How Elastic is helping Honeywell generate sales from online search

Honeywell is a Fortune 100 company that produces commercial and consumer products. With roots dating to 1906, the multinational conglomerate offers chemicals, industrial manufacturing, engineering services, aerospace systems, and much more. The United States-based company employs 110,000 workers globally, and posts revenue of nearly $37 billion. Honeywell is a key player in 50 industries. It produces everything from N95 masks to automated warehouse solutions and airport security scanners. Altoge

What you need to know about Process Ghosting, a new executable image tampering attack

Security teams defending Windows environments often rely on anti-malware products as a first line of defense against malicious executables. Microsoft provides security vendors with the ability to register callbacks that will be invoked upon the creation of processes on the system. Driver developers can call APIs such as PsSetCreateProcessNotifyRoutineEx to receive such events. Despite the name, PsSetCreateProcessNotifyRoutineEx callbacks are not actually invoked upon the creation of processes, b

Adversary emulation with Prelude Operator and Elastic Security

It’s no secret that organisations are up against skilled, relentless and determined adversaries. Security operations teams need to continuously test their detection capabilities by carrying out adversary emulation plans that are made up of varying tactics, techniques and procedures  (TTPs) and track key metrics of their coverage in order to close any existing gaps. There are many tools available for running adversary emulation plans and performing purple team exercises. This blog will focus

How to configure Elastic Cloud on Kubernetes with SAML and hot-warm-cold architecture

Elastic Cloud on Kubernetes (ECK) is an easy way to get the Elastic Stack up and running on top of Kubernetes. That’s because ECK automates the deployment, provisioning, management, and setup of Elasticsearch, Kibana, Beats, and more.  As logging and metric data — or time series data — has a predictable lifespan, you can use hot, warm, and cold architecture to easily manage your data over time as it ages and becomes less relevant. In this guide, we’ll explain how to set up SAML with auth0 a

How South Dakota Bureau of Information and Telecommunications deploys Elastic to secure endpoints

The South Dakota Bureau of Information and Telecommunications (BIT) provides quality customer services and partnerships to ensure South Dakota’s IT organization is responsive, reliable, and well-aligned to support the state government’s business needs. The BIT believes that “People should be online, not waiting in line.” The bureau’s goals for the state's 885,000 residents include: 

Delivering valuable services at economical costs
Building and retaining a highly skilled workforce
Provid
Total Economic Impact™ study: Elastic delivers 10X performance with up to 75% cost savings

Ten times faster at a fraction of the cost. If you want a headline as to why you should consider adopting Elastic for security and observability, that is it.  We often work with our customers to help them establish the business value of Elastic within their organizations. We commissioned Forrester to conduct a Total Economic Impact (TEI) study of our security and observability solutions so our customers have an unbiased view that they can share with their internal stakeholders. The TEI exam

ProblemChild: Generate alerts to detect living-off-the-land attacks

In an earlier blog post, we spoke about building your own ProblemChild framework from scratch in the Elastic Stack to detect living off the land (LOtL) activity. As promised, we have now also released a fully trained detection model, anomaly detection configurations, and detection rules that you can use to get ProblemChild up and running in your environment in a matter of minutes.  This blog provides a high-level breakdown of the steps to enrich your Windows process event data using the rel

Protecting Windows protected processes

This quick blog is the first in a two-part series discussing a userland Windows exploit initially disclosed by James Forshaw and Alex Ionescu. The exploit enables attackers to perform highly privileged actions that typically require a kernel driver. Protected process lightWindows 8.1 introduced the concept of Protected Process Light (PPL), which enables specially-signed programs to run in such a way that they are immune from tampering and termination, even by administrative users. The goal is to

Pride @ Elastic | Feeling seen and safe as a trans woman

We all want to work for a company where we fit in. That’s why Elastic built a Source Code that encourages all to come as they are. In this Pride blog series, we highlight LGBTQIA+ Elasticians who have a unique story — one, perhaps, just as unique as yours. We asked Kiley Davidson, IT Systems Engineer, to talk about her experience and share how Elastic’s culture allowed her to come out at work and thrive as a trans woman. How did you know that Elastic was a safe place for you when you joined in


Ricerca