Learn more about OpenSearch flushing, the process of permanently storing data onto disk for all operations that have been temporarily stored in memory.

SOC Prime

24.12.2024

Fluentd: How to Use a Parser With Regular Expression (regexp) - SOC Prime

This guide explains configuring Fluentd to extract structured data from unstructured log messages using the parser plugin with a regular expression (regexp).

SOC Prime

24.12.2024

Using Kafka as a Fast Correlation Engine - SOC Prime

Explore how Kafka Streams can be utilized for filtering and correlating events in real time, transforming it into a correlation engine.

SOC Prime

24.12.2024

Creating a Regex Pattern Set in AWS WAF - SOC Prime

Learn how to create a Regex Pattern Set in AWS Web Application Firewall (WAF).

SOC Prime

24.12.2024

Additional Settings for Optimizing Elasticsearch Cluster Performance - SOC Prime

Learn how to improve Elasticsearch cluster performance by fine-tuning certain settings and their descriptions.

SOC Prime

21.12.2024

Splunk: Using collect Command for Creating New Events in a New Index - SOC Prime

Explore how to use the COLLECT command for creating new events in a new index in Splunk from our blog.

SOC Prime

21.12.2024

Using map Command in Splunk - SOC Prime

Learn more about using the map command in Splunk to enable secondary searches based on the results of a primary search.

SOC Prime

21.12.2024

Understanding Basics of Apache Kafka - SOC Prime

Learn more about Apache Kafka basics, key concepts, and prominent use cases.

SOC Prime

20.12.2024

Enhancing Events with Geolocation Data in Logstash - SOC Prime

If you are using Logstash and need to enrich event data with geolocation information based on IP addresses, check out this blog.

SOC Prime

20.12.2024

OpenSearch Split Index API - SOC Prime

Learn how to split an existing index into multiple smaller indices by leveraging OpenSearch Split Index API.

SOC Prime

19.12.2024

Using Ruby Code in Logstash for Translating Text from HEX - SOC Prime

Learn how to decode HEX-encoded data, improve data usability, and streamline Elasticsearch workflow using Ruby code in Logstash

SOC Prime

19.12.2024

UAC-0125 Attack Detection: Hackers Use Fake Websites on Cloudflare Workers to Exploit the "Army+" Application - SOC Prime

Detect UAC-0125 attacks against Ukraine exploiting the “Army+” app to gain remote access to targeted systems with Sigma rules from SOC Prime.

SOC Prime

19.12.2024

Understanding OpenSearch Routing Allocation Settings - SOC Prime

Routing allocation settings dictate how shards are distributed across nodes in a cluster, being essential for robust cluster management

SOC Prime

19.12.2024

Fluentd: Work With Multiple Log Sources Within a Single Instance by Using @label - SOC Prime

Learn how to define multiple processing pipelines within a single instance using @label

SOC Prime

18.12.2024

DarkGate Malware Attack Detection: Voice Phishing via Microsoft Teams Leads to Malware Distribution - SOC Prime

Detect DarkGate malware deployed via Microsoft Teams voice phishing using a set of dedicated Sigma rules from SOC Prime Platform.

SOC Prime

18.12.2024

Monitoring Index Size Trends in Elasticsearch: Monthly and Daily Statistics - SOC Prime

Learn how to efficiently monitor and manage index sizes in Elasticsearch, ensuring a stable and well-optimized cluster.

SOC Prime

18.12.2024

JVM GC Monitor Service Overhead: Root Cause and Recommendations - SOC Prime

Discover the root causes of JVM GC Monitor Service overhead in Elasticsearch and get recommendations on how to cope with them.

SOC Prime

18.12.2024

Understanding Key OpenSearch Dashboard Logging Settings - SOC Prime

How to optimize OpenSearch Dashboards for your unique needs, ensuring a secure, efficient, and user-friendly experience.

SOC Prime

17.12.2024

Fluentd: How to Make Nested Hash from Dot-Separated Keys - SOC Prime

Learn how to process dot-separated keys to create a nested structure.

