Blogs
Elastic Security Labs empowers security teams across the globe with novel security intelligence research and free to use tools.
Automating detection tuning requests with Kibana cases
Learn how to automate detection rule tuning requests in Elastic Security. This guide shows how to add custom fields to Cases, create a rule to detect tuning needs, and use a webhook to create a frictionless feedback loop between analysts and detection engineers.
TOR Exit Node Monitoring Overview
Learn how to monitor your enterprise for TOR exit node activity.
Time-to-Patch Metrics: A Survival Analysis Approach Using Qualys and Elastic
In this article, we describe how we applied survival analysis to vulnerability management (VM) data from Qualys VMDR, using the Elastic Stack.
Agentic Frameworks Summary
Agentic systems require security teams to balance autonomy with alignment, ensuring that AI agents can act independently while remaining goal-consistent and controllable .
How AI and contextual search enhance defence cybersecurity
Contextual search brings clarity, speed, and insight to defence security teams
Microsoft Entra ID OAuth Phishing and Detections
This article explores OAuth phishing and token-based abuse in Microsoft Entra ID. Through emulation and analysis of tokens, scope, and device behavior during sign-in activity, we surface high-fidelity signals defenders can use to detect and hunt for OAuth misuse.
Elastic and Keep join forces to help users manage alerts and automate workflows
Elastic announces the acquisition of Keep Alerting
Elastic changes the SIEM game with AI-driven security analytics
Learn more about Elastic's AI-driven security analytics
How to achieve full-spectrum financial risk detection with AI and unified data
Financial services can’t rely on manual review alone. Discover how unified data and explainable AI are helping firms detect risk, reduce cost, and stay ahead of evolving regulations.
WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables
WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling memory introspection.
Exploring AWS STS AssumeRoot
Explore AWS STS AssumeRoot, its risks, detection strategies, and practical scenarios to secure against privilege escalation and account compromise using Elastic's SIEM and CloudTrail data.
Streamlining Security: Integrating Amazon Bedrock with Elastic
This article will guide you through the process of setting up the Amazon Bedrock integration and enabling Elastic's prebuilt detection rules to streamline your security operations.