alto Networks, Fortinet, Cisco ASA, Cisco Meraki, and ExtraHop, including filtering and noise reduction to help control Sentinel ingest volume while retaining visibility. ### Source excerpt Learn how Observability Pipelines Packs map security logs to Microsoft Sentinel schemas and help control downstream ingest volume. ## ClickHouse welcomes RunReveal DevFeed: [ClickHouse welcomes RunReveal]() Original publisher: [Read original article]() Author: ClickHouse Published: 2026-09-01T22:01:39Z Content type: news Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [SIEM, Security](), [Database](), [telemetry](), [agent observability]() Tags: [ai-agents](), [clickhouse](), [database](), [logs](), [security](), [telemetry]() ### AI overview ClickHouse announces its acquisition of RunReveal, a security data platform built on ClickHouse. The article discusses security-data workloads, continued RunReveal support, and plans to apply the team's expertise to security and agentic investigations. ### Source excerpt Security is the largest and fastest growing data workload in the enterprise, and today, ClickHouse has acquired RunReveal. ## VAST Data CrowdStrike Integration Goes Live: Native Falcon Sensor Now, Next-Gen SIEM and AIDR in Preview DevFeed: [VAST Data CrowdStrike Integration Goes Live: Native Falcon Sensor Now, Next-Gen SIEM and AIDR in Preview]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-01T15:37:31Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [Cybersecurity](), [Securing AI](), [AI Infrastructure](), [SIEM, Security](), [SIEM, Security, Observability](), [prompt injection](), [Jailbreak](), [pii](), [Retrieval Augmented Generation (RAG)](), [Nvidia]() Tags: [ai](), [ai-infrastructure](), [ai-security](), [cybersecurity](), [enterprise](), [infrastructure](), [nvidia](), [pii](), [prompt-injection](), [security]() ### AI overview VAST Data and CrowdStrike have launched an integration that embeds Falcon security capabilities into VAST AI storage infrastructure, data pipelines, and production AI workloads. The integration supports native Falcon sensors, sends VAST audit telemetry to CrowdStrike Next-Gen SIEM, inspects data in flight with Falcon AIDR, helps identify PII before downstream use, and detects prompt injection and jailbreak attempts during model interactions. ### Source excerpt VAST Data and CrowdStrike are turning the AI security partnership they announced at VAST Forward in February into a shipping product, detailing a multi-layered integration that embeds enterprise-grade cybersecurity directly into AI storage infrastructure, data pipelines, and production AI workloads. By combining the VAST AI Operating System with the CrowdStrike Falcon platform, the collaboration addresses The post VAST Data CrowdStrike Integration Goes Live: Native Falcon Sensor Now, Next-Gen SIEM and AIDR in Preview appeared first on StorageReview.com. ## Centralize human and agentic work with Datadog Work Management DevFeed: [Centralize human and agentic work with Datadog Work Management]() Original publisher: [Read original article]() Author: Roxanne Moslehi Published: 2026-08-18T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [AI Agent](), [incident](), [site-reliability-engineering](), [Slack](), [SRE](), [SIEM, Security](), [GitHub](), [error tracking](), [dashboards](), [Traces]() Tags: [agentic](), [ai](), [ai-agent](), [cloud-siem](), [dashboards](), [devops](), [devsecops](), [error-tracking](), [github](), [incident](), [management](), [slack](), [sre](), [traces](), [work-management](), [workflow-automation]() ### AI overview Datadog Work Management centralizes work created by people, automations, and Datadog AI agents. It preserves context from logs, traces, monitors, alerts, ownership, assignments, approvals, artifacts, and activity while integrating with Datadog and external collaboration systems. ### Source excerpt Learn how Datadog Work Management helps you coordinate human and AI agent-driven work while preserving context, ownership, and activity across tools. ## Audit Log Drains now support Datadog, Splunk, and Panther DevFeed: [Audit Log Drains now support Datadog, Splunk, and Panther]() Original publisher: [Read original article]() Author: Nate McGrady Published: 2026-08-07T04:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [SIEM, Security](), [Streaming](), [Amazon S3](), [SIEM, Security, Observability]() Tags: [amazon-s3](), [datadog](), [documentation](), [enterprise](), [integration](), [logs](), [migration](), [migration-guide](), [s3](), [streaming]() ### AI overview Vercel Audit Log Drains can stream team audit events and metadata to Datadog, Splunk, or Panther, in addition to custom HTTPS endpoints and Amazon S3. The feature is available on Enterprise plans and replaces Custom SIEM Log Streaming. ### Source excerpt Audit Log Drains now stream your team's audit events into Datadog, Splunk, and Panther, joining the existing custom HTTPS endpoint and Amazon S3 destinations. An Audit Log Drain forwards every event from your team's Activity Log, plus additional audit metadata, to the destination you choose. They're available on Enterprise plans. To create one, go to Drains in your team settings. Click Add Drain, choose Audit Log as the data type, and pick a destination. Audit Log Drains replace Custom SIEM Log Streaming. If you already stream audit logs to a SIEM, follow the migration guide to move your integration over. Learn more about Drains in the documentation. Read more ## How we secure Figma's internal systems with agents DevFeed: [How we secure Figma's internal systems with agents]() Original publisher: [Read original article]() Author: Matthew Sullivan; Brad Girardeau Published: 2026-07-29T20:44:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [AI Agent](), [Security](), [SIEM, Security](), [cloud-infrastructure](), [Amazon Bedrock](), [Cloud](), [Pull Request](), [Code](), [Vulnerabilities](), [Large Language Model]() Tags: [agents](), [ai-agent](), [bedrock](), [cloud](), [cloud-infrastructure](), [code](), [llm](), [pull-request](), [security](), [vulnerabilities]() ### AI overview Figma's security team built an AI agent that triages alerts, investigates incidents, queries security data, writes fixes, opens pull requests, and retains knowledge from prior investigations. The system reduced alert time to resolution by 71% and changed how on-call engineers handle security work. ### Source excerpt Our security team built an AI agent that triages alerts, conducts forensic investigations, queries our security data lake, writes code to fix issues--and remembers what it learns. Here's how we cut alert time-to-resolution by 71% and fundamentally changed how our on-call engineers work. ## How we brought agentic workflows to Cloud SIEM with the Datadog MCP Server DevFeed: [How we brought agentic workflows to Cloud SIEM with the Datadog MCP Server]() Original publisher: [Read original article]() Author: Chelsea Xu; Eddie Cai; Romain Kirszbaum; Mohamed Hachem Ouertani Published: 2026-07-17T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [SIEM, Security](), [MCP Server](), [Model Context Protocol](), [Security & compliance, Cloud security](), [real user monitoring]() Tags: [agent-observability](), [agentic](), [ai](), [ai-impact](), [cloud-security](), [context-window](), [eval](), [mcp](), [mcp-server](), [real-user-monitoring](), [security](), [tool](), [workflows]() ### AI overview This article explains how Datadog built MCP tools for Cloud SIEM to support agentic security workflows. It covers tool scoping based on user behavior, progressive disclosure for managing a shared context window, custom evaluation of non-deterministic agent behavior, and governance of a growing multi-team toolset. ### Source excerpt See how we built MCP tools for Cloud SIEM, using usage data, progressive disclosure, and a custom eval framework to keep a multi-team agentic toolset reliable. ## Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM DevFeed: [Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM]() Original publisher: [Read original article]() Author: Danielle Park Published: 2026-06-24T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [observability pipelines](), [SIEM, Security](), [SIEM, Security, Observability](), [log management](), [Incident response](), [Threat Hunting & Intel](), [Firewall](), [MFA](), [Amazon Web Services](), [DDoS]() Tags: [api](), [aws](), [cloud-siem](), [devsecops](), [firewall](), [incident](), [incident-response](), [log-management](), [logs](), [malware](), [mfa](), [network](), [observability](), [observability-pipelines](), [security](), [techniques](), [threat-detection]() ### AI overview This article explains how Observability Pipelines uses MITRE ATT&CK Enrichment Packs to automatically map security logs and events to common attacker tactics and techniques before they reach a SIEM, data lake, or archive. It describes the initial packs for Okta, Palo Alto, FortiGate, and AWS WAF, covering identity, firewall, network, and web security activity. ### Source excerpt Learn how Observability Pipelines enriches security logs with MITRE ATT&CK tactics and techniques before routing them to your SIEM or storage destination. ## Detecting the Klue supply chain attack in Salesforce instances DevFeed: [Detecting the Klue supply chain attack in Salesforce instances]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [SIEM, Security](), [REST API](), [OAuth](), [API](), [incident](), [Python](), [data](), [Back end](), [Network]() Tags: [api](), [backend](), [cloud-siem](), [data](), [external](), [incident](), [infrastructure](), [integration](), [logs](), [oauth](), [python](), [rest-api](), [salesforce](), [supply-chain](), [tokens]() ### AI overview This article summarizes the Klue supply chain attack, in which a threat actor abused a dormant integration credential to obtain OAuth tokens and query connected Salesforce environments through automated Python REST API calls. It reconstructs the attack timeline and provides detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. ### Source excerpt We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM. ## Audit trails are a feature, not a compliance tax DevFeed: [Audit trails are a feature, not a compliance tax]() Original publisher: [Read original article]() Author: Mohit Bansal Published: 2026-06-04T00:00:00Z Content type: article Language: en Sources: [Webflow Blog]() Topics: [Logging](), [log management](), [SIEM, Security](), [Security]() Tags: [compliance](), [critical-infrastructure](), [logging](), [logs](), [nis2](), [security](), [siem](), [soc-2]() ### AI overview The article argues that audit logging has evolved from an overlooked compliance requirement into a product capability. Queryable, timestamped logs can support sales, vendor evaluations, accountability for AI agents, and more complete breach reconstruction. ### Source excerpt Logging used to satisfy auditors. Now it closes deals, holds AI agents accountable, and decides whether you can reconstruct a breach. ## How to Design SIEM Alerts for Real-Time Application Security Monitoring DevFeed: [How to Design SIEM Alerts for Real-Time Application Security Monitoring]() Original publisher: [Read original article]() Author: Muhammed Ali Published: 2026-05-21T07:00:00Z Content type: tutorial Language: en Sources: [Honeybadger]() Topics: [SIEM, Security](), [Security](), [Application Security](), [Monitoring](), [threat detection](), [real-time]() Tags: [application-security](), [devops](), [devops-articles](), [how-to](), [monitoring](), [real-time](), [security](), [security-events](), [siem](), [threat-detection]() ### AI overview This tutorial explains SIEM alerts, their role in application security, and how SIEM platforms aggregate and correlate logs and security events to identify suspicious behavior. It also provides practical alert examples and describes configuring simple alerts with Honeybadger Insights. ### Source excerpt SIEM alerts help you detect suspicious behavior before it becomes a breach. But security monitoring can quickly turn into noisy dashboards and missed threats without the right approach. Read this article to learn how to design effective SIEM alerts and implement real-time security monitoring. ## PCI DSS Compliance: What Digital Businesses Need to Know DevFeed: [PCI DSS Compliance: What Digital Businesses Need to Know]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-04-15T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [Security](), [Social engineering](), [Network Segmentation](), [TLS (Transport Layer Security)](), [vulnerability management](), [SIEM, Security](), [Software as a service](), [tokenization]() Tags: [compliance](), [digital-products](), [firewalls](), [mfa](), [network-segmentation](), [pci-dss](), [saas](), [scope](), [security](), [siem](), [tls](), [tokenization](), [vulnerability-management]() ### AI overview This guide explains how PCI DSS applies to digital businesses that accept card payments, including SaaS companies and sellers of digital products. It outlines the standard's 12 requirements and discusses controls for networks, account data, vulnerabilities, access, monitoring, and information security. It also covers card-not-present transactions, recurring billing, and tokenization. ### Source excerpt PCI DSS compliance explained for digital businesses. Understand the 12 requirements, compliance levels, and how to reduce your scope when selling digital products online. ## Logging for Detection and Response: How We Build Security Signals at Cockroach Labs DevFeed: [Logging for Detection and Response: How We Build Security Signals at Cockroach Labs]() Original publisher: [Read original article]() Author: Munir Jaber Published: 2026-01-15T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [Logging](), [Security](), [Incident response](), [CockroachDB](), [Architecture & Design](), [SIEM, Security]() Tags: [architecture](), [cockroachdb](), [incident-response](), [logging](), [security](), [siem](), [testing]() ### AI overview Cockroach Labs describes a security logging architecture for Detection and Response around CockroachDB and its supporting cloud services. The approach prioritizes logs that capture meaningful behaviors, support event reconstruction, and provide useful signals for detection and incident response, with detection rules reviewed and tested like software. ### Source excerpt Modern applications rely on CockroachDB for workloads where resilience, correctness and availability are absolutely critical. Whether it's being deployed for payment systems, identity provider systems, or transactional systems, one thing is certain: If the underlying database platform of these applications isn't secure, nothing built on top of it can be truly secure, either. ## Know your tools: The full range of Elastic Security's detection engineering capabilities DevFeed: [Know your tools: The full range of Elastic Security's detection engineering capabilities]() Original publisher: [Read original article]() Author: Kseniia Ignatovych Published: 2024-11-12T05:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Detection engineering](), [Security](), [SIEM, Security](), [threat detection](), [alert triage](), [Tooling]() Tags: [alert-fatigue](), [alert-triage](), [automated](), [automated-threat-protection-cybersecurity-defense-security-compliance](), [blog](), [detection-engineering](), [elastic](), [features](), [latest-features](), [quality](), [security](), [security-siem](), [siem](), [threat-detection](), [tools](), [workflows]() ### AI overview This Elastic Security blog provides an overview of detection engineering capabilities, including customizable prebuilt rules, alert suppression, manual rule runs, automated case creation, and machine learning jobs. ### Source excerpt This blog provides a comprehensive overview of the detection capabilities available in Elastic Security. Learn about the latest features and get useful tips and tricks for your detection practice! ## Introducing Log Drains DevFeed: [Introducing Log Drains]() Original publisher: [Read original article]() Author: Lee TzeYiing Published: 2024-08-15T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [Logging](), [observability pipelines](), [Supabase](), [SIEM, Security](), [observability](), [Self-hosted](), [Cross-origin resource sharing (CORS)](), [backends](), [JSON](), [BigQuery](), [PostgreSQL]() Tags: [analytics](), [bigquery](), [datadog](), [http](), [json](), [logging](), [logs](), [monitoring](), [observability](), [observability-pipelines](), [postgresql](), [product](), [security](), [self-hosted](), [self-hosting]() ### AI overview Supabase introduces Log Drains for Team and Enterprise users, enabling logs from Database, Storage, Realtime, and Auth to be exported to Datadog Logs or custom HTTP endpoints. The feature supports alerting, observability pipelines, SIEM integrations, extended retention, self-hosting, and local development. ### Source excerpt Log Drains for exporting product logs is now available under Public Alpha ## Application vulnerability management best practices DevFeed: [Application vulnerability management best practices]() Original publisher: [Read original article]() Author: Mariah Gresham Published: 2024-08-06T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [vulnerability management](), [DevSecOps](), [vulnerability](), [Security](), [Monitoring](), [configuration](), [Deployment](), [SIEM, Security](), [App]() Tags: [application-security](), [awareness](), [blog](), [configuration](), [deployment](), [devops](), [devsecops](), [env-file-security](), [iac](), [infrastructure-as-code](), [interest](), [megawatt](), [monitoring](), [security](), [snyk-platform](), [tools](), [vulnerability](), [vulnerability-management]() ### AI overview This article explains application vulnerability management as a lifecycle approach for identifying, classifying, remediating, mitigating, reporting, and continuously monitoring application vulnerabilities. It describes how DevSecOps practices such as containerization, infrastructure as code, AI coding assistants, and third-party code require security teams to adapt existing techniques. It also covers enterprise practices including automation, management tools, SIEM systems, and regulatory mapping. ### Source excerpt Learn about application vulnerability management, including its basic definition, what it can and cannot do, and how to supplement it with best practices. ## Reducing false positives with automated SIEM investigations from Elastic and Tines DevFeed: [Reducing false positives with automated SIEM investigations from Elastic and Tines]() Original publisher: [Read original article]() Author: Aaron Jewitt Published: 2024-05-31T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [SIEM, Security](), [SOC](), [Security](), [elasticsearch](), [Amazon Web Services](), [Software as a service](), [API]() Tags: [analysts](), [api](), [automated-threat-protection-anomaly-detection-cybersecurity-network-visibility-security-analytic](), [aws](), [blog-post](), [elastic](), [endpoint-security-security](), [false-positives](), [logs](), [security](), [server](), [soc](), [token](), [workflows]() ### AI overview Elastic's InfoSec team uses Tines to automate initial SIEM alert investigations, helping reduce false positives and analyst fatigue. The workflow queries Elasticsearch using alert data such as source.ip, closes alerts associated with trusted devices or known benign activity, and escalates cases that cannot be resolved automatically. ### Source excerpt Discover how Elastic's InfoSec team saves thousands of hours per month by using Tines to automate SIEM alert investigations while reducing false positives and detect compromised accounts. ## Rolling your own Detections as Code with Elastic Security DevFeed: [Rolling your own Detections as Code with Elastic Security]() Original publisher: [Read original article]() Author: Mika Ayenson,Kseniia Ignatovych,Justin Ibarra Published: 2024-05-14T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Detection engineering](), [Security](), [Code](), [CI/CD](), [SIEM, Security](), [Tooling]() Tags: [automated-threat-protection-cybersecurity-devops-open-security](), [ci-cd](), [devops](), [research](), [review](), [security](), [siem-security](), [testing](), [tooling]() ### AI overview Elastic describes how its detection-rules repository supports Detections as Code, including rule-management tooling, tests, CLI commands, and automation. The article explains how teams can adapt these capabilities for custom detection-rule management using peer review, testing, and CI/CD practices. ### Source excerpt Detections as Code (DaC) is transforming security rule management. Learn about Elastic's latest enhancements in the detection-rules repo, how to leverage it for custom rule management, and our comprehensive guide for adopting DaC.