.webp&w=828&q=75)
Criminal IP releases Splunk TI Feed app for firewall correlation
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.
Stories per day · 30 days
4 RSS
Relatedmicrosoft-sentinel5siem5observability3rce3threat-intelligence3access-control2ai-agents2buyer-guide2cisco2cortex-xsoar2criminal-ip2detection-engineering2firewall2google-secops2hallucinations2log-management2mdr2sigma2
24 stories, newest first · one card per story
Stories tagged #splunk
Panther leads editorial ranking of 2026 detection engineering tools
Research-based scores, not lab tests, place Anvilogic second and SOC Prime third, with Sigma as the portability baseline.
1
Security log management tools ranked for 2026
Splunk leads for analytics depth while Elastic offers open resource-based pricing in 2026 log management tools.
1
Critical PHP RCE flaws may affect Cisco products
CVE-2026-109618 and CVE-2026-109619, called PHP2shell, were fixed in a PHP security release announced October 21.
Buyer's guide compares 12 managed SIEM services for 2026
The review weighs content ownership, offboarding, tuning evidence and whether the SIEM stays in the customer's tenant.
2026 buyer’s guide ranks 12 SOAR platforms by team fit
The research-based guide splits tools into SIEM-bundled, playbook, no-code, and intel-led lanes and flags Revelstoke as absorbed.
1
2026 ranking puts Cortex XSOAR first among SOAR tools
Editorial scores, not lab results, place Splunk SOAR and Tines next, with Torq leading the agentic-AI lane.
1
2026 SIEM rankings put Microsoft Sentinel first, then Splunk and Google
An editorial scorecard, not a lab test, ranks nine platforms after the Exabeam–LogRhythm merger removed one slot.
1
Encore compiles public exploit proofs into threat-hunting rules
Across 45 CVEs, Encore found 43 without reading logs and raised alerts on two wrong CVE pairs.
Talos interview covers Ryan Fetterman's path into detection research
He recounts 15 years from federal SOC work and Splunk's SURGe team into Talos, including an early Pandora Song case.
1
Splunk patches 24 flaws, four critical, in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
1
Splunk Enterprise Patroni API flaw allows unauthenticated commands
Splunk rates CVE-2026-76268 9.8 and reports no active exploitation; a public repository offers claimed PoC code.
Splunk Enterprise and SOAR need updates, Cyber Centre says
Canadian Cyber Centre alert AV26-1077, dated October 22, points to October 2026 Splunk hardening and SOAR vulnerability notices.
Splunk and SolarWinds patch code execution and access flaws
Fixes cover 16 product CVEs in Splunk Enterprise, 15 in SOAR, plus Observability and Patch Manager bugs.
1
Splunk survey: AI agent observability lags hallucination detection
Of 2,050 respondents in ten countries, 85% want hallucination detection but only 58% say they can catch it.
1
Splunk survey: AI agent rollout is outrunning monitoring and ownership
Of 2050 respondents, 38% lack clear ownership for monitoring AI and only 58% can effectively watch for hallucinations.
2
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps
SOCRadar released Splunk apps for MSSP incidents and vulnerability management, expanding its Splunkbase catalog to five apps.
Splunk security advisory (AV26-1018)
Canada's Cyber Centre urges patches for vulnerabilities in Splunk Enterprise and Splunk MCP Server.
SonicWall and Splunk Patch Critical Vulnerabilities
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000, and Splunk fixed critical command-execution flaws.
Splunk Patches Critical 9.8 Flaw Allowing Unauthenticated Remote Command Execution
Splunk patched CVE-2026-76268, a CVSS 9.8 flaw allowing unauthenticated command execution via Patroni.
11
Should the CISO role be split in two?
Experts argue organizations should keep one strategic CISO rather than splitting the role in two.
3
Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional
Axoflow launches AxoDetect in early access, running customer Sigma rules in the data pipeline to cut SIEM ingest costs and make full SIEM feeding optional.
Patch Tuesday to Pentest Wednesday: How an Equipment Rental Company Is Turning Continuous Testing Into Continuous Exposure Management
An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.
2
Autonomous Threat Operations in action: Real results from Recorded Future’s own SOC team
Recorded Future reports its Autonomous Threat Operations platform enabled 15-20 weekly automated threat hunts in its own SOC.
1