# threat detection Threat detection is a security strategy for identifying deviations from expected actions using collected, analyzed, and correlated data. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Abnormal AI: Amazon Bedrock AgentCore for agentic email security at scale DevFeed: [Abnormal AI: Amazon Bedrock AgentCore for agentic email security at scale]() Original publisher: [Read original article]() Author: Aswin Vasudevan Published: 2026-09-14T21:22:45Z Content type: article Language: en Sources: [Artificial Intelligence]() Topics: [Amazon Bedrock AgentCore](), [threat detection](), [Amazon Bedrock](), [Security](), [Serverless](), [API](), [Amazon Web Services](), [AWS CloudTrail](), [Amazon CloudWatch](), [Amazon S3]() Tags: [advanced-300](), [agentic](), [agents](), [amazon-bedrock-agentcore](), [amazon-cloudwatch](), [amazon-s3](), [analysis](), [api](), [aws](), [aws-cloudtrail](), [code](), [customer-solutions](), [data](), [data-processing](), [security](), [serverless](), [threat-detection]() ### AI overview Abnormal AI uses Amazon Bedrock AgentCore Code Interpreter as an ephemeral, serverless compute scratch pad for real-time inline email threat detection. The article describes its sandbox isolation, networking and file-handling options, preloaded Python capabilities, observability integrations, and use at billion-message scale. ### Source excerpt Learn how Abnormal AI deployed Amazon Bedrock AgentCore Code Interpreter as an ephemeral compute scratch pad for the agents behind its real-time email threat detection at billion-message scale, plus the sandbox design decisions and practical lessons for builders deploying Code Interpreter in production. ## Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection DevFeed: [Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection]() Original publisher: [Read original article]() Author: Osher Jacob Published: 2026-09-14T10:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [AWS CloudTrail](), [Cloud](), [threat detection](), [Threat Research](), [SIEM, Security, Observability](), [Machine learning](), [Algorithms](), [SQL](), [IAM](), [identity and access management](), [Amazon Web Services]() Tags: [algorithms](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [cloud](), [cloud-cybersecurity-research](), [cloud-detection](), [devops](), [iam](), [identity-and-access-management](), [logs](), [machine-learning](), [post](), [sql](), [threat-detection](), [threat-research]() ### AI overview This article presents a behavioral clustering model for mapping cloud identities to functional roles using activity patterns from audit logs. It applies unsupervised machine learning with UMAP and HDBSCAN to data from more than 40,000 identities across 125 cloud environments, and shows how the resulting map can support automated threat detection. The article also explains how lightweight heuristics extracted from the map can classify identities at scale using standard SQL, reducing the need for continuous resource-intensive machine learning pipelines. ### Source excerpt We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42. ## AuthKit vs Better Auth for B2B SaaS DevFeed: [AuthKit vs Better Auth for B2B SaaS]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Software as a service](), [Single sign-on (SSO)](), [Security](), [log management](), [threat detection](), [Frameworks](), [MFA](), [Passkeys]() Tags: [auth](), [comparison](), [enterprise](), [logs](), [mfa](), [saas](), [security](), [threat-detection](), [vercel]() ### AI overview This comparison examines AuthKit and Better Auth as platforms for B2B SaaS products selling to enterprise IT buyers. It argues that both now provide core capabilities such as SSO, SCIM, and audit logs, so the meaningful differences are provider coverage, where user lifecycle management begins, and contractual responsibility. The article also describes Better Auth's hosted infrastructure, dashboard, SIEM drain, self-service provisioning, and threat detection features, while noting its convergence with AuthKit on enterprise requirements. ### Source excerpt Both ship SSO, SCIM and audit logs now. The comparison that decides enterprise deals has moved to the long tail: provider coverage, where user lifecycle actually starts, and who is contractually on the hook. ## Welcome to APNIC 62 DevFeed: [Welcome to APNIC 62]() Original publisher: [Read original article]() Author: Timothy Hildred Published: 2026-09-08T03:33:07Z Content type: article Language: en Sources: [APNIC Blog]() Topics: [Internet](), [Networks](), [Cybersecurity](), [DNSSEC](), [threat detection](), [Threat Research](), [FIRST]() Tags: [apnic-62](), [community](), [conference](), [conferences](), [cybersecurity](), [dnssec](), [event](), [events](), [india](), [ipv4](), [ipv6](), [nixi](), [nro](), [policy-sig](), [tech-matters](), [threat-detection]() ### AI overview APNIC 62 in Mumbai