Securonix Connect!

BETA DETECTION: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials AttackBlog

name: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials Attack Analyticsignatureid: WEL-ACC78-RUNcategory: 'Credential Access'threatname: 'Steal or Forge Authentication Certificates'functionality: 'Microsoft Windows'description: |

4 hours ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: PowerShell Telegram Bot API Used as Command and Control ChannelBlog

name: PowerShell Telegram Bot API Used as Command and Control Channel Analyticsignatureid: WEL-PSH137-RUNcategory: 'Command and Control'threatname: 'Web Service: Bidirectional Communication'functionality: 'Microsoft Windows Powershell'description: |

5 hours ago

Aaron BeardsleeCommunity Manager

HEAVYGRAM: Inside Handala Hack's Telegram-Native Surveillance BackdoorBlog

OverviewOn September 17, 2026, Group-IB published a technical report tying a Telegram-based surveillance backdoor called HEAVYGRAM to Handala Hack, the Iran-linked "hacktivist" persona that emerged in the days after the October 7, 2023 Hamas-led atta

140

23 hours ago

BatbilguunNew Member

Securonix On-Prem

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

Hello Team, We would like to submit an enhancement request regarding Incident Report exports.Currently, the report header fields such as Start Date and End Date correctly reflect our configured tenant timezone (Asia/Ulaanbaatar). However, the Date/Ti

1 day ago

absachinCommunity Manager

Microsoft Copilot Studio: Identity, Logging, and Threat Detection - Part I

Audience: Security Administrators, SOC Analysts, Detection Engineers, MSSPsProduct Module: Securonix SIEM / Microsoft 365 and Entra ID IntegrationLast Updated: September 21, 2026KB ID: KB-20260921-copilot-studio-threat-detection [Tentative]Tags: Micr

430

5 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: Browser Process Spawning Download-and-Execute Chain to Temp AnalyticBlog

name: 'Browser Process Spawning Download-and-Execute Chain to Temp Analytic'signatureid: EDR-SYM972-RUNcategory: 'Execution'threatname: 'Exploitation for Client Execution'functionality: 'Endpoint Management Systems'description: | Detects a Chromium-

120

Aaron BeardsleeCommunity Manager

BETA DETECTION: GRIMWEDGE Persistence Scheduled Task Creation AnalyticBlog

name: 'GRIMWEDGE Persistence Scheduled Task Creation Analytic'signatureid: WEL-ACC83-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'lifecycle: experimentaldescription: | Detects creation o

Aaron BeardsleeCommunity Manager

BETA DETECTION: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analytic

name: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analyticsignatureid: EDR-SYM964-RUNcategory: 'Defense Evasion'threatname: 'Masquerading: Match Legitimate Resource Name or Location'functionality: 'Endpoint Man

Aaron BeardsleeCommunity Manager

BETA DETECTION: SYSTEM Scheduled Task Created with Minute Interval Executing from ProgramData or Diagnostics Path AnalyticBlog

name: SYSTEM Scheduled Task Created with Minute Interval Executing from ProgramData or Diagnostics Path Analyticsignatureid: EDR-SYM965-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Endpoint Management Syst

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

BatbilguunNew Member

Securonix On-Prem

1 day ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1540

2 months ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

850

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1771

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

730

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

5292

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

3062

How To Fix Delay in Searchable Period

fatimaNew Member

Show & Tell

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2892

martel.williamsNew Member

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

4511

BrillNew Participant

How can I display amalgamated vulnerability intelligence on a dashboard?

I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d

2381