Drew Gibson
Threat Hunting with TLS/SSL Certificates
TLS and SSL certificates are a great way to hunt advanced adversaries. Collect them with Splunk Stream, Bro, or Suricata and hunt in your own data!
Human in the Loop (HITL) in Practice: A Guide to Core HITL Concepts, Benefits, and Effective AI Collaboration
Learn more about HITL. Human in the Loop is the crucial role of human intervention in an automated or AI-driven process.
How To Use CloudTrail Data for Security Operations & Threat Hunting
This blog post reviews AWS cloudtrail as a security logging source and how to hunt in it
Hunting with SA-Investigator & Splunk Enterprise Security (SIEM)
Discover how Splunk Enterprise Security and the SA-Investigator add-on empower analysts to streamline threat hunting and incident response. Learn how to pivot across assets, identities, and processes for deep-dive investigations and actionable insights. Happy hunting!
Hunting for Threats in VPCFlows
This article will look at native AWS network telemetry — VPCFlows. We’ll explore what it is, how you can ingest it, and what value it provides from a security perspective.
XWorm's Shape-Shifting Arsenal: Loader and Stager Variants in the Wild
Explore XWorm's shape-shifting tactics, evolution, and persistence, and how Splunk helps detect this RAT.
Machine Learning in Splunk Enterprise Security: Unleashing Hidden Detection Power
Discover how Splunk Enterprise Security 8.0 revamps machine learning, spots hidden threats, simplifies anomaly detection, and turbocharges your SOC.
What To Know Before Agentic AI Starts Driving Security and Fraud Workflows
The essential guardrails for safe AI deployment in financial services.
What is Automated Incident Response? Benefits, Processes, and Challenges Explained
Discover how automated incident response streamlines IT operations, reduces costs, and enhances efficiency by automating key processes like triage and diagnostics.
