Learn. Share. Secure. Access product knowledge, get certified, and collaborate with the global Securonix user community.
Join the discussion, ask questions, get solutions.
Discover product guides and helpful how-tos.
Join groups and collaborate with peers.
Stay up to date with our product team.
Share your ideas and suggestions with our team.
Discover and join upcoming events.
Explore Securonix solutions, products, and company insights
Access product guides, release notes, and technical documentation
Get active findings and detection strategies from Securonix Threat Research
Discover the ThreatQ threat intelligence platform and solutions
Find step-by-step guides, release notes, and troubleshooting resources
Discover and deploy integrations, extensions, and apps for the ThreatQ platform
name: Suspicious WSUS Spawning Command Shell for Reconnaissance Analyticsignatureid: EDR-SYM858-RUNcategory: "Execution"threatname: "Command & Scripting Interpreter: Windows Command Shell"functionality: "Endpoint Management Systems"description: |
name: Windows IIS Worker or PHP CGI Process Spawning Suspicious Command Process Analyticsignatureid: EDR-SYM974-RUNcategory: 'Execution'threatname: 'Command & Scripting Interpreter: Windows Command Shell'functionality: 'Endpoint Management System
name: Web Server or PHP Worker Spawning Suspicious Command Process Analyticsignatureid: EDR-NIX5-RUNcategory: 'Execution'threatname: 'Command & Scripting Interpreter: Unix Shell'functionality: 'Endpoint Management Systems'lifecycle: experimentalv
Two unauthenticated PHP core RCEs landed on October 21. We emulated the aftermath on a bounded range across three PHP deployment models, measured what the telemetry actually carries, and found that the parent process is not the same thing on any two
Executive assessment:PHP2Shell refers to two critical vulnerabilities in the PHP runtime that can lead to unauthenticated remote code execution in web-serving configurations. Both affect the request lifecycle, but the failure mechanisms differ. CVE-2
Introducing Securonix Academy: Your Hub for Expert-Led Cybersecurity Learning Audience: Security Analysts, Threat Hunters, Administrators, and PartnersTags: Securonix Academy, ThreatQuotient, UDS, AgenticAI, LearningPaths, Credentials, TrainingIntro
Audience: Administrators, Security Analysts, MSSPsProduct Module: Activity Import, Securonix Cloud Hub, SpotterLast Updated: October 14, 2026KB ID: KB-20261001-syslog-logs-not-appearingTags: syslog, Cloud Hub, Activity Import, Spotter, datasource, pa
Audience: New Customers, Partners, Security Analysts, Administrators, and BeginnersProduct Module: Securonix Connect AcademyLast Updated: October 12, 2026KB ID: KB-20261012-securonix-foundationsTags: Securonix Foundations, Securonix Connect Academy,
Executive summary:OpenAI and ChatGPT branding is being used in several distinct abuse patterns. The cases reviewed here include credential phishing, a ClickFix-style malware chain that used a malicious Custom GPT as a referral point, and unauthorized
name: Kubernetes Node Identity Used by a Non-Kubelet Client Analyticsignatureid: CAS-AUD02-RUNcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Cloud Accounts'functionality: 'Containers As A Service'description: | Detects a Kubernetes nod
Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this
Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf
We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i
Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone
I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d
Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to
During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?
When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being
Where security professionals share intelligence and strengthen defense together
Learn More →
Bring your questions. Learn live with the Securonix Training team.
Join open Office Hours for guidance on course content, product functionality, training logistics, and questions from the Securonix Connect community.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
