Elastic Security Labs — The Cyber Toolchain

Elastic Security Labs How CVE-2026-73570 turns a Zimbra log file into remote code execution (2026-10-23)

Fri, 23 Oct 2026 00:00:00 GMT

Elastic Security adds a SIEM detection rule for CVE-2026-73570 Zimbra Swatchdog command injection via log-file RCE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the 'Zimbra Swatchdog SNMP Command Injection Execution' SIEM rule, which fires on a two-step process sequence: a shell spawned from a Perl `swatchdog_script` parent with `snmptrap`, `zmservicename`, and `zmservicestatus` in its command line, followed by any child process other than `snmptrap`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Auditing the auditor: Unmasking Apex Accelerator (2026-10-12)

Mon, 12 Oct 2026 00:00:00 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage (2026-10-05)

Mon, 05 Oct 2026 00:00:00 GMT

Elastic SIEM adds monthly-refreshed Noise, Performance, Threat, and Profile tags to all 1,781 prebuilt detection rules to guide enablement decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Noise: Low`, `Noise: Medium`, `Noise: High`, and `Noise: Unknown` tags to prebuilt rules, scored monthly from 30-day fleet telemetry using a `global_noise` metric (mean alerts per distinct environment on firing days), with per-platform percentile cuts for Windows, Linux, macOS, AWS, Azure, GCP, Google Workspace, Microsoft 365, Okta, and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Performance: Fast`, `Performance: Normal`, `Performance: Slow`, `Performance: Very Slow`, and `Performance: Unknown` tags using absolute execution-time thresholds (e.g. `Performance: Fast` requires average ≤400 ms, p95 <1 s, zero 30-second executions, and ≥5 sampled environments). • Adds `Threat` tags drawn from a managed TRaDE-team catalog — covering categories such as Supply Chain, ClickFix, Phishing Kits, and RMM abuse — applied deterministically via heuristics and, as a fallback, via LLM suggestion capped at five tags per rule and filtered against the approved catalog. • Adds `Profile: Recommended` and `Profile: Aggressive` summary tags that synthesize severity, `Noise`, `Performance`, and `Threat` scores into a single deployment-posture label: `Profile: Recommended` requires a composite score ≥7 with no `Noise: High` and non-low severity; `Profile: Aggressive` fires on `Noise: High` (hard gate) or score <2. • Adds a standardised prebuilt-rule tag taxonomy with `Domain`, `Platform`, `Data Source`, `Service`, `Vuln`, and `Resources` dimensions to enable more granular rule-search queries. • Plans to add `MITRE ATLAS` tags alongside existing `MITRE ATT&CK` tags in the next release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage (2026-10-05)

Mon, 05 Oct 2026 00:00:00 GMT

Elastic Security Labs Quarantined isn't contained: Agentic phishing response with Elastic and Sublime (2026-09-28)

Mon, 28 Sep 2026 00:00:00 GMT

Elastic Security adds a native two-way Sublime Security integration, correlating email threat telemetry with endpoint, identity, and network signals and enabling SOAR-driven⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a native Sublime Security integration that ingests email threat telemetry (flagged message, detection rationale, targeted recipient, and Sublime action taken) into Elastic Security for correlation with endpoint, identity, and network signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a two-way SOAR integration with Sublime Security inside Elastic Workflows, enabling response actions on the Sublime side — such as triggering a blast-radius quarantine using a SHA-256 hash from an Elastic Defend finding — without leaving Elastic. • Attack Discovery agentic workflow correlates Sublime Security email alerts with endpoint and other signals into unified, MITRE ATT&CK-mapped attack chains, querying raw logs and gathering supporting evidence before surfacing a prioritized incident to analysts. • Elastic Workflows supports per-action configurable autonomy, letting teams set individual steps to run automatically or route through an analyst approval flow rather than applying a single automation policy across the whole system. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless (2026-09-18)

