Now Available: Intelligence Dashboard in the GreyNoise Platform
With the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.
GreyNoise US
Výsledky hledání
Meet Athena: Huntress' Agentic SOC Analyst
Learn how Huntress' Athena brings agentic AI to the SOC, investigating signals end-to-end while human analysts own the final call.
US
METTLER TOLEDO: Microsoft cumulative patches until March for FreshWay B/D
[VDE-2026-066] This update deploys cumulative Microsoft Windows security patches through March 2026 for LTSB 2016, LTSC 2019, and LTSC 2021.
EPSS 0.01 CVE-2026-23673 CVE-2026-25171 CVE-2026-25172 CVE-2026-25174 CVE-2026-25175 CVE-2026-25179 CVE-2026-25181 CVE-2026-25185 CVE-2026-26111 CVE-2026-26128 METTLER TOLEDO Microsoft DE
How Aikido Intel detects malware and vulnerabilities first
Aikido Intel is a real-time feed that catches malware and undisclosed vulnerabilities across open-source ecosystems, often within 8 minutes of release. Category: Product & Company Updates
BE
Now Available: The Threat Brief Library in the GreyNoise Platform
GreyNoise's Threat Brief Library is now live in the Visualizer — browse, search, filter, and download weekly At The Edge briefs, Executive Situation Reports, and more, all built on primary-source sensor data.
GreyNoise US
Celebrating Canada Day with Localized Managed Phishing
Huntress Managed SAT now offers localized phishing simulations for Canada, using familiar, country-specific brands and scenarios to provide more effective security awareness training for your learners.
Huntress US
Aikido acquires Root to secure the supply chain
Aikido has acquired Root to secure the software supply chain, fixing open source vulnerabilities in the version you already run, no upgrade required. Critical fixes go back to the community, free. Category: Product & Company Updates
BE
Packagist is now protected by Aikido Intel and other updates to the PHP registry
Aikido's malware feed now blocks bad package versions in Composer by default. A look at how Packagist is closing whole classes of supply chain attacks. Category: Product & Company Updates
Aikido x Drydock | A way for maintainers to catch malware before it ships
Aikido partners with Drydock to bring pre-publish package review to npm and PyPI. See exactly what's inside a release before it ships, malware caught before download number one. Category: Product & Company Updates
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap
AAD Graph Activity Logs are now ingestible into Elastic and usable for threat detection within the SIEM/XDR solution. That sentence shouldn't be exciting, but it is. For most of the past decade, this slice of telemetry simply didn't exist as a customer-accessible log stream. Microsoft Graph Activity Logs (the modern graph.microsoft.com surface) went GA in April 2024. The legacy graph.windows.net surface, the one adversary tooling actually hits, stayed dark until early 2026. This post walks the…
Aggiornamento di sicurezza per dispositivi Google Pixel
Aggiornamento di sicurezza Google di giugno risolve molteplici vulnerabilità, di cui 11 con gravità “critica” e 20 con gravità “alta”, nei dispositivi Pixel.
Google IT
Governing Claude Enterprise in Environments Where Inline Controls Can't Go
TrendAI™ integrates the Claude Compliance API into TrendAI Vision One™ through two collectors that bring AI-aware visibility and detection to Claude Enterprise usage: one keeps all data inside the environment, while the other feeds TrendAI Vision One™ for deeper correlation and compliance.
Trend Micro JP
Aikido x Docker: less noise, more signal in your containers
Aikido now supports Docker Hardened Images with built-in VEX integration, helping teams reduce CVE noise and focus on container vulnerabilities that actually need attention. Category: Product & Company Updates
From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence
Elastic Security natively ingests Google Threat Intelligence: known-malicious IPs, domains, URLs, and file hashes matched against your telemetry the moment they appear, each carrying a verdict and a 0–100 threat score. The setup consists of an API key and two data streams, with no extra infrastructure. When an indicator is ambiguous, workflows built on Agent Builder query VirusTotal in real time, enrich the alert, correlate with your telemetry, and summarize findings in real time. How threat…
Elastic US
Phoenix Contact: PLCnext Firmware Security Issues Related to APPs and Configuration Files
[VDE-2026-050] This advisory addresses security issues in PLCnext firmware versions prior to 2026.0.3 that are related to APP handling and the processing of configuration files. The identified vulnerabilities affect APP installation authenticity as well as the handling of configuration data in writable directories. Successful exploitation may allow authenticated attackers with different privilege levels to compromise integrity, availability, and system security of affected PLCnext Control. Both…
EPSS 0.00 CVE-2025-41669 CVE-2025-41670 Phoenix Contact DE
Introducing Group-IB Prevyn AI
How Group-IB is building a cognitive core that anticipates threats before they happen
SG
How Huntress Managed ITDR's New Incident Report Timeline | Huntress
Learn how the Incident Report Timeline within Huntress Managed ITDR offers clear, chronological insights, enabling a decisive response to incidents.
