RunReveal

RunReveal is delighted to have had the opportunity to open Nasdaq with the other Okta SaaS Startup competition finalists Validia and Block Party. Nothing says you've made it quite like standing there in a suit at 9:30 AM, dramatically pushing a button on a tablet. You spend years building a company, and this moment of glory is essentially being a really well-dressed doorbell operator. ?? And while we've come a long way already, we're still just getting started. Every day is a new opportunity and a chance to build something great. Ringing the bell is just the opening, just wait until you see what we can do next!

Yesterday at Nasdaq, we asked the finalists of our SaaS Startup Competition to imagine the possibilities if everyone used their company's products. Hear their vision for a safer world. ??

Most of RunReveal made it to the NASDAQ bell ringing this morning! Very cool experience! Alan Braithwaite, Andrew Shifflett, Michael Harpe, and I got to be part of the bell ringing ceremony this morning! Thanks everyone at Okta Ventures especially Eunice Wong, Austin Arensberg, and Jessica (Valdez) Martinez for allowing us be part of the experience. Congrats to Justin Marciano Paul Vann and Tracy Chou as well!

Tomorrow's the big day! Tomorrow, RunReveal is taking the stage at Oktane for the Startup Competition Finals! ?? We’re thrilled to compete against the incredible startups Validia and Block Party in front of an all-star panel of judges from the worlds of cybersecurity and identity: Galina Antova, Nick Galbreath, and Neena Thomas. When: Tomorrow, October 15th Where: Oktane24, Las Vegas Caesar's Forum We’ve worked hard to get here, and we’d love to have your support in the audience or following along online. Don't miss the chance to see what’s next for SaaS identity security! ?? Follow our journey and cheer us on! ?? #Oktane24 #SaaS #Startups #IdentitySecurity #RunReveal

We'll be competing on stage at Oktane less than a week from now! If you'll be attending Oktane, reach out! We'd love to meet you.

We at RunReveal are absolutely thrilled to be considered as a finalist in Okta's very first Startup Competition! ?? https://lnkd.in/gHDhKGcK Alongside the other finalists Validia and Block Party, we'll be going on stage at Oktane on October 15th to present in front of a panel of judges working in the intersection of cybersecurity and identity: Galina Antova, Nick Galbreath and Neena Thomas. Learn more about our journey and follow us to follow along! https://lnkd.in/gJ-N8rM4 We couldn't have done it without our incredibly supportive customers. Thank you! ?#Oktane24 #SaaS #Startups #IdentitySecurity Thank you Okta, Eunice Wong, Austin Arensberg, and Jessica (Valdez) Martinez for the awesome opportunity and Brandon Adams for capturing our story so incredibly well!

Friday malware news: The new `perfctl` Linux malware proves that XKCD 272 becomes less relevant every day as Linux becomes more popular! (See comments for reference) `perfctl` is Linux malware that infects systems using weak credentials, common misconfigurations and easy RCEs. It hides and gains persistence using launch services and the `.profile` script, and has been active in the wild for at least 3 years. Discovered by Aqua Security, it includes a rootkit that hooks LD_PRELOAD for persistence and evasion and pcap_loop to evade detection via host network monitoring. This malware highlights the continued importance of network-level monitoring similar to what Harvey does with RunReveal by monitoring flow logs. With RunReveal automatic managed enrichments, the TOR traffic coming from infected boxes would have been caught immediately. Don't underestimate the power of network and flow log monitoring. Malware may be able to escape XDR monitoring on the host, but it continues to be challenging for threat actors to hide network traffic. What do you think? Do you monitor the network for threats? What's the signature you'd pick out of this research to add to your SIEM?

I'm so excited that RunReveal is announcing Automatic Enrichments. We rewrite the log as soon as we receive it to include additional threat intel information, and RunReveal is already enriching over 250,000 logs per second in our pipeline at peak times. The best part is we built our detections, destinations, and all of our other features to be compatible with automatic enrichments. We normalize all logs immediately after we receive them from log sources, enriching them, running them through our detection engine (https://sigmalite.dev), and then storing the results in a storage bucket or a high performance db like ClickHouse so you can threat hunt, correlate, and respond quickly when you need to. This feature being boiled down to a single toggle and searching through over 125,000 IP addresses over 250,000 times per second is mind-blowing and all of the technical details of how that works will be published in a blog in the next week or so! I tend to think there's a lot more automatic enrichments we should build. For example, HRIS integrations to append title/role name to logs so you can easily spot abnormal behavior. It's still early days but this announcement has me really excited about what's possible. Anyways, give it a read. https://lnkd.in/gV9jQHuB

At RunReveal, we're committed to helping ensure that no breach goes undetected. As part of that, lowering barriers to good tools is critical. That's why we're making Automatic Managed Enrichments for IP threat intelligence available to every customer today, for free. Automatic enrichments augment your security data in real time as it comes in with IP intelligence capabilities to help you identify when low reputation IPs are performing actions against your IT infrastructure. When starting my career, I was deeply inspired by Cloudflare's goal of helping to secure the internet by providing SSL for free to websites. When they started, it was common to see plaintext websites. Now, they're very rare. We're doing the same thing for security data. You shouldn't need a team of experts and specialists maintaining your SIEM, and there shouldn't be minimum contract values to get started with something useful. Huge props to the team for making this possible! We're turning log processing on it's head with our efficiency and execution. Wouldn't be possible without them. Check it out today! Blog in comments.

??? Sigmalite: New OSS tool that can run Sigma rules without a SIEM. Designed for stream processing and can be embedded into data pipelines, decoupling detection from data storage. Sigmalite supports real-time streaming detections and allows users to make decisions about log handling (e.g., storage location, forwarding) based on Sigma rule matches. By RunReveal, H/T Evan J Johnson for sharing. https://lnkd.in/g2NgmFPF #cybersecurity