Fri, 18 Sep 2026 00:00:00 GMT

Elastic Security Serverless gains cross-project search (CPS), letting one origin project run ~2,100 detection rules across up to 100 linked projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Consolidates all rule-generated alerts into a single queue on the origin project, eliminating per-project rule duplication and multi-context analyst hopping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Surfaces cross-project scope in Discover and non-managed dashboards for broad ES|QL hunting sweeps; Security managed pages show the CPS scope selector as read-only so analysts see in-scope projects while admins set defaults per space. • Extends Timeline search, Alert flyout, and Analyzer/Correlations views (read-only) across linked projects so analysts can follow an attack chain without leaving the origin. • Supports machine learning datafeeds reading linked-project data, with jobs and results stored on the origin for centralized ML anomaly detection. • Provides entity store partial cross-project support: origin profiles include entities from every linked project, though per-project risk scores are not merged across projects. • Enforces a 100 linked-project default limit per origin, with higher limits available by contacting Elastic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Linux Detection Engineering - Local Privilege Escalation (2026-09-11)

Fri, 11 Sep 2026 00:00:00 GMT

Elastic Security Labs adds a layered Linux LPE detection framework covering SUID/SGID abuse, page-cache exploits, and COW-class kernel bugs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `Suspicious SUID/SGID Utility Execution` detection rule combining euid-0 / non-root-real-user shape, low `process.args_count`, and interpreter or writable-path parent to catch abuse of `su`, `sudo`, `pkexec`, and `passwd` with near-zero false positives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `Potential Privilege Escalation via a SUID/SGID Binary` detection rule using an EQL stringcontains(process.executable, process.command_line) trick to catch abuse of uncommon or long-tail SUID binaries without maintaining a hard-coded name list. • Adds a SUID helper proxy-execution detection rule that inspects `process.args` (rather than `process.name`) for known setuid binary paths — including `/usr/bin/pkexec`, `/usr/lib/snapd/snap-confine`, `/usr/bin/newuidmap`, and `/usr/libexec/openssh/ssh-keysign` — combined with `process.args_count <= 2` to catch cases where the helper is passed as an argument to another privileged binary. • Adds outcome-oriented general LPE detection rules keyed on the common escalation skeleton — an unprivileged process (`uid != 0`) executing from writable paths such as `/tmp`, `/dev/shm`, `/var/tmp`, `/run/user/`, or `/home/` that becomes root — covering page-cache and no-userland-tell kernel bugs where no implementation-specific artifact is present. • Adds Auditd Manager integration guidance for syscall-level LPE visibility, requiring `socket`, `splice`, `bind`, and `execve` audit rules to surface the page-cache exploit family including Copy Fail and DirtyFrag. • Extends Elastic prebuilt rule coverage for Linux privilege escalation techniques mapped to MITRE ATT&CK `T1548.001` (Abuse Elevation Control Mechanism: Setuid and Setgid), available in the `detection-rules` repository (SIEM) and the `protections-artifacts` repository (endpoint behavioral rules). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Linux Detection Engineering - Fileless Execution (2026-09-01)

Tue, 01 Sep 2026 14:26:37 GMT

Elastic Security 9.4.0 adds process events for `memfd_create` and kernel module loads on Linux, exposing fileless ELF execution in Defend telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `process.Ext.memfd.name`, `process.Ext.memfd.flags`, `flag_cloexec`, `flag_allow_seal`, `flag_hugetlb`, `flag_noexec_seal`, and `flag_exec` fields to process events in Elastic Defend, capturing `memfd_create` syscall arguments for hunting fileless ELF execution chains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Elastic Defend now records a process event when a process calls `memfd_create` on Linux (requires kernel 5.10.16+ for eBPF-based event sourcing), starting from Elastic Security 9.4.0. • Adds `load_module` event action to process events in Elastic Defend, reporting `init_module` and `finit_module`-based loadable kernel module loads for visibility into fileless kernel module activity. • Introduces FENIX (Fileless Execution for NIX), an open-source lab framework at `github.com/elastic/FENIX` with a `fenix run ` CLI for reproducing and testing memfd-based fileless execution patterns against Elastic Defend telemetry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs From 88 lines to 1: Detecting DLL hijacking with Elastic Defend (2026-08-28)