Huntress US
Huntress × Acrisure Cyber Insurance Program
The Huntress × Acrisure Cyber Insurance Program now simplifies cyber insurance. Get streamlined coverage and a $0 deductible on Tech E&O or Cyber policies when using Managed EDR and Managed ITDR.
Elastic Security MCP App: Interactive security operations inside your AI Tools
Every SOC analyst knows the drill: an alert fires, and the next ten minutes are spent switching between a triage dashboard, a threat hunt, a case file, and the AI tool that told you to look in the first place. Recently, we introduced MCP Apps for Elastic, built on the open MCP Apps extension to the Model Context Protocol, that lets an MCP tool return an interactive UI alongside its text response, rendered inline in Claude Desktop, Claude.ai, VS Code Copilot, Cursor, or any compatible host. This…
Elastic US
Group-IB Digital Risk Protection Integrates with Google SecOps: Brand Threat Intelligence, Now In Your SOC
Elastic Workflows GA: automation where your security data already lives
Elastic Workflows is generally available in 9.4. It is the automation layer built directly into Elastic, running where your data lives across Security, Observability, and Search. While this post focuses on a security deep dive, the same workflow capabilities apply across solutions, with no separate platform to deploy and no data to move. When an alert fires or a schedule triggers, a Workflow executes: querying Elasticsearch, enriching with threat intel, creating cases, calling external APIs,…
Elastic US
Know who to watch before the incident finds you
Elastic Security v9.4 introduces Entity Analytics Watchlists, a new capability in the Entity Analytics suite that lets security teams create named, weighted lists of users, hosts, and services and feed that context directly into the platform's risk scoring pipeline. The gap this closes isn't awareness, as most security teams already know which entities deserve elevated scrutiny. The gap is that SIEMs have had no way to express that organizational knowledge as a risk signal. Watchlists do that…
Elastic US
AI-generated hunting leads: The hunt starts before you ask the question
Threat hunting has always been a human art; a practitioner staring at logs, forming a hypothesis, and patiently chasing it down. What if the hardest part of the hunt (knowing where to look) could be done for you, automatically, in milliseconds, and tuned specifically to your environment? This is where AI-generated hunting leads come in, allowing you to shift from reactive alerting to proactive defense with entity-centric, risk-based threat hunting tailored specifically to your environment's…
Elastic US
From plain English to production rule: AI-native Elasticsearch ES|QL detection in Elastic Security
Elastic Security now includes AI-powered detection rule creation, built into the rule creation workflow. Analysts describe a threat behavior in plain English and receive a complete, validated Elasticsearch Query Language (ES|QL) rule in return, with MITRE ATT\&CK mappings, severity recommendations, and a preview against live data, all without leaving the platform or writing a single line of query syntax. This post walks through exactly how that works using an Okta credential stuffing and…
Elastic US
Elastic Conversational Entity Analytics: threat hunting in a single conversation
Entity Analytics is a core security analytics capability that extends Elastic Security from event-centric to entity-centric investigation. By focusing on critical entities, such as users, hosts, and services, it builds a complete profile of each entity’s attributes, lifecycle, behaviors, relationships, and risk score over time. This security context equips threat hunters to stop chasing isolated alerts and instead uncover the full narrative of a potential compromise. In this blog, we walk…
Elastic US
One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow
Three things land on you at once: Attack Discovery correlated 12 alerts into a credential-harvesting campaign overnight, your team just onboarded a new fleet of macOS endpoints and needs detection rules for LOLBin abuse, and a risk score spike on a service account just crossed the critical threshold. In most security operations centers (SOCs), that's three different people, three different workflows, and a morning spent context-switching. In Elastic Security 9.4, it's one conversation. You open…
Elastic US
Aikido integrates with AWS Kiro: Catching in review doesn't scale anymore
AI agents writing your code. Aikido integrates directly into AWS Kiro's agentic workflow to keep security in the loop, automatically, from the first line. Aikido is AWS's first global security partner for Kiro. Category: Product & Company Updates
AWS BE
CI/CD pipeline abuse: the problem no one is watching
Preamble In 2025 and 2026, we watched a pattern play out across the industry. Attackers stopped going after production servers directly and started targeting the automation that deploys to them. Compromised developer credentials, a modified workflow file, and suddenly every secret in a CI/CD environment is streaming to an attacker-controlled endpoint. We saw this play out across incidents involving major open-source projects, Fortune 500 companies, and critical infrastructure tooling. The…
Project Swarm: Join the Collective. Defend the Edge
Today, we're launching Project Swarm — a research initiative that opens the GreyNoise deception platform to the global security community. Project Swarm transforms GreyNoise from a proprietary sensor network into a collective intelligence platform.
