Important: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.48 CVEs Elasticsearch Kibana Most of the 15 CVEs are Denial of Service vulnerabilities affecting Elasticsearch (ES|QL, EQL, search-query parsing) and Kibana…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic An update for the Kibana package is now available for NetEye 4. Security Fix for NetEye 4.48 CVEs All of the 3 CVEs are Denial of Service vulnerabilities that affect Kibana, within the Elastic Stack. Affected Products All…
Read MoreIn real-world security environments, “simple” rarely means simple. As a technical consultant, I often see Elastic Defend deployed within infrastructure that’s anything but standard: segmented networks, restricted outbound connectivity, compliance-driven isolation, and operational constraints that make direct internet access impossible for managed endpoints. One recurring requirement in these environments is the local delivery of Elastic…
Read MorePostfix is not typically the first component that comes to mind when talking about critical services. And yet it’s through Postfix that all notifications, ticketing system-related correspondence, and monthly SLA reports are sent out from NetEye. As long as everything is working properly, Postfix is almost invisible. And that’s exactly what it does: silently and…
Read MoreWith Elastic Observability we can create alerts on all data we collect, such as logs, metrics, application services and synthetic monitoring. However, NetEye represents the main operational console from which to monitor the entire infrastructure. By sending alarms from Elastic Observability to NetEye via Tornado, we can also bring this information into the NetEye console,…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the elastic stack packages are now available for NetEye 4, with a special focus on Kibana and Logstash. Security Fix for NetEye 4.47 Summary There are several patched vulnerabilities: For details on how to apply…
Read MoreHi everyone! Today I’d like to share with you an investigation we undertook related to ingesting Open Telemetry data in Elasticsearch, while maintaining tenant segregation from start to end. The Scenario Let’s imagine we have multiple customers, where in this case “multiple” may be well in the order of hundreds, who would like to send…
Read MoreA Rule Is More Than a Query In modern detection engineering, a rule is often misunderstood as just a query that triggers alerts. In reality, within Elastic Security, a detection rule is a structured, versioned, and lifecycle-managed object that goes far beyond simple query logic. Understanding this structure is essential for anyone operating in a…
Read MoreIn this article I’d like to share my experience with Elastic certifications. Recently, I had the opportunity to take the Elastic Certified Engineer and Elastic Certified Observability Engineer exams and I’d like to describe my preparation, experience and finally share some useful tips for anyone else who wants to follow the same path. Overview of…
Read MoreA scalable approach to detecting malicious domains using Threat Intelligence and Indicator Match Rules One of the most common techniques used in phishing and initial access campaigns is the creation of domains that closely resemble legitimate ones. Attackers exploit typosquatting, homograph attacks, and brand impersonation to deceive users and steal credentials. For a Security Operations…
Read MoreIntroduction Managing Elasticsearch effectively – especially as environments grow in size and complexity – can quickly become a challenging task. Performance tuning, identifying the true root cause behind slowdowns, and optimizing resource allocation often demand specialized expertise and a significant investment in time. In enterprise ecosystems, where observability underpins critical services and reliability expectations are…
Read MoreIn many Elastic deployments, the natural approach every time you encounter a server with different needs is to create a new Fleet policy. Each group seems to require its own small set of tweaks or additional integrations. But the more policies you create, the harder it becomes to maintain and scale your configuration. In reality…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic An update for the Kibana package is now available for NetEye 4. Security Fix for NetEye 4.46 CVEs All of the 4 CVEs are Denial of Service vulnerabilities that affect Kibana, within the Elastic Stack. Affected Products All…
Read MoreFrom a Technical Consultant’s Perspective “How can I tell if a new Elastic Integration feature or PR is already included in my NetEye version?” Elastic adds new features quite often. However, these features do not always appear in NetEye right away. That’s because each integration requires a specific Kibana version. If NetEye doesn’t yet ship…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic An update for the elastic-stack packages (elasticsearch, kibana, filebeat, logstash and elastic-agent) is now available for NetEye 4. Security Fix for NetEye 4.45 CVEs The CVEs include an Information Disclosure vulnerability, a Server-Side Request Forgery and 5 Denial…
Read More