Ryan Kovar's Blog Posts

NY. AZ. Navy. SOCA. KBMG. DARPA. Splunk.

Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk
Security
9 Minute Read

Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk

This blog discusses how to detect HAFNIUM activity around the recent CVEs released affecting Exchange Server using Splunk and Splunk Enterprise Security.
Staff Picks for Splunk Security Reading February 2021
Security
3 Minute Read

Staff Picks for Splunk Security Reading February 2021

These monthly postings will feature the favorite security-centric presentations, white papers and customer case studies from various peeps in the Splunk (or not) security world that WE think everyone should read. If you would like to read other months, please take a peek at previous posts in the "Staff Picks" series!
Staff Picks for Splunk Security Reading January 2021
Security
3 Minute Read

Staff Picks for Splunk Security Reading January 2021

These monthly postings will feature the favorite security-centric presentations, white papers and customer case studies from various peeps in the Splunk (or not) security world that WE think everyone should read. If you would like to read other months, please take a peek at previous posts in the "Staff Picks" series!
Detecting the Sudo Baron Samedit Vulnerability and Attack
Security
3 Minute Read

Detecting the Sudo Baron Samedit Vulnerability and Attack

Looking for ways to detect and protect against the SUDO Baron Samedit vulnerability (CVE-2021-3156)? Look no further. In this blog we tell you how to proactively detect vulnerable servers using Splunk and also to detect malicious folks who are attempting to exploit this vulnerability for nefarious outcomes!
Staff Picks for Splunk Security Reading December 2020
Security
3 Minute Read

Staff Picks for Splunk Security Reading December 2020

These monthly postings will feature the favorite security-centric presentations, white papers and customer case studies from various peeps in the Splunk (or not) security world that WE think everyone should read. If you would like to read other months, please take a peek at previous posts in the "Staff Picks" series!
Using Splunk to Detect Sunburst Backdoor
Security
8 Minute Read

Using Splunk to Detect Sunburst Backdoor

The Sunburst Backdoor threat truly burst on the scene as a send off for 2020. The good news is that the Splunk Security team has produced detections you can run in Splunk Enterprise Security to help you protect your environment from this sophisticated threat.