Fri, 28 Aug 2026 00:00:00 GMT

Elastic Defend 9.5.0 adds a `dll.Ext.defense_evasions` field that reduces DLL hijacking detection from 88 lines to one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `dll.Ext.defense_evasions: "DLL Hijack: Masquerading"` field in Elastic Defend 9.5.0 to detect DLL search-order hijacking in a single rule condition, replacing rules that previously required ~88 lines covering ~2,600 named libraries, 10 excluded Windows system paths, signature checks, and a drop-to-load time window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enriches DLL load events with `DLL Hijack: Masquerading` when a loaded DLL is not Microsoft-signed and its name matches a cached inventory of Windows and system-library DLLs, enabling direct field-based detection in detection rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11)

Tue, 11 Aug 2026 00:00:00 GMT

Elastic Security Labs publishes a 280-line bash hook collector that ships every Cursor AI agent tool call to Elasticsearch as structured JSONL via Elastic Agent filestream. • Adds a 280-line dependency-free bash hook collector script (`log-tool-calls.sh`) available in the `elastic/elasticsearch-labs` repository, plus a PowerShell port for Windows, that records every Cursor AI agent tool call as JSONL to a date-rotated log file readable only by the owner (`chmod 0600`). • Promotes top-level structured fields (`hook_event_name`, `tool_name`, `command`, `file_path`, `mcp_server`, `model`, `session_id`, `duration`, `duration_ms`) plus an ECS-conformant `event` object (`event.category`, `event.type`, `event.outcome`) in every log entry for correlation with existing Elastic security indices. • Tags each event with a detected `agent` and `ide` surface (`cursor`, `cursor-cli`, or `remote`) by inspecting inherited environment variables (`CURSOR_VERSION`, `CURSOR_CODE_REMOTE`, `VSCODE_PID`, `VSCODE_CWD`, `VSCODE_IPC_HOOK`) so IDE and CLI sessions are distinguishable in a single log stream. • Delivers the collector to devices outside MDM via Cursor's Cloud Distribution console, which pushes a self-bootstrapping hook command that carries the collector script gzipped and base64-encoded and verifies it against a pinned SHA-256 hash on every invocation. • Provides an Elastic Agent filestream integration configuration that parses the JSONL logs into structured fields, enabling ES|QL queries across all agent activity — for example, identifying which hosts ran an agent that read a `.pem` file in a given time window. • Validates CLI coverage by running `cursor-agent --print 'say hello'` and tailing the date-stamped log at `~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl` to confirm `'agent':'cursor','ide':'cursor-cli'` appears. • Enforces local log retention of 30 days with opportunistic deletion of older files; Elasticsearch is the system of record for long-term storage. • Covers the `cursor-agent` headless CLI (used in CI and scripted runs) through the same `hooks.json`, firing identical hook events as the IDE. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11)

Tue, 11 Aug 2026 00:00:00 GMT

Elastic Security Labs The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent (2026-08-07)

Fri, 07 Aug 2026 00:00:00 GMT

Elastic Agent CEL integration snapshots .npmrc on a 6-hour heartbeat to detect silent removal of npm's min-release-age setting • Adds a ~40-line Common Expression Language (CEL) integration in Elastic Agent that snapshots every `.npmrc` on a 6-hour heartbeat and marks `cooldown.absent = true` in the ingest pipeline when `min-release-age` disappears between snapshots. • Uses the file() and dir() CEL functions to enumerate user home directories at runtime (under `/Users` and `/home`) and machine-global npm config paths (`/opt/homebrew/etc/npmrc`, `/usr/local/etc/npmrc`, `/etc/npmrc`, `/usr/lib/node_modules/npm/.npmrc`), covering macOS and Linux with a single script. • Sets `resource.url: file:///dev/null` to satisfy the CEL integration's required URL field without making an HTTP request, with global paths and poll interval supplied via the "Custom request cursor" YAML field in Fleet UI. • Filters registry auth token lines (`//registry.npmjs.org/:_authToken=...`) in the ingest pipeline before any data leaves the host, ensuring credentials are never indexed in Elasticsearch. • Emits per-file SHA-256 hashes (`file.hash.sha256`) alongside file content so the cursor can detect in-place rewrites of `.npmrc` that remove `min-release-age` without changing the file path. • Documents why the Custom Logs Filestream integration is unsuitable for config file state monitoring: files under 1024 bytes are silently held back under the default fingerprint identity strategy, and `filestream` emits only on append — not on content removal. • Explains that `clean_inactive` in the Filestream integration requires `ignore_older` to also be set, a coupling that is useful for log rotation but counterproductive for static config files that may sit unchanged for months. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent (2026-08-07)

