When a cyber incident occurs, one of the first challenges is understanding what happened, which systems were involved, and what traces were left behind. In this context, Velociraptor is an open-source DFIR tool that can collect and examine endpoint data in a centralized, targeted, and repeatable way. After completing a course focused on Velociraptor, I…
Read MoreA field briefing on space threat intelligence, for security teams that run zero satellites but depend on dozens of them I do not work in the space industry. I do not design satellites, operate ground stations, or analyze orbital telemetry in real time. Worth saying upfront, because it is the right starting point for this…
Read MoreTornado: Allow disabling forwarding of local system logs to Tornado By default, rsyslog on NetEye nodes forwards all logs it handles to the Tornado event engine. These include the system logs of the NetEye node itself, which can generate a large number of syslog events on Tornado. Until now, there was no way to turn…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Elastic Agent Elasticsearch Kibana Most of the 8 CVEs are resource-exhaustion weaknesses in Elasticsearch. These are Uncontrolled…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: Summary This Keycloak update (version 26.8.0) resolves several security issues identified in upstream Keycloak, including those fixed in upstream release 26.7.5:…
Read MoreOIDC group synchronization with read-only LDAP federation Fixed an issue that occurred when OIDC group synchronization was enabled alongside a read-only LDAP federation. The OIDC mapper attempted to modify LDAP-managed group memberships, resulting in the error: Not possible to delete LDAP group mappings as mapper mode is READ_ONLY. The synchronization logic now respects the LDAP…
Read MoreImportant: GLPI security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 Summary This is the list of vulnerabilities patched in this update: For details on how to apply this update, which includes the…
Read More
Turning Relevant Campaigns into Actionable Security Content To prioritize detection rule deployment based on threats that could realistically affect our organization or customer environments, we’ve developed an intelligence-driven detection model. Rather than prioritizing rules solely by mapping MITRE ATT&CK techniques and addressing coverage gaps indiscriminately, the model uses threat intelligence to identify which campaigns, behaviors,…
Read MoreIn my previous post, I was pointing out how an LLM context should be handled with care, and how there’s a better and worse way to basically interface with it. It’s not enough to “prompt in a clear way” or pack tons of customizations inside a CLAUDE.md file. In part 1, which you can read…
Read MoreNATS: Fix multi-tenancy configuration corruption in cluster environments When executing commands such as neteye install –restrict-services-to nats-server, neteye tenant config apply, or neteye satellite config create from a cluster node while nats-server was active on a different node, the shared /neteye/shared/nats-server/conf/multi-tenancy.conf configuration file could get corrupted. Unreplaced template placeholders (such as @@ACCOUNTS@@, @@TORNADO_IMPORTS@@, and @@TELEGRAF_IMPORTS@@)…
Read MoreUpgrading an existing NetEye cluster to 4.49 introduces a networking question that’s easy to underestimate. The existing environment may already have everything we normally associate with a NetEye cluster: a corporate network for frontend access and integrations, a private trusted network for internal cluster communication, and the corresponding virtual IPs. With Kubernetes entering the architecture…
Read MoreImportant: Grafana security update Type/Severity NetEye Product Security has rated this update as having a medium security impact. Topic An update for the grafana packages is now available for NetEye 4. Security Fix for NetEye 4.49 and 4.50 Summary Four medium-severity CVEs were fixed (CVSS 4.3–5.4). Three concern permission scoping: alert rules listable from folders a user may…
Read MoreWelcome to version 4.50 of our NetEye Unified Monitoring Platform. As you log in, you’ll be greeted by the wide-open autumn meadows of Alpe di Siusi, the largest high-altitude plateau in Europe, with the jagged peaks of the Gruppo delle Odle and the distinctive ridge of Seceda rising in the distance. Their pale rock faces…
Read MoreA quick overview of the new native numerical calculation feature available in Jira systems. It’s something we’ve been waiting for a long time. Introduction The ability to perform calculations within an integrated management system is one of our most requested features. This need is most pressing in large organizations, where such data increasingly forms the…
Read MoreAt NetEye we’re always working towards more and more integration with Kubernetes. The NetEye Operator is the first piece of that journey we’re working on, with the goal of obtaining a component that ships as a Kubernetes operator rather than as an RPM. The process of building it gave us a rare opportunity, a chance…
Read More