US
Unified EDR + ITDR: Closing the Identity Gap Before Attacks Spread
See how Huntress EDR/ITDR Correlations stop infostealer-driven attacks before stolen credentials can be reused, linking endpoint compromise to cloud identities for one coordinated response.
US
Introducing Device Protection: Security for Developer Devices
Supply chain attacks target developer devices. Aikido Device Protection monitors every install across npm, PyPI, VS Code extensions, browser extensions, and AI tools. Category: Product & Company Updates
BE
Disrupting Attacks on Endpoints | Attack Disruption Engine
Standard EDR creates a gap between detection and action. Huntress closes it. Learn how our Attack Disruption Engine automatically disrupts threat actors and reduces the impact of endpoint attacks.
Huntress US
Introducing C2 Detection: Know When Your Edge Devices Are Calling Home to Attackers
We're launching C2 Detection — a new GreyNoise intelligence module that gives you two distinct, high-confidence signals that a device in your environment has been compromised.
GreyNoise US
Elastic Security Integrations Roundup: Q1 2026
A quarterly look at Elastic’s security integrations ecosystem Security teams can only protect what they can see. Gaps in coverage, like a macOS fleet generating logs that never reach your SIEM, an email gateway running in isolation, or a cloud environment producing findings that stay siloed in the vendor console, are easily exploited by attackers. Elastic’s answer to this is continuous and open investment in third-party integrations, built on the belief that a strong security ecosystem requires…
Elastic IBM Proofpoint US
ITDR for Google Workspace | Huntress Managed ITDR
Huntress now delivers ITDR for Google Workspace to protect identities against BEC, inbox rule manipulation, and account takeover, all with a 24/7 SOC-led response.
Google US
Linux & Cloud Detection Engineering - Getting Started with Defend for Containers (D4C)
Introduction Linux systems remain a critical foundation for modern infrastructure, particularly in cloud-native environments where containers and orchestration platforms are the norm. As workloads move from long-lived hosts to ephemeral containers, attacker tradecraft shifts as well. Activity that once left persistent artifacts on disk is increasingly confined to short-lived, runtime behavior that can be difficult to capture using traditional log sources. Detection engineering in these…
Elastic US
Huntress Expands Into Proactive Security Posture Management
Huntress "shifts left" with Managed ESPM and Managed ISPM. We proactively harden your endpoints and identities to close the security gaps that attackers love to exploit.
Huntress US
Get started with Elastic Security from your AI agent
Get started with Elastic Security from your AI agent Elastic Agent Skills are open source packages that give your AI coding agent native Elastic expertise. If you're already using Elastic Agent Builder, you get AI agents that work natively with your security data. Agent Skills are for the other side: bringing that same Elastic Security knowledge to the external AI tools your team already uses, like Cursor, Claude Code, or GitHub Copilot. If you use an AI coding agent and want to evaluate…
Elastic US
Managing Elastic Security Detection Rules with Terraform
At the core of Elastic Security lie outstanding detection capabilities, allowing users to create, test, tune, manage, deploy detection rules, as code, in their environments. The ability to create robust detections is critical for Security Operations as detection logic elevates threat signal from the telemetry noise. This article highlights how Elastic's new Terraform resources for security detection rules and exceptions expand practitioners' capabilities for detection-as-code deployment. Below…
Elastic US
GreyNoise Integrates with Google Security Operations to Enhance Detection and Response Capabilities
GreyNoise's integration with Google Security Operations delivers standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, response actions, webhook support, and ready-to-deploy playbooks.
Google US
GreyNoise Intelligence Is Available Across the CrowdStrike Falcon Platform
GreyNoise intelligence is now available across the CrowdStrike Falcon platform, bringing internet-wide scanning context to SIEM queries, SOAR workflows, and AI-driven triage.