Fri, 07 Aug 2026 00:00:00 GMT

Elastic Security Labs Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas (2026-07-31)

Fri, 31 Jul 2026 23:59:59 GMT

Elastic Security adds autonomous attack investigation, auto-drafted detection rules, Windows on ARM endpoint protection, and plain-language workflow authoring. • Attack Discovery now performs autonomous analyst-style investigation: threat-hunting raw events, checking entity risk, corroborating across data sources, and classifying events as validated attacks before they reach the queue. • Attack Discovery auto-drafts detection rules when it finds gaps not covered by existing rules, routing the draft to an analyst for approval. • New alert analysis workflow differentiates likely false positives from true positives upstream, reducing noise before Attack Discovery investigates. • Elastic Defend gains always-on vulnerable driver coverage: threat research continuously monitors VirusTotal, loldrivers.io, and Microsoft's blocklist and automatically generates and instantly deploys YARA rules as new drivers are disclosed. • Elastic Defend now provides full endpoint protection for Windows on ARM devices (e.g., Surface laptops), bringing them into the same protection tier as the rest of the fleet. • New endpoint troubleshooting skill automatically flags policy and performance issues on endpoints. • Elastic Workflows adds plain-language authoring, letting users describe an automation in natural language and have it generated automatically. • Elastic Workflows adds versioning with change history, diff comparison between any two versions, and one-click rollback. • Visual Mode in Elastic Workflows displays a workflow as a graph with triggers, steps, branches, and YAML side by side. • Human-in-the-loop approvals in Elastic Workflows pause execution at decision points and route approval requests to Slack. • Attack Discovery can be triggered directly from Elastic Workflows, enabling scheduled or event-driven investigation cadences. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC (2026-07-31)

Fri, 31 Jul 2026 00:00:00 GMT

Elastic Security 9.5 ships Alert Zero: AI-driven alert triage, attack chain investigation, and SOC workflow integration. • Adds the Security alert analysis workflow for first-pass AI triage of alerts generated by selected rules, classifying them as true positive, false positive, or inconclusive with optional auto-close above a configurable confidence threshold. • Adds a new Attacks page under Detections that surfaces Attack Discovery results alongside Alerts, making correlated attack chains a first-class operational object. • Extends Attack Discovery with a skill-backed investigation pipeline (powered by Elastic Agent Builder and Elastic Workflows) that hunts for related activity, inspects entity context, and searches raw logs before generating an attack narrative. • Adds detection gap analysis inside Attack Discovery: when the investigation uncovers activity missed by existing detections, it drafts an ES|QL rule for analyst review and explicit approval before creation. • Enables Attack Discovery to run on a schedule or be triggered from within an Elastic Workflow, making deep investigation always-on without requiring manual analyst initiation. • Exposes new Elastic Workflows steps to manage alert and attack status, tags, and assignees from the canvas, and to run the full Attack Discovery pipeline as a workflow step. • Supports custom retrieval and validation workflows in Attack Discovery, enabling teams to connect external enrichment sources (e.g., VirusTotal, MITRE ATT&CK context) or proprietary entity data. • Supports bring-your-own AI model, including local LLMs for air-gapped and sovereign deployments, for both alert triage and Attack Discovery. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support (2026-07-31)

Fri, 31 Jul 2026 00:00:00 GMT

Elastic Defend adds 800+ auto-generated vulnerable driver rules, ARM Windows support, and an AI troubleshooting skill in Agent Builder. • Continuously monitors VirusTotal, LOLDrivers catalog, and Microsoft's Vulnerable Driver Block List to automatically generate and instantly deploy YARA-based endpoint protection rules for newly disclosed vulnerable drivers — decoupled from any release cycle and published openly in the elastic/protections-artifacts repository. • Expands vulnerable driver detection coverage from 65 rules (2023) to 800+ known vulnerable drivers, growing automatically as new drivers are disclosed. • Adds Automatic Troubleshooting as a conversational skill in Elastic Agent Builder, enabling natural-language diagnosis of endpoint policy failures, third-party antivirus conflicts, and performance issues with specific remediation guidance. • Extends Elastic Defend support to Windows on ARM, covering Snapdragon laptops, Copilot+ PCs, and ARM workstations with the same detection rules and telemetry as x64 endpoints, enrollable under existing policies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here (2026-07-29)

