On Tuesday, 20 October, I was scrolling through Mastodon in the morning. Many of the accounts I follow work in infosec, just like I do. That’s where I first heard about the PHP2Shell vulnerability: details were unclear, but all PHP installations were affected. Pre-auth remote code execution, so absolutely critical. No fix available yet, but there were rumors about the first exploits being developed already. A patch would be released at 4 pm; until then, you should take anything running PHP and connected to the internet offline. Okay, I thought, this might be a busy day. As a reminder, I’ve only recently ended up in vulnerability management.

My greatest recent professional achievement is probably the fact that my manager now confidently sends me on rescue missions to clients who, for whatever reason, aren’t entirely happy with my company’s work anymore — believing that I can turn things around. Writing it down like that makes it sound a bit like a suicide mission leading straight to burnout, but it’s actually harmless. I’m good at dealing with people and communicating, and that’s what these missions are all about.

When I started specializing in SIEM systems as a consultant less than ten years ago, there were a few authoritative SIEM products on the market, operated on their own servers by the large organizations that used them:

• Splunk Enterprise (or Enterprise Security)
• ArcSight
• IBM QRadar

Other solutions existed, among others, Elastic’s full-fledged SIEM solution (as an add-on module on the Elastic or ELK stack) was emerging at that time.

Since then, an astonishing amount has happened in this market. In my perception, the three most important products are now the following: