Welcome to Securonix Connect!

CyberAv3ngers, Reprised: Inside the Ongoing IOCONTROL Campaign Against U.S. PLCsBlog

OverviewOn July 22, 2026, six U.S. federal agencies (the FBI, CISA, NSA, the EPA, the Department of Energy, and U.S. Cyber Command) jointly updated an advisory (AA26-097A) first issued in April 2026, warning that nation-state actors are still activel

600

12 days ago

Aaron BeardsleeCommunity Manager

FakeAgent: How a Malicious Ad on claude.ai's Own Domain Delivered SectopRAT to 29 OrganizationsBlog

OverviewOn July 21-22, 2026, Huntress' Security Operations Center identified a burst of unusual executable installs, Microsoft Defender exclusions, and anomalous persistence activity across 29 separate organizations, all traced back to a single proce

230

12 days ago

Aaron BeardsleeCommunity Manager

Laundry Bear's Half-Click Zimbra Exploit: A Year-Long Russian Espionage Campaign Hiding in Plain SightBlog

TL;DRA Russian state-sponsored actor (tracked by Unit 42 as CL-STA-1114, by the Dutch AIVD/MIVD and joint international advisory as "Laundry Bear," and overlapping with Microsoft's Void Blizzard) has been exploiting a Zimbra Collaboration Suite zero-

410

12 days ago

Dheeraj KumarCommunity Manager

Threat Brief: AsyncAPI Supply Chain Attack, Securonix ThreatWatch AnalysisBlog

Executive Summary: Several packages in the @asyncapi npm namespace were maliciously republished after an attacker abused AsyncAPI's release process. The malicious code did not rely on npm lifecycle scripts. It executed when affected runtime modules w

420

17 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: WordPress wp2shell Post-Exploitation Persistence and Enumeration ActivityBlog

name: 'WordPress wp2shell Post-Exploitation Persistence and Enumeration Activity Analytic'signatureid: WAF-APP02-RUNcategory: 'Persistence'threatname: 'Server Software Component: Web Shell'functionality: 'Web Proxy'description: | Detects the post-ex

300

18 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1050

1 month ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

710

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1411

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

620

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

3982

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

2682

3 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2622

4 months ago

martel.williamsNew Member

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

3641

4 months ago

BrillNew Participant