Threat hunting is proactively identifying and thwarting unusual network activity that could indicate an attempted security breach. It’s a historically manual activity, making it time-intensive and arduous. It’s no wonder, then, why most organizations don’t have the time, budget, or resources to undertake it effectively…if at all. That’s why many organizations rely on “reactive” threat response solutions, including firewalls, intrusion detection, and SIEM to alert analysts to an event after it occurs. Without the resources to commit to proactive threat hunting, reactive solutions are the next best option.

Tenant-to-tenant migrations are increasingly common. Some are necessitated by business changes like mergers, acquisitions, and divestitures, while others are driven by the desire to clean up or consolidate the IT infrastructure to facilitate business processes and reduce administrative overhead.

Getting data to Splunk can be challenging. Syslog is still the most important data source, and it can provide you with hard-to-solve problems (for example, like high volume, non-compliant messages, unreliable network protocol (UDP), and more). The syslog-ng Premium Edition (PE) and syslog-ng Store Box (SSB) by One Identity can make these challenges manageable.