Category Archives: Technology
Threat hunting in Cortex XDR is not the act of running broad queries until something looks unusual. It is a disciplined process for testing a security hypothesis against endpoint and related telemetry, validating what the results mean, and deciding whether the finding should expand into an incident, a new detection, or no action at all. […]
Cortex XSOAR playbooks can automate enrichment, triage, containment, notification, evidence collection, and many of the repetitive transitions in an incident workflow. The hard part is not drawing a sequence of tasks. It is designing automation that remains predictable when inputs are incomplete, integrations fail, cases take unexpected branches, and an analyst needs to understand exactly […]
TensorRT-LLM optimization is not a single compiler switch. It is the process of matching model representation, precision, memory layout, batching behavior, request scheduling, parallelism, and serving objectives to the hardware and traffic pattern that will actually run in production. A configuration that wins a throughput benchmark with long batches can be the wrong choice for […]
FortiSIEM correlation rules turn streams of normalized security events into incidents by expressing relationships that matter to the SOC. A rule can look for repeated behavior, sequences across subpatterns, thresholds, or conditions that become meaningful only when several events are evaluated together. The technical editor makes those relationships configurable, but useful correlation still depends on […]
Training and inference both run on accelerated computing, but they reward different infrastructure choices. Training is dominated by large forward-and-backward passes, optimizer state, checkpointing, and frequent synchronization across GPUs. Inference is dominated by request arrival patterns, model residency, KV-cache or activation memory, batching, latency targets, and continuous service availability. A platform can support both, yet […]
FortiSOAR case management is where alert records, incident ownership, tasks, evidence, collaboration, and automation become an operational workflow. The platform can receive large numbers of alerts, but a SOC still needs a consistent method for deciding which alerts become incidents, who owns the investigation, what evidence must be preserved, which tasks are required, and what […]
NVIDIA Triton Inference Server is best understood as a serving control plane for heterogeneous models rather than as a model format. It accepts inference requests through standard APIs, routes them to model-specific schedulers and backends, manages concurrency and batching, exposes health and performance telemetry, and can combine models into pipelines. That makes it useful when […]
API protection requires a different security posture from simply applying web-application rules to traffic that happens to use HTTP. APIs expose structured interfaces, machine identities, predictable schemas, and high-volume automated access. Attackers can abuse that structure with malformed objects, unexpected fields, excessive requests, stolen tokens, or calls to endpoints that were never meant to be […]
Cisco Secure Firewall policy design is the work of translating business access requirements into an ordered control system that can be reviewed, deployed, monitored, and changed safely. An access control policy can match traffic by network attributes, applications, users, security groups, URLs, and other context, but additional matching options do not automatically create better security. […]
Cisco Umbrella DNS Security has long provided a way to enforce security at the DNS layer, blocking access to malicious or unwanted destinations before a connection is established. In 2026, the design conversation also has to include platform transition: Cisco has announced the end-of-sale and end-of-life path for Umbrella SIG and DNS as the company […]
Zero Trust Network Access is often described as a replacement for remote-access VPN, but that description is too narrow for Cisco Secure Access. The more useful model is policy-controlled private application access in which identity, device trust, destination definition, traffic steering, and enforcement are evaluated together. A user is not simply placed “inside” the network […]
Cortex XSOAR becomes valuable when it can reliably exchange data and actions with the tools around the SOC. That makes integration design a core architecture problem rather than a setup task. An integration that works in a test command can still fail in production because credentials rotate, an API rate limit is reached, the remote […]
Access control becomes difficult when every table requires its own hand-maintained set of grants, row filters, and masking rules. The number of objects grows faster than the security team can review them, and the same category of sensitive data can be protected differently depending on who created the table. Unity Catalog attribute-based access control addresses […]
Cloud security changes when an application starts running. Build-time scanning can identify vulnerable packages and configuration issues, but runtime introduces processes, network connections, credentials, workload identities, user actions, and behavior that did not exist as static code. Cortex Cloud Runtime Security is designed for that active phase, adding detection and prevention around cloud workloads, containers, […]
A zero-trust design becomes meaningful only when a request can actually be denied, constrained, or terminated. A user may authenticate successfully yet still be unable to reach a payroll database from an unmanaged device; a privileged administrator may reach one management interface but not every server. Those decisions require more than an identity provider and […]