SOC Prime

17.12.2024

UAC-0099 Attack Detection: Cyber-Espionage Activity Against Ukrainian State Agencies Using WinRAR Exploit and LONEPAGE Malware - SOC Prime

Detect UAC-0099 attacks against Ukraine exploiting CVE-2023-38831 and spreading LONEPAGE malware with Sigma rules from SOC Prime.

SOC Prime

17.12.2024

Essential Dev Tools Commands for Elasticsearch & OpenSearch Administrators - SOC Prime

Learn more about essential Dev Tools Console commands in Kibana to simplify cluster management and troubleshooting as Elasticsearch admin.

SOC Prime

17.12.2024

How to Deal with the Warning: "No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'" - SOC Prime

Learn how to deal with "No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'" warning in Elasticsearch, OpenSearch.

SOC Prime

17.12.2024

How to Increase index.max_regex_length in OpenSearch - SOC Prime

Read the blog by SOC Prime experts and learn how to increase index.max_regex_length in OpenSearch.

SOC Prime

14.12.2024

Secret Blizzard Attack Detection: The russia-Linked APT Group Targets Ukraine via Amadey Malware to Deploy the Updated Kazuar Backdoor Version - SOC Prime

Detect Secret Blizzard APT attacks targeting Ukraine via Amadey malware to deploy KazuarV2 backdoor with Sigma rules from SOC Prime Platform.

SOC Prime

14.12.2024

IBM QRadar: How to Create a Rule for Log Source Monitoring - SOC Prime

Learn how to create a custom rule to send notifications when logs stop coming from any log source

SOC Prime

14.12.2024

Using Roles and Users for Data Access in Elasticsearch - SOC Prime

Learn how to control the level of access to data through roles and users in Elasticsearch

SOC Prime

14.12.2024

Fluentd: How to Change Tags During Log Processing. - SOC Prime

Learn how to dynamically modify the tags of incoming log records based on their content.

SOC Prime

13.12.2024

OpenSearch: Cluster Blocks Read-Only - SOC Prime

Learn about the cluster blocks read-only settings, common scenarios when they occur, and how to restore normal operations

SOC Prime

13.12.2024

CVE-2024-50623 Detection: Attackers Actively Exploit a RCE Vulnerability in Cleo Harmony, VLTrader, and LexiCom File Transfer Products - SOC Prime

Detect CVE-2024-50623 exploitation attempts, an RCE vulnerability in Cleo file transfer products with Sigma rules from SOC Prime Platform.

SOC Prime

13.12.2024

How to Allow Verified Bots Using AWS WAF Bot Control - SOC Prime

Learn how to manage bot traffic effectively by configuring your web ACL to allow verified bots with AWS WAF Bot Control

SOC Prime

13.12.2024

SOC Prime Threat Bounty Digest — November 2024 Results - SOC Prime

Threat Bounty November digest brings program insights on released content, five top-rated rules and authors, and recommendations on known challenges

SOC Prime

13.12.2024

How to Convert Arrays of Hashes Into a Structured Key-Value Format During Log Processing - SOC Prime

Learn how to convert arrays of hashes into a structured key-value format in Fluentd using inline Ruby scripts enabling transformations during log processing.

SOC Prime

12.12.2024

Adaptive Replica Selection in OpenSearch - SOC Prime

Learn how to ensure that cluster dynamically selects replicas based on their responsiveness

SOC Prime

12.12.2024

Designing Index Structure for Large Volumes of Data in Elasticsearch - SOC Prime

Learn how to configure the index structure for large volumes of data in Elasticsearch

SOC Prime

12.12.2024

New Cyber-Espionage Campaign Detection: Suspected China-Backed Actors Target High-Profile Organizations in Southeast Asia - SOC Prime

Detect cyber-espionage activity against Southeast Asian organizations potentially linked to Chinese groups with Sigma rules from SOC Prime Platform.

SOC Prime

12.12.2024

How to prevent BufferOverflowError - SOC Prime

Learn how to prevent BufferOverflowError when you get logs from Kafka and your output can't connect to OpenSearch or ElasticSearch

SOC Prime

11.12.2024

How to Enable and Manage AWS WAF Logging with CloudWatch Logs - SOC Prime

Explore how to enable and manage AWS WAF logging using Amazon CloudWatch Logs.