previews technical, security, IPv6 deployment, DNSSEC, threat-detection, community, and policy sessions, alongside keynote talks, social events, newcomer activities, and NRO NC voting information. ### Source excerpt APNIC welcomes you to Mumbai, India for APNIC 62. Here is what you can look forward to over the coming days. ## Machine vs. machine: The new reality of cybersecurity in ANZ DevFeed: [Machine vs. machine: The new reality of cybersecurity in ANZ]() Original publisher: [Read original article]() Author: Jeremy Pell Published: 2026-08-26T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Cybersecurity](), [Frontier AI](), [Threat Research](), [threat detection](), [data-architecture](), [AI Platforms/Deployment](), [Security & Privacy]() Tags: [agentic-ai-cybersecurity-security-research](), [australia](), [compliance](), [cybersecurity](), [data-architecture](), [endpoint-security-siem-security](), [frontier-ai](), [policy](), [research](), [threat-detection]() ### AI overview Frontier AI is accelerating cyberattacks across Australia and New Zealand to machine speed, while defensive capabilities, policy, data visibility, and operational security are struggling to keep pace. Survey findings from more than 850 IT and cybersecurity professionals highlight gaps between regulatory intent and real-world protection, as well as the need for searchable, unified data architectures to support reliable AI-enabled defence. ### Source excerpt Frontier AI has accelerated cyber threats to machine speed, leaving many ANZ organisations vulnerable. Our latest research reveals how fragmented data and visibility gaps hinder defence and why a unified platform is essential to battle threats. ## Runtime security monitoring and threat detection: Protecting production without slowing developers DevFeed: [Runtime security monitoring and threat detection: Protecting production without slowing developers]() Original publisher: [Read original article]() Author: Ajay Chankramath Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [threat detection](), [Platform Engineering](), [Monitoring](), [Security](), [Containers](), [internal developer platform](), [eBPF](), [Network](), [Processes]() Tags: [blog-post](), [containers](), [developer](), [ebpf](), [firewalls](), [internal-developer-platform](), [monitoring](), [network](), [platform](), [platform-engineering](), [processes](), [security](), [threat-detection]() ### AI overview This article explains how runtime security monitoring protects production workloads from threats that static scans may miss, including privilege escalation, container escapes, unexpected processes, sensitive file access, and suspicious network connections. It presents kernel-level monitoring, including eBPF, as a way to provide continuous protection while embedding security policies into the platform and minimizing developer friction. ### Source excerpt Runtime security monitoring detects zero-days, container escapes, and privilege escalations in production. Discover how eBPF enables 'invisible, always-on' protection for platform engineers ## Preparing for OMB M-26-14: How Datadog supports federal logging maturity DevFeed: [Preparing for OMB M-26-14: How Datadog supports federal logging maturity]() Original publisher: [Read original article]() Author: Chris Leffler; Sophie Wang Published: 2026-06-29T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [SIEM, Security, Observability](), [log management](), [Monitoring](), [threat detection](), [incident](), [Incident response](), [observability](), [Security](), [Security Operations Center](), [Resilience](), [Cybersecurity]() Tags: [bits-ai](), [cloud-siem](), [compliance](), [cybersecurity](), [fedramp](), [govcloud](), [incident-response](), [log-management](), [logging](), [monitoring](), [observability](), [resilience](), [security](), [security-operations-center](), [soc](), [systems](), [telemetry](), [threat-detection](), [workflow-automation]() ### AI overview This article explains how OMB Memorandum M-26-14 changes federal logging guidance from prescriptive requirements to a risk- and maturity-based model. It describes continuous event monitoring and threat hunting, investigation, response, and forensics, including centralized security telemetry, visibility across IT, OT, and IoT environments, threat detection, searchable and retrievable logs, cross-source correlation, incident response, and forensic analysis. It also presents Datadog as a unified observability and security platform for helping agencies meet these requirements. ### Source excerpt Learn how Datadog helps federal agencies prepare for OMB M-26-14 by providing centralized telemetry data, threat detection, and automated incident response. ## Detect source code attacks with Datadog Code Threat Detection DevFeed: [Detect source code attacks with Datadog Code Threat Detection]() Original publisher: [Read original