Blog
News and notes from armor360
What the product does, how it works, and how to run it.
- How armor360 orders the alert queueWhy the order of an alert queue matters more than raw speed, and how armor360 sorts it: verdict first, then alert severity, with the unsure kept in view.
- What our AI verdict labels meanReal attack, suspicious, harmless, authorised activity and unsure: what each armor360 verdict means, how to read its confidence and what a reviewer does next.
- Why armor360 takes no response actionsarmor360 investigates and recommends but never isolates, blocks or disables anything. Here is why, what we do instead, and where automated response makes sense.
- How reviewer corrections become memoryWhen a reviewer agrees with or changes an armor360 verdict and adds context, it is remembered for later investigations about the same company. Here is how.
- Telling armor360 what your machines doAt set-up you tell armor360 what each machine does, which business processes it serves and who to call. Here is why that matters and how to write it well.
- What an on-premises AI SOC install looks likeWhat runs where when armor360 is installed on your own hardware, what you provide, who maintains what, and when the hosted option is the better fit.
- How to reduce noisy detection rulesFind your noisiest detection rules, choose between an exception and a rewrite, test the change on past data, and know when switching a rule off is right.
- MITRE ATT&CK coverage, explainedWhat MITRE ATT&CK tactics and techniques are, what a coverage map tells you and what it hides, and how to rank gaps by the threats you actually face.
- Detecting command-and-control beaconingWhat command-and-control beaconing looks like in network and process data, how to tell it from updaters and agents, and an example from our own lab.
- Living off the land on Linux: what to watchHow attackers use bash, curl, wget, python, cron and ssh on Linux, how to tell admin work from abuse, and which telemetry makes the difference.
- Suspicious sign-in patterns and what to checkImpossible travel, password spraying, MFA fatigue, risky new devices and interactive service accounts: how each shows in identity logs and how to check it.
- Why machines stop sending logs, and what to doA machine that stops sending logs is a blind spot. The usual causes, how to find silent machines in your SIEM, and a simple routine to keep coverage honest.
- How to write a SOC runbook analysts will useWhat a good SOC runbook holds, from trigger to who may act, how to keep it short and current, and a worked outline for a suspicious PowerShell alert.
- SOC shift handover: a template that worksWhat gets lost between SOC shifts, a handover template you can copy, and how to track open investigations, pending approvals and the morning review.
- SOC analyst burnout: causes and what helpsWhy SOC analysts burn out, the signs to watch for, and what team leads can change, with an honest look at what tools can and cannot fix.
- SOC escalation paths that work in practiceHow to build SOC escalation paths people follow: who to call for what, agreed severity levels, owners for key systems and contact lists kept current.
- Onboarding a new SOC analyst: the first weeksA practical plan for a new SOC analyst’s first weeks: shadowing, reading real investigations, learning the business and taking on work in stages.
- Tuning security alerts with the businessHow to tune noisy security alerts with IT and application owners: learn what normal looks like, record the context and get exceptions approved.
- How AI agents investigate security alertsAn AI agent investigates an alert by choosing its own queries, one step at a time. How that loop works, why each record is kept, and where it falls short.
- Prompt injection in security logs and alertsAttackers write much of the text an AI analyst reads. How prompt injection reaches it through logs, files and emails, and the defences that hold up.
- Why AI confidence scores matter in the SOCA confidence score only helps if 90% means right about nine times in ten. What calibration is, how reviewers should use it, and how to check it yourself.
- Local vs hosted AI models for security workRun an AI model on your own hardware or call a hosted one? The trade-offs for security teams in data, cost per alert, speed, control and specialisation.
- How AI analysts get it wrong in the SOCAI analysts go wrong in predictable ways: missing data, misread records, overconfidence and tidy but false stories. How cited evidence and review catch them.
- Keeping people in charge of AI in securityHuman oversight of AI in security works when it is built in: clear lines of authority, recorded approvals, two-person rules and an audit trail you can read.
- How to explain security to the boardWhat boards really ask about security, how to turn alerts into business risk, and a one-page monthly report that leaves out the vanity numbers.
- The business case for an AI SOCHow to build the business case for an AI SOC: the hours spent on first looks, gaps at night, an illustrative calculation and how a pilot gives you real numbers.
- Questions auditors ask about AI in securityThe five questions auditors ask about AI in security operations, what a good answer looks like for each, and how to prepare the evidence before they arrive.
- Security without a full SOC: where to startFor mid-sized firms with one or two security people: what to cover first, how MSSP and MDR services differ, and where an AI analyst helps and where it does not.
- What to automate first in security operationsAutomate reading and enrichment first, and decisions and actions last. A step-by-step ladder for security automation, and why read-only is the safe start.
- Twelve alerts, one attack: a lab storyIn our lab, 12 alerts from 5 rules turned out to be one attack on one Linux machine. How armor360 joined them into a single campaign, and why that matters.
- Introducing armor360: an AI first look at your security alertsarmor360 investigates security alerts from Elastic Security with AI and hands your team a verdict to review. Here is what it does, and what it leaves to people.
- How armor360 investigates an alert, step by stepWe followed one alert from our test lab from its arrival to the verdict a person reviewed. These are the real screens.
- Running an AI SOC analyst inside your own networkAlert data says a lot about a company. Here is what it takes to run armor360 so that data stays inside your environment.
New guides and posts by emailAbout once a month: a new guide to security operations, or what changed in armor360. No other mail.Subscribe by email
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.