SOC Prime

11.12.2024

Standard Logstash Template for Event Processing (Gold Template) - SOC Prime

This article provides a standard template for configuring Logstash pipelines, referred to as the "gold template."

SOC Prime

11.12.2024

Optimizing Elasticsearch Master Node for Cluster Stability - SOC Prime

Explore best practices for optimizing the master node to ensure a stable and robust Elasticsearch cluster.

SOC Prime

11.12.2024

Configuring Disk Allocation Thresholds in Elasticsearch and OpenSearch - SOC Prime

Learn how to manage disk allocation thresholds in an Elasticsearch or OpenSearch cluster

home›SOC Prime›Software

SOC Prime - Software

OpenSearch Flush, Translog, and Refresh - SOC Prime

Fluentd: How to Use a Parser With Regular Expression (regexp) - SOC Prime

Using Kafka as a Fast Correlation Engine - SOC Prime

Creating a Regex Pattern Set in AWS WAF - SOC Prime

Additional Settings for Optimizing Elasticsearch Cluster Performance - SOC Prime

Splunk: Using collect Command for Creating New Events in a New Index - SOC Prime

Using map Command in Splunk - SOC Prime

Understanding Basics of Apache Kafka - SOC Prime

Enhancing Events with Geolocation Data in Logstash - SOC Prime

OpenSearch Split Index API - SOC Prime

Using Ruby Code in Logstash for Translating Text from HEX - SOC Prime

UAC-0125 Attack Detection: Hackers Use Fake Websites on Cloudflare Workers to Exploit the "Army+" Application - SOC Prime

Understanding OpenSearch Routing Allocation Settings - SOC Prime

Fluentd: Work With Multiple Log Sources Within a Single Instance by Using @label - SOC Prime

DarkGate Malware Attack Detection: Voice Phishing via Microsoft Teams Leads to Malware Distribution - SOC Prime

Monitoring Index Size Trends in Elasticsearch: Monthly and Daily Statistics - SOC Prime

JVM GC Monitor Service Overhead: Root Cause and Recommendations - SOC Prime

Understanding Key OpenSearch Dashboard Logging Settings - SOC Prime

Fluentd: How to Make Nested Hash from Dot-Separated Keys - SOC Prime

UAC-0099 Attack Detection: Cyber-Espionage Activity Against Ukrainian State Agencies Using WinRAR Exploit and LONEPAGE Malware - SOC Prime

Essential Dev Tools Commands for Elasticsearch & OpenSearch Administrators - SOC Prime

How to Deal with the Warning: "No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'" - SOC Prime

How to Increase index.max_regex_length in OpenSearch - SOC Prime

Secret Blizzard Attack Detection: The russia-Linked APT Group Targets Ukraine via Amadey Malware to Deploy the Updated Kazuar Backdoor Version - SOC Prime

IBM QRadar: How to Create a Rule for Log Source Monitoring - SOC Prime

Using Roles and Users for Data Access in Elasticsearch - SOC Prime

Fluentd: How to Change Tags During Log Processing. - SOC Prime

OpenSearch: Cluster Blocks Read-Only - SOC Prime

CVE-2024-50623 Detection: Attackers Actively Exploit a RCE Vulnerability in Cleo Harmony, VLTrader, and LexiCom File Transfer Products - SOC Prime

How to Allow Verified Bots Using AWS WAF Bot Control - SOC Prime

SOC Prime Threat Bounty Digest — November 2024 Results - SOC Prime

How to Convert Arrays of Hashes Into a Structured Key-Value Format During Log Processing - SOC Prime

Adaptive Replica Selection in OpenSearch - SOC Prime

Designing Index Structure for Large Volumes of Data in Elasticsearch - SOC Prime

New Cyber-Espionage Campaign Detection: Suspected China-Backed Actors Target High-Profile Organizations in Southeast Asia - SOC Prime

How to prevent BufferOverflowError - SOC Prime

How to Enable and Manage AWS WAF Logging with CloudWatch Logs - SOC Prime

Standard Logstash Template for Event Processing (Gold Template) - SOC Prime

Optimizing Elasticsearch Master Node for Cluster Stability - SOC Prime

Configuring Disk Allocation Thresholds in Elasticsearch and OpenSearch - SOC Prime

home
›
SOC Prime
›
Software