article]() Author: Kassen Qian; Daniel Blazquez; Christoph Hamsen Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [threat detection](), [GitHub](), [GitHub Actions](), [Pull Request](), [CI/CD](), [code security](), [AI-assisted coding](), [Application Security]() Tags: [agent](), [agents](), [ai](), [attacks](), [ci](), [ci-cd](), [code-security](), [devsecops](), [github](), [github-actions](), [pull-requests](), [review](), [secrets](), [security](), [supply-chain](), [threat-detection](), [vulnerabilities]() ### AI overview Datadog Code Threat Detection analyzes GitHub pull requests with AI-assisted analysis to identify malicious code changes and attempts to compromise CI/CD pipelines, secrets, and release workflows. ### Source excerpt Learn how Datadog Code Threat Detection helps teams detect malicious pull requests and source code attacks targeting CI/CD workflows, secrets, and software releases. ## How to Design SIEM Alerts for Real-Time Application Security Monitoring DevFeed: [How to Design SIEM Alerts for Real-Time Application Security Monitoring]() Original publisher: [Read original article]() Author: Muhammed Ali Published: 2026-05-21T07:00:00Z Content type: tutorial Language: en Sources: [Honeybadger]() Topics: [SIEM, Security](), [Security](), [Application Security](), [Monitoring](), [threat detection](), [real-time]() Tags: [application-security](), [devops](), [devops-articles](), [how-to](), [monitoring](), [real-time](), [security](), [security-events](), [siem](), [threat-detection]() ### AI overview This tutorial explains SIEM alerts, their role in application security, and how SIEM platforms aggregate and correlate logs and security events to identify suspicious behavior. It also provides practical alert examples and describes configuring simple alerts with Honeybadger Insights. ### Source excerpt SIEM alerts help you detect suspicious behavior before it becomes a breach. But security monitoring can quickly turn into noisy dashboards and missed threats without the right approach. Read this article to learn how to design effective SIEM alerts and implement real-time security monitoring. ## What's New in Android Security and Privacy in 2026 DevFeed: [What's New in Android Security and Privacy in 2026]() Original publisher: [Read original article]() Author: Eugene Liderman Published: 2026-05-12T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Android](), [Android Security](), [Security](), [spoofing](), [Social engineering](), [threat detection](), [On-device AI](), [Chrome]() Tags: [ai](), [android](), [android-security](), [fraud](), [none](), [on-device-ai](), [security](), [social-engineering](), [spoofing](), [threat-detection]() ### AI overview The article describes planned Android security and privacy enhancements for 2026, including verified financial calls to combat spoofed banking scams. Android can verify incoming calls through participating financial apps and automatically end calls that are not genuine. It also highlights expanded Live Threat Detection, which uses on-device AI to analyze app behavior and warn about suspicious activity. ### Source excerpt New Android security and privacy features ## How Merkle Science fights crypto crime at scale with ClickHouse Cloud DevFeed: [How Merkle Science fights crypto crime at scale with ClickHouse Cloud]() Original publisher: [Read original article]() Author: Akshay Gupta, Lead Data Engineer, and Priyanshu Sehgal, Sr. Data Engineer Published: 2025-11-13T09:30:52Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Cloud](), [Data Infrastructure](), [Blockchain](), [threat detection](), [real-time](), [on-prem]() Tags: [blockchain](), [clickhouse](), [cloud](), [data-infrastructure](), [infra](), [on-prem](), [real-time](), [threat-detection]() ### AI overview Merkle Science uses ClickHouse as a core part of its blockchain analytics and predictive risk platform for detecting, tracing, and preventing illicit activity. The company ingests about 1.5 terabytes of data weekly and runs more than 18 million queries, relying on ClickHouse for transaction monitoring, wallet attribution, cross-chain forensics, and real-time threat detection. The article describes its migration from self-managed ClickHouse infrastructure to ClickHouse Cloud to simplify operations and support faster scaling. ### Source excerpt "Even if data increases by 4x or 5x in the next year, we literally don't have to worry about it. We've got the architecture right, the stack right, and the right platform at the end of the day." - Akshay Gupta, Lead Data Engineer ## Doppel's AI defense system stops attacks before they spread DevFeed: [Doppel's AI defense system stops attacks before they spread]() Original publisher: [Read original article]() Published: 2025-10-28T10:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Artificial Intelligence](), [threat detection](), [Large Language Model](), [Fine-tuning](), [OpenAI](), [Social