Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: CVEs Most of the 19 CVEs are Missing/Incorrect Authorization flaws in the Admin REST API and Fine-Grained Admin Permissions (FGAP) v2:…
Read MoreWhat happens when Monitoring, Observability and Cybersecurity are no longer treated as separate disciplines? How can organizations gain a better understanding of complex IT environments? How can they identify relevant threats at an early stage? And how can they turn growing volumes of data and alerts into informed decisions? These were some of the key…
Read MoreImportant: GLPI security update Type/Severity NetEye Product Security has rated this update as having a medium security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 Summary The list of vulnerabilities, regarding to the bundled plugins, patched in this update is: For details on how to apply this…
Read MoreGLPI: Fix of the upgrade to NetEye 4.50 when custom GLPI plugins are installed During the upgrade to NetEye 4.50, NetEye moves the GLPI plugins that you installed manually out of the folder /usr/share/glpi/plugins. Before this fix, NetEye did not correctly identify which plugins were installed manually. On NetEye clusters with manually installed plugins, the…
Read MoreWhen a cyber incident occurs, one of the first challenges is understanding what happened, which systems were involved, and what traces were left behind. In this context, Velociraptor can help: It’s an open-source DFIR tool that can collect and examine endpoint data in a centralized, targeted, and repeatable way. After completing a course focused on…
Read MoreA field briefing on space threat intelligence, for security teams that run zero satellites but depend on dozens of them I don’t work in the space industry. I don’t design satellites, operate ground stations, or even analyze orbital telemetry in real time. Worth saying upfront, because it’s the right starting point for this kind of…
Read MoreTornado: Allow disabling forwarding of local system logs to Tornado By default, rsyslog on NetEye nodes forwards all logs it handles to the Tornado event engine. These include the system logs of the NetEye node itself, which can generate a large number of syslog events on Tornado. Until now, there was no way to turn…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Elastic Agent Elasticsearch Kibana Most of the 8 CVEs are resource-exhaustion weaknesses in Elasticsearch. These are Uncontrolled…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: Summary This Keycloak update (version 26.8.0) resolves several security issues identified in upstream Keycloak, including those fixed in upstream release 26.7.5:…
Read MoreOIDC group synchronization with read-only LDAP federation Fixed an issue that occurred when OIDC group synchronization was enabled alongside a read-only LDAP federation. The OIDC mapper attempted to modify LDAP-managed group memberships, resulting in the error: Not possible to delete LDAP group mappings as mapper mode is READ_ONLY. The synchronization logic now respects the LDAP…
Read MoreImportant: GLPI security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 Summary This is the list of vulnerabilities patched in this update: For details on how to apply this update, which includes the…
Read More
Turning Relevant Campaigns into Actionable Security Content To prioritize detection rule deployment based on threats that could realistically affect our organization or customer environments, we’ve developed an intelligence-driven detection model. Rather than prioritizing rules solely by mapping MITRE ATT&CK techniques and addressing coverage gaps indiscriminately, the model uses threat intelligence to identify which campaigns, behaviors,…
Read MoreIn my previous post, I was pointing out how an LLM context should be handled with care, and how there’s a better and worse way to basically interface with it. It’s not enough to “prompt in a clear way” or pack tons of customizations inside a CLAUDE.md file. In part 1, which you can read…
Read MoreNATS: Fix multi-tenancy configuration corruption in cluster environments When executing commands such as neteye install –restrict-services-to nats-server, neteye tenant config apply, or neteye satellite config create from a cluster node while nats-server was active on a different node, the shared /neteye/shared/nats-server/conf/multi-tenancy.conf configuration file could get corrupted. Unreplaced template placeholders (such as @@ACCOUNTS@@, @@TORNADO_IMPORTS@@, and @@TELEGRAF_IMPORTS@@)…
Read MoreUpgrading an existing NetEye cluster to 4.49 introduces a networking question that’s easy to underestimate. The existing environment may already have everything we normally associate with a NetEye cluster: a corporate network for frontend access and integrations, a private trusted network for internal cluster communication, and the corresponding virtual IPs. With Kubernetes entering the architecture…
Read More