logging
OMB M-26-14: Why federal agencies must fix asset visibility first
The U.S. Office of Management and Budget (OMB) has issued Memorandum M-26-14, a new directive for federal agencies focused on improving logging and network visibility. This memo replaces previous mandates with a five-level maturity model for logging, where progress is directly tied to an agency's ability to discover and inventory its IT, OT, and IoT assets. Achieving higher maturity levels requires progressively higher percentages of asset capture, making comprehensive asset visibility the foundational step for compliance.
Uncommon NIMLOC DNS Record Type Observed
The SANS Internet Storm Center has published an entry discussing the uncommon NIMLOC DNS record type, which has been observed appearing in network logs.
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap
Microsoft has made Azure AD Graph Activity Logs available for ingestion into Elastic, enabling threat detection within SIEM/XDR solutions. Previously, this critical telemetry was largely inaccessible to customers, leaving a significant visibility gap for defenders. This development allows for the monitoring of adversary activities that leverage the legacy graph.windows.net surface, which remained unlogged until recently.