engineering](), [human feedback](), [spoofing]() Tags: [ai](), [fine-tuning](), [gpt](), [human-feedback](), [internet](), [phishing](), [social-engineering](), [threat-detection]() ### AI overview Doppel uses OpenAI GPT-5 and o4-mini models, together with reinforcement fine-tuning and human-graded feedback, to detect, classify, and remove deepfake, phishing, spoofed-domain, and impersonation threats. The system reduces analyst workloads by 80%, triples threat-handling capacity, and cuts response times from hours to minutes. ### Source excerpt Doppel uses GPT-5 and reinforcement fine-tuning to stop deepfake and impersonation attacks, cutting analyst workloads by 80% and reducing response times from hours to minutes. ## How Exabeam uses ClickHouse for scalable, searchable security analytics DevFeed: [How Exabeam uses ClickHouse for scalable, searchable security analytics]() Original publisher: [Read original article]() Author: ClickHouse Published: 2025-09-11T13:46:05Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Cybersecurity](), [threat detection](), [real-time](), [Cloud](), [Database](), [Machine learning](), [Artificial Intelligence](), [Generative AI]() Tags: [2025](), [ai](), [clickhouse](), [cloud](), [cybersecurity](), [data](), [database](), [events](), [logs](), [machine-learning](), [models](), [platform](), [real-time](), [security](), [threat-detection]() ### AI overview Exabeam uses ClickHouse Cloud as the real-time analytics engine for its security operations platform, processing millions of events per second and searching petabytes of log data across 10 global regions. The architecture supports AI- and machine-learning-based threat detection, sub-second investigations, and faster response while controlling compute costs. ### Source excerpt Exabeam uses ClickHouse Cloud to power real-time, scalable security analytics--ingesting millions of events per second, cutting query times to sub-second, and reducing mean time to detection across 10 global regions. ## Minimizing False Positives: Enhancing Security Efficiency DevFeed: [Minimizing False Positives: Enhancing Security Efficiency]() Original publisher: [Read original article]() Author: Tiago Mendo Published: 2025-07-01T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [threat detection](), [Cybersecurity](), [Detection engineering](), [Vulnerabilities](), [data]() Tags: [2025](), [application-security](), [awareness](), [blog](), [cybersecurity](), [data](), [developer](), [devops](), [efficiency](), [engineering](), [false-positives](), [organizational](), [reduce](), [security](), [security-tools](), [threat-detection](), [vulnerabilities]() ### AI overview The article explains how false-positive security alerts consume investigation time, contribute to alert fatigue, and delay responses to genuine cyberattacks. It contrasts false positives and false negatives with accurate true-positive detection, emphasizing the value of security tools that improve accuracy and help organizations respond to real threats efficiently. ### Source excerpt Discover how enhanced security tools reduce false positives and streamline threat detection for more effective cybersecurity management. ## How Wallarm's API security platform relies on ClickHouse Cloud to detect and block attacks DevFeed: [How Wallarm's API security platform relies on ClickHouse Cloud to detect and block attacks]() Original publisher: [Read original article]() Author: ClickHouse Published: 2025-04-30T00:00:00Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [API](), [clickhouse](), [Security](), [threat detection](), [real-time](), [Apache Cassandra](), [vulnerability](), [Cloud]() Tags: [api](), [api-security](), [cassandra](), [clickhouse](), [real-time](), [security](), [self-hosted](), [threat-detection](), [vulnerability]() ### AI overview The article describes how Wallarm's API security platform uses ClickHouse to support real-time analysis, threat detection, and attack blocking. It explains that Cassandra's eventual-consistency model was insufficient for real-time security and that Wallarm moved to a self-hosted ClickHouse deployment to reduce latency and analyze API sessions more effectively. ### Source excerpt "We need our platform to operate in real time. The moment we detect suspicious activity, we aim to block the API user before they can attack the site or exploit a vulnerability." - Slava Yudanov, VP of Engineering, Wallarm ## 4M Models Scanned: Protect AI + Hugging Face 6 Months In DevFeed: [4M Models Scanned: Protect AI + Hugging Face 6 Months In]() Original publisher: [Read original article]() Author: Sean Morgan Published: 2025-04-14T00:00:00Z Content type: article Language: en Sources: [Hugging Face - Blog]() Topics: [hugging face](), [Machine Learning, Security Attacks](), [Threat Research](), [Security](), [threat detection](), [Zero