Security Vision SIEM Adds Monitoring for Missing Logs, Correlation Quality, and SOC SLA Compliance
Security Vision has released a major update to its SIEM platform. The new version monitors not only external attackers but also the stability of the data sources feeding the system, the performance of correlation rules, and the progress of ongoing investigations by analysts.
One of the key additions is monitoring for collection stability. Administrators can now oversee each individual source, configure acceptable deviations in event volume, and receive automatic notifications when events suddenly cease. This capability is intended to surface blind spots proactively rather than after an incident has already occurred.
A separate dashboard displays the quality of correlation rules. Rules can be tested against simulated events, and the platform supports import and export in Sigma format, simplifying the transfer of detection content between different systems.
The StatAnalyser service tracks atypical behavior using statistical rules and marks suspicious incidents with a dedicated indicator. Investigations benefit from a new retrospective process-chain builder inside each incident card. The system automatically runs additional queries to reconstruct parent processes, user sessions, and lateral movement across hosts, giving analysts a more coherent view of the compromise instead of isolated events.
The platform also monitors the SOC team itself. A new dashboard tracks SLA compliance during incident handling and allows managers to drill from aggregate statistics down to the performance of individual analysts.
Together these features aim to create a closed, manageable cycle for SOC operations: verify that data is actually arriving, assess detection quality, identify anomalies, reconstruct attack paths, and oversee team response. The updated SIEM is positioned as an active control point for the entire investigation process rather than a passive log repository.
Related articles
From Security Champion to Engineering Security Culture: MTS Web Services Transforms DevSecOps Approach
MTS Web Services has shifted from a single Security Champion per team model to a broader engineering security culture that distributes responsibility across multiple specialists. The previous approach created overload for appointed champions, offered insufficient training, and failed to motivate appointed participants to grow their skills. The new strategy emphasizes voluntary participation, professional development through dedicated tracks, and integration of security practices into daily workflows and onboarding. Key changes include forming a DevSecOps guild, running regular workshops and Q&A sessions, embedding vulnerability scan results into team metrics, and adding competency maps with role-specific learning paths. The company now recognizes security heroes and high-performing teams while linking basic security training completion to performance indicators. Results show organic growth in engagement, with event numbers rising from a handful in 2023 to 18 in 2025 and product teams independently adopting secure development practices.
ManticoreSearch Publishes Detailed Checklist for Enabling Authentication in Production
ManticoreSearch has released an extensive checklist for safely enabling authentication in production deployments. The guide covers standalone nodes, distributed tables with remote agents, and replication clusters, stressing the need for thorough inventory of clients and nodes before changes. It details procedures for creating users with minimal privileges, testing in staging environments, and performing controlled rollouts during maintenance windows. Special attention is given to handling Bearer tokens, protecting auth.json files, and ensuring consistent authentication data across cluster nodes. The document also explains differences between RT-mode and plain-mode configurations and provides commands for initializing the first administrator and reloading authentication settings.
WhatsApp Web Gains Native Audio and Video Calling with Screen Sharing and Device Switching
WhatsApp, owned by Meta, is rolling out audio and video calling directly in its web version, eliminating the previous need for a separate desktop application. The update introduces a Calls tab with call history and favorite contacts, along with screen sharing and reactions that match most desktop app capabilities. Calls can now seamlessly transfer between devices without disconnection, allowing users to start a conversation in a browser and continue it on a smartphone. Group calls gain waiting rooms where the link creator can require manual approval for entry, useful for professional meetings. Additional improvements include background noise suppression, faster transition to HD video quality, and the ability to call users via usernames across platforms without sharing phone numbers.
Manticore Search Adds Built-in Authentication and Authorization Starting with Version 27.1.5
Manticore Search has introduced native authentication and authorization capabilities for SQL over MySQL, HTTP/HTTPS endpoints, and replication operations. The feature distinguishes between authentication, which identifies the requester, and authorization, which determines permitted actions such as read, write, schema, replication, and admin. Users can enable the feature via the auth directive in the searchd section of the configuration file, supporting both RT mode with auth.json storage and plain mode with an explicit path. Initial setup requires creating an administrator account, after which additional users can be managed through SQL commands like CREATE USER, GRANT, TOKEN, and SET PASSWORD. The system supports mysql_native_password, HTTP Basic authentication, and Bearer tokens, with mandatory SSL or HTTPS recommended for credential transmission. Detailed logging, permission checks, and phased rollout guidance are provided to minimize disruption in production environments.