September 23, 2022
A log file is an event that took place at a certain time and might have metadata that contextualizes it.
Log files are a historical record of everything and anything that happens within a system, including events such as transactions, errors and intrusions. That data can be transmitted in different ways and can be in both structured, semi-structured and unstructured format.
The basic anatomy of a log file includes:
However, depending on the type of log source, the file will also contain a wealth of relevant data. For example, server logs will also include the referred webpage, http status code, bytes served, user agents, and more.
Just about everything produces some version of a log, including:
The list goes on, but the point is, almost all infrastructure that you interact with on a daily basis produces a log file.
Log files can provide almost every role at an organization with valuable insights. Below are some of the most common use cases by job function:
ITOps
DevOps
DevSecOps
SecOps/Security
IT Analysts
Nearly every component in a network generates a different type of data and each component collects that data in its own log. Because of that, many types of logs exist, including:
While there are seemingly infinite insights to be gained from log files, there are a few core challenges that prevent organizations from unlocking the value offered in log data.
With the rise of the cloud, hybrid networks, and digital transformation, the volume of data collected by logs has ballooned by orders of magnitude. If almost everything produces a log, how can an organization manage the sheer volume of data to quickly realize the full value offered by log files?
Unfortunately, not all log files follow a uniform format. Depending on the type of log, the data may be structured, semi-structured or unstructured. In order to absorb and derive valuable insights from all log files in real-time, the data requires a level of normalization to make it easily parsable.
According to Gartner, many organizations, especially midsize enterprises and organizations with less-mature security operations, have gaps in their monitoring and incident investigation capabilities. The decentralized approach to log management in their IT environments makes detecting and responding to threats nearly impossible.
In addition, many organizations rely on SIEM solutions that are limited by cost and capability. SIEM licensing models are based on the volume or velocity of data ingested by the SIEM often increase costs for the technology, making broad data collection cost-prohibitive (although many log management tools have similar pricing models). In addition, as data volumes grow, SIEM tools might experience performance issues, as well as increasing operations costs for tuning and support.
Falcon LogScale Community Edition (previously Humio) offers a free modern log management platform for the cloud. Leverage streaming data ingestion to achieve instant visibility across distributed systems and prevent and resolve incidents.
Falcon LogScale Community Edition, available instantly at no cost, includes the following:
Get Started Free
A new covert attack campaign singled out multiple military and weapons contractor companies with spear-phishing emails to trigger a multi-stage infection process designed to deploy an unknown payload on compromised machines.
The highly-targeted intrusions, dubbed STEEP#MAVERICK by Securonix, also targeted a strategic supplier to the F-35 Lightning II fighter aircraft.
“The attack was carried out starting in late summer 2022 targeting at least two high-profile military contractor companies,” Den Iuzvyk, Tim Peck, and Oleg Kolesnikov said in an analysis.
Infection chains begin with a phishing mail with a ZIP archive attachment containing a shortcut file that claims to be a PDF document about “Company & Benefits,” which is then used to retrieve a stager — an initial binary that’s used to download the desired malware — from a remote server.
This PowerShell stager sets the stage for a “robust chain of stagers” that progresses through seven more steps, when the final PowerShell script executes a remote payload “header.png” hosted on a server named “terma[.]app.”
“While we were able to download and analyze the header.png file, we were not able to decode it as we believe the campaign was completed and our theory is that the file was replaced in order to prevent further analysis,” the researchers explained.
“Our attempts to decode the payload would only produce garbage data.”
What’s notable about the modus operandi is the incorporation of obfuscated code designed to thwart analysis, in addition to scanning for the presence of debugging software and halt the execution if the system language is set to Chinese or Russian.
The malware is also designed to verify the amount of physical memory, and once again terminate itself if it’s less than 4GB. Also included is a check for virtualization infrastructure to determine if the malware is being executed in an analysis environment or sandbox.
But if this test fails, rather than simply quitting the execution, the malware disables system network adapters, reconfigures Windows Firewall to block all inbound and outbound traffic, recursively deletes data in all drives, and shuts down the computer.
Should all these checks pass, the PowerShell stager proceeds to disable logging, add Windows Defender exclusions for LNK, RAR, and EXE files, and establish persistence via a scheduled task or Windows Registry modifications.
“Overall, it is clear that this attack was relatively sophisticated with the malicious threat actor paying specific attention to OPSEC,” the researchers noted. “While this was a very targeted attack, the tactics and techniques used are well known and it is important to stay vigilant.”
Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.
New Procore product enhancements continue to support the needs of its customers around the world.