Trust](), [obfuscation](), [vulnerability](), [payload](), [Script](), [llamafile](), [Tensorflow]() Tags: [ai-ml](), [hub](), [hugging-face](), [keras](), [llamafile](), [obfuscation](), [partnerships](), [payload](), [security](), [tensorflow](), [threat-detection](), [vulnerability](), [zero-trust]() ### AI overview Hugging Face and Protect AI report six months of collaboration on Guardian, a scanning system that improves security checks for models hosted on the Hugging Face Hub. Guardian added four detection modules, expanded format and obfuscation coverage, identified a Keras vulnerability, and provides inline alerts and vulnerability reports. The system uses a zero trust approach that treats arbitrary code execution as unsafe, including code hidden through obfuscation. ### Source excerpt We're on a journey to advance and democratize artificial intelligence through open source and open science. ## One step ahead: How Harvey uses ClickHouse for proactive threat detection DevFeed: [One step ahead: How Harvey uses ClickHouse for proactive threat detection]() Original publisher: [Read original article]() Author: Mike Parowski Published: 2025-03-24T00:00:00Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [threat detection](), [Network](), [Cloud](), [data](), [Security]() Tags: [clickhouse](), [cloud](), [compliance](), [data](), [industry](), [logs](), [network](), [real-time](), [security](), [threat-detection]() ### AI overview The article explains how Harvey, a generative AI platform for law firms, uses ClickHouse Cloud to analyze large volumes of Azure network flow logs for proactive, real-time threat detection. Its security team aims to identify threats from network logs before or alongside endpoint detection systems while protecting sensitive client data. ### Source excerpt Read how Harvey uses ClickHouse Cloud to turn 5.4TB of daily network logs into real-time threat detection - protecting client data while revolutionizing the legal industry with AI. ## Overcoming AppSec Challenges in FinServ: How CIBC Balances Speed, Security, and Compliance DevFeed: [Overcoming AppSec Challenges in FinServ: How CIBC Balances Speed, Security, and Compliance]() Original publisher: [Read original article]() Author: Snyk Team Published: 2025-03-20T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Security, Privacy and Abuse Prevention](), [DevSecOps](), [vulnerability management](), [Artificial Intelligence](), [Automation](), [threat detection](), [cloud-infrastructure](), [Cybercrime]() Tags: [ai](), [application-security](), [automation](), [blog](), [cloud-infrastructure](), [community](), [compliance](), [customer](), [customer-featured](), [data-privacy](), [devsecops](), [executive](), [financial-services](), [finserv](), [interest](), [pci-dss](), [security](), [soc-2](), [threat-detection](), [vulnerability-management]() ### AI overview This article distills a fireside-chat discussion about application security challenges in financial services, featuring Snyk's Field CTO and CIBC's Senior Director of Security Service Management. It covers the tension between rapid innovation and strict compliance, risks from cybercrime, data privacy, cloud infrastructure, third-party services, legacy systems, and modern applications, and the role of automation, continuous security testing, monitoring, DevSecOps, AI-driven tools, and human oversight in vulnerability management. ### Source excerpt Join Snyk's Field CTO, Steven Schmidt, and Mihai Saveschi, Senior Director of Security Service Management at CIBC, for an exclusive fireside chat on the evolving landscape of application security in financial services. ## AI Risk Management: Benefits, Challenges, and Best Practices DevFeed: [AI Risk Management: Benefits, Challenges, and Best Practices]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2025-03-13T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Strategy](), [AI Development](), [Vulnerabilities](), [Security](), [threat detection]() Tags: [ai](), [ai-adoption](), [awareness](), [best-practices](), [blog](), [code-generation](), [developer](), [megawatt](), [secure-by-design](), [security](), [security-vulnerabilities](), [snyk-apprisk](), [snyk-code](), [standards]() ### AI overview This article explains how organizations can manage risks introduced by AI development tools while still benefiting from faster coding and reduced manual work. It covers hidden vulnerabilities in generated code, outdated libraries, logic errors, compliance concerns, automated threat detection, and the use of NIST and ISO guidance to support secure-by-design AI adoption. ### Source excerpt Learn how to manage AI risks effectively with best practices, frameworks, and strategies to ensure secure AI adoption while mitigating vulnerabilities. ## Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco DevFeed: [Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco]() Original publisher: [Read original