Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a
#elastic
共收录 48 条相关情报。
← 返回所有主题How CVE-2026-73570 turns a Zimbra log file into remote code execution
CVE-2026-73570
We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog ne
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 · CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is ve
Auditing the auditor: Unmasking Apex Accelerator
REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled
Introducing AlertZero: Inbox zero for your alert queue
AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your p
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules acr
No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Cod
Quarantined isn't contained: Agentic phishing response with Elastic and Sublime
The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response c
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with a
Linux Detection Engineering - Local Privilege Escalation
Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug poi
Data access: the hidden cost of security vendor lock-in
Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 3
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, f
Living off the coding agent: Two tales of tunnels and LaunchAgents
Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet. Endpoint still needs to tr
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
A 40-line CEL integration snapshots .npmrc files every 6 hours to catch cooldown removals. This post walks through the t
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAIND
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows
Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades
Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human
LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that match
SOC case management and detection rule history in Elastic Security
Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the
Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas
Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as the