Learn. Share. Secure. Access product knowledge, get certified, and collaborate with the global Securonix user community.
Join the discussion, ask questions, get solutions.
Discover product guides and helpful how-tos.
Join groups and collaborate with peers.
Stay up to date with our product team.
Share your ideas and suggestions with our team.
Discover and join upcoming events.
Explore Securonix solutions, products, and company insights
Access product guides, release notes, and technical documentation
Get active findings and detection strategies from Securonix Threat Research
Discover the ThreatQ threat intelligence platform and solutions
Find step-by-step guides, release notes, and troubleshooting resources
Discover and deploy integrations, extensions, and apps for the ThreatQ platform
name: Kubernetes Node Identity Used by a Non-Kubelet Client Analyticsignatureid: CAS-AUD02-RUNcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Cloud Accounts'functionality: 'Containers As A Service'description: | Detects a Kubernetes nod
This is part 2 of the Hugging Face Attack Chain series. We ran the Hugging Face attack path against a purpose built EKS cluster this week and captured every control plane event it produced. Eight steps, from a pod orienting itself to the same pod rea
name: Inference Workload Pod Querying the Kubernetes API Analyticsignatureid: CAS-AUD01-RUNcategory: 'Discovery'threatname: 'Container and Resource Discovery'functionality: 'Containers As A Service'description: | Detects a model-serving pod using it
Wiz Research cloned gpt2, modified it so that loading the model ran their code, and uploaded it to Hugging Face's inference API. That gave them execution inside a pod on Amazon EKS. What followed is four steps, and none of them are exotic.The pod re
Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay Kumar Introduction:The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in September 2026. The report also include
Audience: Admins, Analysts, MSSPsProduct Module: Add Data > Activity / Activity ImportLast Updated: September 30, 2026KB ID: KB-20260930-activity-import-troubleshooting Tags: Activity Import, datasource, Spotter, Job Monitor, data ingestion, colle
OverviewOn September 28, 2026, AhnLab's Security Intelligence Center published two incident cases that share one entry point: an Internet-facing Microsoft IIS server running an unpatched copy of Telerik UI for ASP.NET AJAX. In both, the attacker expl
OverviewBetween September 9 and September 14, 2026, an operator compromised at least six legitimate Ukrainian small-business websites and used them to serve a fake Cloudflare verification page. The page did not exploit anything. It asked the visitor
Have a Product Idea? Help Shape the Future of Securonix Innovation at Securonix is driven by you — our customers and partners. Whether you’ve identified a gap, experienced a challenge, or have an idea for a new feature, we want to hear from you. We’
OverviewBetween June and September 2026, GreyNoise researchers tracked a single actor, publicly nicknamed "Kapibala" after the WordPress usernames it left behind, through a ten-vulnerability exploitation spree that touched WordPress sites, ZyXEL netw
Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to
Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this
Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf
We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i
Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone
We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?
Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?
I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d
Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to
During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?
Where security professionals share intelligence and strengthen defense together
Learn More →
Bring your questions. Learn live with the Securonix Training team.
Join open Office Hours for guidance on course content, product functionality, training logistics, and questions from the Securonix Connect community.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
