Emanuel Falzon

Deploying a SIEM (Security Information and Event Management) system within your infrastructure provides immense value and helps you check off critical requirements during an ISO 27001 certification audit. A robust SIEM drives compliance by extracting actionable value from the logs you already collect and store. Benefits of Deploying Sentio SIEM Centralized Environment: Sentio SIEM serves as a centralized housing for all your logs. It seamlessly ingests data from mainstream sources like...

Predictable Local Activity May Reduce Analyst Vigilance For SOC analysts who spend their days triaging Microsoft 365 login events, the daily routine often falls into a predictable pattern. Security teams often implement a binary triage logic: local logins are automatically marked as benign, while foreign logins undergo a deeper analysis verification. This creates a dangerous security gap. Logins from local IP: Check the sign-in IP \rightarrow If it’s a local IP \rightarrow Close as...

Cybersift is observing a modern type of phishing attacks on Office 365 users which deviate from the typical fake login web page, we analysts are typically accustomed to seeing. The new phishing attack utilizes device registration to compromise the victim’s account, meaning that the threat actor does not require to steal your password to gain entry. But this modern phishing attack is smarter than you might think. Case Study We analyzed a phishing email which utilized a device registration...