Realm Security

No entries match these filters. Clear filters

1. Context-Driven SIEM Log Reduction for SOC Teams (2026-09-10) Sep 10, 2026 · issue 070

   Realm adds Reduction Rule Assessments with Reasoning and Considerations sections powered by Clarity AI for every recommended SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. log reduction rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Introduces Reduction Rule Assessments — AI-generated evaluations shipped with every recommended reduction rule, split into a Reasoning section (why the rule is likely effective) and a Considerations section (where it may not be appropriate for a given environment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Realm Clarity AI now reasons over what your sources produce and what each destination needs to generate rule assessments tuned to the actual conditions defined in each rule, not generic category descriptions.
   • Detection Integrity maps every candidate reduction against the detections you currently run, protects the log fields those detections depend on, and flags at-risk detections as findings rather than silently cutting their data.
   • Data Haven retains a complete, immutable copy of all reduced log data with OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. observables attached, keeping it searchable and re-suppliable to any destination if a reduction proves incorrect.

   4 details in Everything

2. Realm + Databricks Zerobus Ingest: Clean, Structured Security Data, Delivered Direct (2026-08-04) Aug 4, 2026 · issue 054

   Realm now streams parsed, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.-normalized, enriched security logs directly into Databricks Delta Lake via the Zerobus Ingest push API, governed by Unity Catalog.

   • New Databricks integration delivers security telemetry directly into Unity Catalog Delta tables via Zerobus Ingest, Databricks' serverless push-based ingestion API, with no customer-managed staging bucket or message bus.
   • Realm streams both raw logs and parsed, OCSF-normalized versions simultaneously, letting teams route raw events to Bronze and structured data to Silver within their medallion architecture.
   • Real-time enrichment with GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services., threat intel, and customer-supplied CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. or HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. context is applied as events flow through, before they land in the lakehouse.
   • Output feed is configured through the Realm UI; once the Databricks target table, Zerobus Ingest endpoint, and access credentials are created, data flows with no additional pipeline to build or maintain.

   4 details in Everything

3. Realm Security Debuts Detection Integrity to Prove that Reducing SIEM Log Volume Never Breaks a Threat Detection (2026-07-28) Jul 28, 2026 · issue 054

   Realm Security adds Detection Integrity and Data Haven Search to cut SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. volume without breaking coverage.

   └──▷ HOW TO FIND IT
   During an active investigation, search Data Haven to pull historical events that were never sent to the SIEM and resupply them to your analysis destination.
   📍In the Realm Platform, go to Data Haven › Search, query against OCSF-normalized observables for the relevant time window, then select Resupply to forward the matching raw events to your chosen destination.
   • New Detection Integrity capability reads every SIEM detection, maps each rule to its dependent log sources and fields, and auto-generates pipeline protection rules to preserve coverage as volume is reduced — supporting Sigma, KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly., and SPL.
   • Detection Integrity produces a shareable report showing what was reduced, what was protected, projected savings, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage before and after each reduction; when a cut cannot be applied safely, it flags the finding instead of cutting.
   • New search inside Realm Data Haven lets analysts query their full immutable security history directly against OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.-normalized observables and resupply exact events to any destination — no restore step, no schema setup, no data-lake infrastructure required.
   • Data Haven Search launches with unmetered queries: pricing is based on ingestion volume, not on how much analysts query or retrieve.

   4 details in Everything