Loading story…
Several cybersecurity vendors and experts have announced new developments aimed at improving security operations centers (SOCs) and threat detection capabilities. ManageEngine has released a major upgrade to its Log360 SIEM platform, introducing a revamped threat detection engine with a central detection console, object-level filters, and over 1,500 updated detection rules to reduce alert noise and speed up response times. Arctic Wolf has expanded its Threat Intelligence Plus service, providing real-time, operationally proven indicators of compromise and enhanced integration with SIEM and threat intelligence tools for more effective threat hunting and incident response. Industry analysis highlights the convergence of SIEMs and data lakes, with modern platforms integrating advanced analytics, UEBA, and SOAR to address legacy challenges and support evolving SOC requirements. These developments reflect a broader trend toward automation, AI integration, and unified threat intelligence in security operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A market analysis article described the convergence of SIEMs and data lakes, outlining market evolution, key players, and future direction. The reference was published on September 24, 2025, but does not clearly identify a separate discrete real-world event beyond the analysis itself.
Arctic Wolf announced an expansion of its threat intelligence service. The development was publicly reported on September 24, 2025.
ManageEngine announced a revamp of threat detection capabilities in its Log360 platform. The reference indicates this product update was publicly reported on September 24, 2025.
3 references tracked. Mallory keeps watching after this page renders.
softwareanalyst.substack.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Detection engineering communities have released a series of updates and insights aimed at improving threat detection capabilities across multiple platforms. Notable highlights include the integration of chaos engineering principles into incident response playbooks, the use of AI to generate and translate detection rules, and the expansion of community-driven detection content for PowerShell execution, lateral movement, and service installations. These efforts are designed to help security teams stay ahead of evolving attacker techniques and streamline the process of operationalizing threat intelligence. In parallel, major detection rule repositories such as Sigma, Splunk, and YARA have seen significant activity, with dozens of new and updated rules targeting recent exploits and vulnerabilities. Key updates include new Sigma rules for Commvault RCE and GoAnywhere MFT attacks, Splunk content for Oracle E-Business Suite exploitation, and YARA rules for WSUS RCE and WinRAR path traversal. Cloud detection coverage has also been enhanced, with new rules for AWS and Azure environments, and credential dumping detections have been refined to monitor additional processes and command-line flags. These developments collectively strengthen the detection engineering landscape and provide security teams with actionable tools to address current threats.
Jun 29, 2026
Detection engineering teams are increasingly adopting automation to monitor and maintain the effectiveness of deployed detection rules. Maintenance of detection rules is a critical but often neglected aspect, with many organizations facing challenges such as excessive alert volumes and insufficient allow-listing, leading to alert fatigue and missed threats. Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms typically provide limited native support for ongoing monitoring and tuning of detection rules, necessitating custom solutions. To address these gaps, detection engineers are implementing automated checks to track the trigger rates of detections, monitor the frequency of entities triggering alerts, and detect tampering such as unauthorized disabling or deletion of rules. Health metrics, including daily and monthly failure rates of detection rules, are also being tracked to ensure ongoing operational integrity. Automation in this phase enables proactive maintenance, allowing teams to address issues before they escalate to the Security Operations Center (SOC) or customers. In parallel, the security community is actively updating detection rules across multiple repositories, with recent changes including the addition of 47 new rules and modification of 81 existing ones in a single week. These updates target a range of threats, such as Windows defense evasion techniques, malicious scheduled tasks, and cloud environment persistence tactics. Notably, new rules have been introduced to detect attempts to disable Windows Event Log services and to identify malicious use of scheduled tasks leveraging tools like curl and PowerShell. Detection coverage for Azure and Microsoft 365 has been enhanced, focusing on defense evasion methods like deleting firewall policies and disabling cloud logs, as well as persistence via privileged role assignments and illicit OAuth consent grants. Email security rules have also evolved, now incorporating advanced analysis techniques such as optical character recognition (OCR), logo detection, and natural language understanding (NLU) to better identify phishing attempts and reduce false positives. These developments reflect a broader trend toward continuous improvement and operationalization of detection engineering, with automation and community-driven rule updates playing a central role in strengthening organizational defenses against evolving threats. By integrating automated monitoring and leveraging the latest detection rule advancements, security teams can more effectively manage alert volumes, reduce manual workloads, and improve their ability to detect and respond to sophisticated attacks.
Jul 12, 2026
Recent developments in detection engineering have focused on enhancing security measures for Microsoft Copilot, cloud environments, and non-human identities (NHIs). Detection rule repositories have seen significant updates, with 82 new and 328 modified rules across platforms such as Elastic, KQL, Splunk, Sigma, and YARA. New detection rules specifically target Microsoft 365 Copilot account compromise, including suspicious authentication patterns, usage anomalies, and prompt injection attempts, as well as eDiscovery log analysis. Additional rules address attacks against Ollama servers, covering DDoS, remote code execution, data exfiltration, and prompt injection, reflecting the growing threat landscape for AI-powered services. Azure environments have received new detection logic for destructive actions, such as Restore Point Collection and Storage Account deletions, and for identifying critical identity compromises in Microsoft Entra ID, including admin-confirmed compromises and Privileged Identity Management (PIM) failures. AWS detection coverage has improved with rules for federated user logins lacking multi-factor authentication, as well as enhanced monitoring for root user and IAM privilege escalation activities. Auth0 detections now correlate successful logins with suspicious TLS fingerprints, increasing the ability to spot anomalous access. Updates also refine detection of advanced process and memory manipulation techniques, such as API calls from spoofed parent processes, return-oriented programming (ROP) gadgets, image hollowing, and direct syscalls. System tampering, including boot file owner changes, is now more effectively detected. The focus on NHIs is growing, with organizations recognizing the need to modernize threat detection and response for these entities, as highlighted by guidance on using ITDR playbooks for NHI compromise. The cybersecurity community is also discussing the operational impact of AI in security operations centers (SOCs), noting that AI-driven tools can increase alert volumes and complexity. Industry newsletters emphasize the importance of consolidating cloud security platforms to manage risk in dynamic environments and highlight the ongoing challenges posed by the rapid adoption of AI and cloud technologies. Security leaders are encouraged to prioritize critical assets and adapt detection strategies to address evolving threats, particularly those targeting identity and access management systems. The integration of AI into detection engineering is transforming how threat intelligence is operationalized, enabling faster and more accurate rule creation. As organizations face increasing complexity in their security environments, staying informed about the latest detection rule changes and best practices is essential for maintaining robust defenses. The collective updates and guidance underscore the need for continuous improvement in detection engineering to keep pace with sophisticated adversaries and emerging attack vectors.
Jun 29, 2026