Mark Runals' Blog

Today in the car I heard a credit card debt consolidation commercial that sort of drove me crazy. While there is a place for those companies...

Crazy thought I know but it isn’t hard not to get caught up in that mentality. I was trying to think of a way to tell the story of resources...

The other day I read a bit by Andreas M. Antonopoulos on Networkworld about how to be an effective security buyer . Of course when it came t...

I wanted to post something a little more positive when it comes to the ArcSight Lego concept. Several months ago a group at work was charged...

(Or for Chris' sake the Erector set!) This post came mostly out of a comment and thread post on the internal ArcSight forums. The same...

The problem with looking through logs is its a little like looking through a whole lot of poop. Metaphorically speaking. I mean I have never...

Sadly its not looking good for the presentation idea I submitted for the ArcSight '10 User Conference. Don't get me wrong - I know ...

There have been a couple articles that have popped up here and there that seem to have had their base in Duncan Hoopes’ FUDsec article relat...

If you are like me you are always (or in stages) on the lookout for “noise” events to filter out of the SIEM. Windows event 673 is fairly te...

I started looking for information on the web relative to SIEM use cases over a year ago. Almost a self search for just-in-time learning as i...

A couple weeks ago my wife was watching the Masters and I happened to see Phil Mickelson hit his second eagle in a row. The amazing part to ...