article]() Published: 2025-03-13T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Security](), [threat detection](), [Kubernetes clusters](), [kubectl](), [Cloud](), [Open Source](), [api server](), [container](), [Amazon EKS](), [Amazon Elastic Kubernetes Service]() Tags: [api](), [audit](), [auditlogs](), [container](), [falco](), [kubectl](), [kubernetes](), [linux](), [logs](), [mks](), [ovhcloud](), [plugin](), [security](), [threat-detection]() ### AI overview This article explains how Falco uses the OVHcloud MKS Audit Logs plugin to detect anomalies, suspicious activity, and policy violations in Kubernetes clusters. It describes Falco's event processing and outlines the required setup involving OVHcloud Logs Data Platform, a data stream, and an MKS cluster. ### Source excerpt Detecting threats in a Kubernetes cluster can be challenging, we generally don't know where and how to start. The good news is that we have an amount of valuable logs that can help us to know what is happened in the cluster. Indeed, each action requested or done by a user or an app, in a cluster, is recorded in Audit Logs. Kubernetes events are key to understanding the behavior of a cluster. We already provide plugins that let you parse Audit Logs and use Falco to detect threats from GKE, EKS and AKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your OVHcloud MKS clusters 🎉. What is Falco? Falco is an Open Source cloud-native runtime security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco can receive Events, compare them to a set of Rules to determine the actions to perform and generate Alerts to different endpoints. What is the OVH MKS Audit Logs plugin? The OVH audit logs plugin (k8saudit-ovh) extends Falco's capabilities to OVHcloud Managed Kubernetes Service (MKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE, EKS and AKS environments. With this plugin, you can seamlessly integrate MKS Audit Logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your MKS-based workloads. Concretely, when a user executes some kubectl commands in an OVHcloud MKS cluster, Audit Logs will be generated. Falco is listening to them, and depending on the configured rules to follow, it will generate some alerts. Using OVH MKS Audit Logs plugin In order to use the OVH MKS Audit Logs plugin, you must follow several steps: deploy an OVHcloud LDP (Logs ## Blog: Falco plugin for collecting AKS audit logs DevFeed: [Blog: Falco plugin for collecting AKS audit logs]() Original publisher: [Read original article]() Published: 2025-03-09T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Azure Kubernetes Service](), [Falco](), [Kubernetes](), [Security](), [threat detection](), [api server](), [Containers](), [Cloud Native Ecosystem](), [Kernel]() Tags: [aks](), [audit](), [auditlogs](), [azure](), [azure-kubernetes-service](), [falco](), [kubernetes](), [logs](), [plugin](), [security](), [threat-detection]() ### AI overview The article introduces a Falco plugin for collecting Azure Kubernetes Service (AKS) audit logs. It explains how Falco uses runtime and Kubernetes data for threat detection and outlines the required Event Hub configuration and storage setup for using the plugin. ### Source excerpt Troubleshooting Kubernetes events is challenging due to the multitude of data sources involved: container logs, Kubernetes events, cloud logs, and more. Among these sources, Kubernetes audit logs are especially valuable for identifying threats, as every action passing through the Kubernetes API server is recorded there. We already provide plugins that let you parse and use Falco to detect threats in audit logs from GKE and EKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your Azure AKS clusters. What is Falco? Falco is a Cloud Native Computing Foundation project that provides runtime threat detection. Out of the box, Falco examines syscalls to alert you to any suspicious activity. And, since containers share the same kernel as their host, Falco can monitor not only activity on the host but also activity on all of the containers running on that host. Moreover, Falco pulls data from both Kubernetes and the container runtime to add additional context to its alerts. With Falco running on your GKE clusters you can be notified of a wide variety of events, such as: Did someone start a container with high privileges? Has someone shelled into a running container? Has an executable been added to the container after it was deployed? These are just a few examples. Falco has over 80 rules that can be used to make you aware of not only external threats but also when clusters aren't being operated in accordance with industry best practices. What is the AKS audit logs plugin? The AKS audit logs plugin extends Falco's capabilities to Microsoft Azure Kubernetes Service (AKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE and EKS environments. With this plugin, you can seamlessly integrate