Procore’s new collaborative document management solution, coming soon, will make it easier and faster to access and collaborate on documents. (Graphic: Business Wire)
Procore’s new collaborative document management solution, coming soon, will make it easier and faster to access and collaborate on documents. (Graphic: Business Wire)
New Procore product enhancements continue to support the needs of its customers around the world. (Graphic: Business Wire)
CARPINTERIA, Calif.–(BUSINESS WIRE)–Procore Technologies, Inc. (NYSE: PCOR), a leading provider of construction management software, today announced multiple platform updates to further meet the needs of its global customers — from document control to data and privacy enhancements. Used in over 125 countries, Procore’s platform is continually advancing to provide customers with everything they need to meet business and security needs worldwide.
“Procore builds software for the people who build the world,” said Tooey Courtemanche, Procore founder and CEO. “Our platform enhancements for customizability, security, privacy, storage, and collaborative document management will benefit both existing and new customers as we continue to expand internationally.”
Collaborative Document Management Goes Global
Procore is taking its world-class document solution global to improve how the industry collaborates on construction documents across all project stakeholders. This is often a fragmented and inefficient process with construction teams using multiple disconnected solutions for versioning, markup, and workflow management. In 2020, 90 million documents were uploaded to the Procore platform. Procore’s new collaborative document management solution, coming soon, will offer a more flexible and configurable approach, making it easier and faster to access and collaborate on documents. It will provide customers with an integrated markup experience, offer custom approval workflows with granular file level permissions, and provide a solution that helps them meet common data environment (CDE) requirements and ISO compliance standards.
“We use Procore to manage documents on our projects and to digitise our inspections and snagging processes,” said Philip Lambourne MSc MCIOB, head of design and information management at Henry Boot Construction Limited in the UK. “The level of support Procore offered with configuring the platform and its usability was largely the reason behind our decision to select them. The support provided is vital, not only for our internal employees but for all our supply chain partners.”
“For all Procore customers around the world, this will provide a single location for all project documents, from preconstruction through closeout, and can only be accomplished with a true platform offering unlimited users, unlimited data and unlimited collaboration on every project,” said Wyatt Jenkins, Procore’s Senior Vice President of Product.
Global Cloud Infrastructure and Security Features to Meet Global Needs
Procore has expanded its global infrastructure with 11 new cloud data centers for file storage, now 15 in total, that allow customers to store certain project data locally, while also improving the speed and performance of the platform. Procore provides enterprise grade security and privacy features such as data encryption-at-rest, managed bug bounty program, strict access control policies, and more. Procore solutions can assist customers in meeting their data privacy and governance requirements, including GDPR, California’s Consumer Privacy Act (CCPA) and Australia’s Privacy Act of 1988 — learn more here.
Platform Flexibility and Global Enhancements Drive Customer Success
With feedback from global customers, Procore is building customization into the platform to meet the diverse needs of customers around the world. Whether building an inspection test plan in Australia or contractual correspondence in Germany, Procore’s customizable platform flexes to support regional business needs. Custom and Configurable fields are now supported by every product across the platform.
For Dean Hopkins, chief operations officer at Oxford Properties, “Procore is a big part of creating a global development platform, where we can benefit from what teams in Australia are doing and learning, and that can actually translate to what we’re doing in North America on projects, and then also to our teams in Europe on projects. Procore is at the center of collaboration that activates this global pool of expertise.”
Industry Votes Procore as Top Construction Platform Solution
Procore was recently named the tenth best software company in the world on The Software Report’s list of 100 Top Software Companies of 2021, and received top honors from G2 in eight categories of software: construction management, construction project management, bid management, construction ERP, construction drawing management, construction accounting, punch list, and jobsite management software.
To learn more about these platform enhancements, register and join Procore virtually at Groundbreak, the company’s annual conference being held October 12-14.
Forward-looking Statements
This press release contains forward-looking statements about Procore and its industry that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this press release, including, but not limited to: statements regarding the expected performance of Procore’s business and objectives of management for future operations, are forward-looking statements. Procore has based the forward-looking statements contained in this press release primarily on its current expectations and projections about future events and trends that Procore believes may affect its business, financial condition, and operating results. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties, and other factors that could cause results to differ materially from Procore’s current expectations. You should not place undue reliance on Procore’s forward-looking statements. Procore assumes no obligation to update any forward-looking statements to reflect events or circumstances that exist or change after the date on which they were made, except as required by law.
About Procore
Procore is a leading provider of construction management software. Over 1 million projects and more than $1 trillion USD in construction volume have run on Procore’s platform. Procore’s platform connects key project stakeholders to solutions Procore has built specifically for the construction industry—for the owner, the general contractor, and the specialty contractor. Procore’s App Marketplace has a multitude of partner solutions that integrate seamlessly with Procore’s platform, giving construction professionals the freedom to connect with what works best for them. Headquartered in Carpinteria, California, Procore has offices around the globe. Learn more at Procore.com.
Media Contact
Raelle Alfaro
press@procore.com
Investor Contact
Matthew Puljiz
ir@procore.com
Media Contact
Raelle Alfaro
press@procore.com
Investor Contact
Matthew Puljiz
ir@procore.com