Wed, 29 Jul 2026 00:00:00 GMT

Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration, translating Scheduled and NRT analytics rules to Elastic via LLM. • Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice. • Supports Watchlists-to-ES|QL Lookups conversion and Sentinel severity mapping during rule migration. • Identifies required Elastic integrations from exported Sentinel rules, enabling a 'rules-first' migration path to plan data onboarding before moving logs. • Surfaces per-rule translation status (Installed, Translated, Partially translated, Not translated, Failed) in the Manage Automatic Migrations UI. • Available in Tech Preview in Elastic Security 9.5 across multiple cloud providers and regions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap (2026-06-19)

Fri, 19 Jun 2026 00:00:00 GMT

Elastic now ingests Azure AD Graph Activity Logs for SIEM detection, closing a decade-long visibility gap on legacy AAD Graph enumeration. • Adds ingestion of AzureADGraphActivityLogs into Elastic via the Azure integration, landing events in `logs-azure.aadgraphactivitylogs-*` with full ECS extraction. • New dedicated 'Azure AD Graph Activity Logs' integration item available for direct policy-template installation in Kibana. • Enables typed ECS fields (`event.action`, `http.request.method`, `source.ip`, `user.id`, `user_agent.original`) plus dataset-specific fields under `azure.aadgraphactivitylogs.properties.*` for AAD Graph telemetry. • Supports threat hunting across five detection patterns: known offensive tooling user-agents, endpoint breadth (bulk enumeration), `*-internal` API version misuse, FOCI client-ID mismatches, and 4xx surge detection. • Exposes `azure.aadgraphactivitylogs.properties.api_version` to flag callers requesting `1.61-internal`, which returns `strongAuthenticationDetail` data not available via Microsoft Graph. • Populates `related.user` with both `user.id` and `properties.app_id`, enabling simultaneous pivot on identity and OAuth client dimensions. • Retains raw JSON in `event.original` for forensic replay, queryable via ES|QL's JSON_EXTRACT(). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs

Elastic Security Labs From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence (2026-06-02)

Tue, 02 Jun 2026 00:00:00 GMT

Elastic Security adds native Google Threat Intelligence integration with prebuilt dashboards, indicator match rules, and agentic VirusTotal enrichment. • New Google Threat Intelligence (GTI) integration ingests known-malicious IPs, domains, URLs, and file hashes into Elastic Security via two data streams — Threat List (high-confidence detections) and IOC Stream (broader hunting coverage) — with no additional infrastructure required. • Each ingested GTI indicator carries a verdict (Malicious, Suspicious, or Undetected), severity, and a composite 0–100 threat score, enabling confidence-based tuning of indicator match detection rules. • Supports 14 categorized GTI feed types including ransomware, infostealers, phishing, malicious infrastructure, IoT threats, macOS threats, threat actors, and vulnerability exploitation — coverage adjustable to subscription tier without Elastic configuration changes. • Automatic indicator lifecycle management handles expiration and revocation, reducing false positives from stale intelligence. • Prebuilt dashboards summarize threat intelligence activity across malware families, campaigns, threat actors, toolkits, and vulnerabilities to show which threat types are most active in the environment. • Agentic enrichment via Agent Builder and Elastic Workflows enables real-time VirusTotal queries, alert enrichment, telemetry correlation, and structured investigation summaries for indicators not yet in an indexed feed. • GTI indicators are normalized to Elastic Common Schema (ECS) and stored in a dedicated threat intelligence data view, enabling ES|QL-based historical hunting and correlation alongside TAXII feeds, custom intelligence, and endpoint/cloud telemetry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/elastic-security-labs