AKS audit logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your AKS-based workloads. Using AKS audit ## Know your tools: The full range of Elastic Security's detection engineering capabilities DevFeed: [Know your tools: The full range of Elastic Security's detection engineering capabilities]() Original publisher: [Read original article]() Author: Kseniia Ignatovych Published: 2024-11-12T05:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Detection engineering](), [Security](), [SIEM, Security](), [threat detection](), [alert triage](), [Tooling]() Tags: [alert-fatigue](), [alert-triage](), [automated](), [automated-threat-protection-cybersecurity-defense-security-compliance](), [blog](), [detection-engineering](), [elastic](), [features](), [latest-features](), [quality](), [security](), [security-siem](), [siem](), [threat-detection](), [tools](), [workflows]() ### AI overview This Elastic Security blog provides an overview of detection engineering capabilities, including customizable prebuilt rules, alert suppression, manual rule runs, automated case creation, and machine learning jobs. ### Source excerpt This blog provides a comprehensive overview of the detection capabilities available in Elastic Security. Learn about the latest features and get useful tips and tricks for your detection practice! ## Effective Identity Threat Response with Teleport DevFeed: [Effective Identity Threat Response with Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Viktor Chuchurski and Francesco Lacerenza, Doyensec Security) Published: 2024-07-15T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [incident](), [Incident response](), [Security](), [threat detection](), [log management](), [audit](), [Monitoring]() Tags: [audit](), [breach](), [identity](), [incident](), [incident-response](), [log-management](), [monitoring](), [operations](), [security](), [threat-detection]() ### AI overview This article explains how to use Teleport to respond to identity compromise, including detecting suspicious behavior, containing threats, analyzing impact, and supporting recovery. ### Source excerpt Using Teleport to respond to identity compromise. ## Blog: Automate Kubernetes Network Security with Falco Talon DevFeed: [Blog: Automate Kubernetes Network Security with Falco Talon]() Original publisher: [Read original article]() Published: 2024-02-09T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Falco](), [network security](), [threat detection](), [C2]() Tags: [c2](), [falco](), [kubernetes](), [network-security](), [security](), [security-concept](), [threat-detection]() ### AI overview This article explains how Falco Talon can automate Kubernetes network security by responding to detected threats and updating network policies. It describes the limitations of IP-based policies and proposes using labels to isolate suspicious network traffic at runtime. ### Source excerpt Falco Talon Repository: https://github.com/Falco-Talon/falco-talon Falco Talon Documentation: https://falco-talon.github.io/ Falco Talon is currently under active development and remains in the alpha stage; therefore, breaking changes may occur at any time, and the documentation may not always be up to date. Setting up robust network security in Kubernetes is a challenge that demands both precision and adaptability. NetworkPolicy offers the potential for highly specific network configurations, enabling or blocking traffic based on a comprehensive set of criteria. However, the dynamic nature of network topologies and the complexities of managing policy implementations present ongoing challenges. The need for constant policy updates, especially in response to changing threat landscapes, introduces risks such as the potential for misconfiguration and the unintended dropping of packets. The Challenge of IP-Based Network Policies Building network policies around IP addresses is notoriously challenging. For instance, threat feeds, which list known malicious IP addresses, are constantly changing. An IP address associated with a malicious entity one week might be reassigned and deemed safe the next. This fluidity necessitates an agile approach to network policy management, integrating solutions like NetworkSets to dynamically update policies based on the latest intelligence. However, the sheer volume of threat intelligence feeds - from Tor IP lists to cryptomining blocklists - complicates this integration, making it a daunting task to maintain accurate network controls. Here, Falco Talon emerges as a transformative solution. By leveraging Falco's detection capabilities, such as identifying Outbound Connections to C2 Servers, Falco Talon can instantly update Kubernetes network policies to block all egress traffic except allowed CIDR ranges. This is facilitated through the kubernetes:networkpolicy Talon action, demonstrating a seamless integration of dynamic threat detection [Next page]()