#SIEM
All CosmicBytez Labs articles tagged #SIEM, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-82041: Missing Authorization in UTMStack's Incident Command WebSocket Enables Authenticated RCE
Critical CVSS 9.9 missing-authorization flaw in UTMStack lets any authenticated user run OS commands on monitored endpoints; fixed in v11.2.16.
- Security
CVE-2026-82042: Critical Authentication Bypass in UTMStack's InternalApiKeyFilter
CVSS 9.8 auth bypass in UTMStack: a forged Utm-Internal-Key header grants full admin API access. Fixed in 11.2.16.
- Security
CVE-2026-17561: Critical Code Injection in Logsign SIEM
A critical code injection vulnerability in Logsign SIEM (CVSS 9.8) allows unauthenticated remote code execution on affected systems running versions prior...
- Security
CVE-2026-56699: Critical NDJSON Injection in Wazuh Manager (CVSS 10.0)
CVSS 10.0 flaw in Wazuh Manager 5.0 beta lets enrolled agents inject NDJSON ops into OpenSearch under admin credentials, deleting logs and corrupting alerts.
- Project
OWASP DefectDojo: Self-Hosted Vulnerability Management Platform
Aggregate, deduplicate, and track security findings from 100+ scanners in a unified dashboard. Build a production-grade vulnerability management pipeline...
- HOWTO
Linux auditd: Kernel-Level Security Monitoring and Compliance Logging
Deploy and tune the Linux Audit Framework (auditd) to capture privileged operations, file access, and authentication events — building a tamper-resistant...
- News
Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
Splunk patches CVE-2026-20253, a CVSS 9.8 critical vulnerability enabling unauthenticated file operations and remote code execution in Splunk Enterprise.
- News
Only 10% of SOCs Say They're Getting Excellent Value From AI — What the Second Wave Must Deliver
A new survey reveals only 10% of Security Operations Centers report getting excellent value from AI investments. As billions flow into AI-powered security…
- Project
Building a Wazuh XDR + SIEM Homelab
Deploy a full Wazuh stack in Docker to gain host-based intrusion detection, file integrity monitoring, vulnerability scanning, and active response across your…
- HOWTO
Osquery Endpoint Visibility & Threat Hunting
Use SQL to query your endpoints like a database. Deploy osquery across Linux and Windows hosts to surface process trees, network connections, user activity…
- HOWTO
Network Traffic Analysis with Zeek: From Deployment to Threat Detection
Deploy Zeek (formerly Bro) on Linux to passively monitor network traffic, generate structured logs, write detection scripts, and forward data to your SIEM...
- HOWTO
Suricata IDS/IPS Deployment: From Install to Active Threat
Deploy Suricata as a full-featured Network Intrusion Detection and Prevention System on Ubuntu. Covers installation, interface capture, Emerging Threats...
- Security
CVE-2026-25769: Wazuh Critical RCE via Insecure
A critical remote code execution vulnerability (CVSS 9.1) in Wazuh versions 4.0.0–4.14.2 allows an attacker with access to a worker node to achieve root...
- Security
CVE-2026-25770: Wazuh Privilege Escalation to Root via Cluster Protocol File Write
A critical privilege escalation vulnerability (CVSS 9.1) in Wazuh versions 3.9.0–4.14.2 allows authenticated cluster nodes to overwrite the manager...
- HOWTO
How to Deploy Wazuh SIEM/XDR for Unified Security Monitoring
Step-by-step guide to deploying Wazuh as an open-source SIEM and XDR platform. Covers server installation, agent deployment across Windows and Linux,...
- HOWTO
How to Configure Microsoft Sentinel Analytics Rules
End-to-end SOC guide for Microsoft Sentinel: build KQL-based scheduled and NRT analytics rules, wire automation rules for incident triage, and deploy...
- HOWTO
FortiAnalyzer Log Forwarding and Compliance Reports
Configure FortiAnalyzer for centralized logging, SIEM integration, and compliance reporting. Covers syslog forwarding, custom log handlers, and PCI/HIPAA...
- Project
Azure Sentinel SIEM Implementation
Deploy Microsoft Sentinel as your cloud-native SIEM with data connectors, analytics rules, workbooks, and SOAR automation for comprehensive security operations.
- Project
Build Your Own SIEM with Open-Source Tools
Step-by-step project guide for building a functional SIEM using Wazuh, Elastic, and Grafana. Perfect for homelabs and small businesses.