Practical insights from Eventus on cybersecurity, SIEM+, managed security, IoT data platforms, cloud operations, and digital transformation.
Campaigns in SIEM+ already roll related cases into one story. The latest release goes one level up: campaign groups that belong to the same attack are now linked into a single campaign chain. We are also preparing support for three more SIEM platforms, OpenText ArcSight, IBM QRadar and Splunk, which are coming soon.
SIEM+ now supports Alicloud Security Center. More importantly, this release lets SIEM+ connect to several SIEM platforms at the same time, so analysts can investigate across them instead of inside one console at a time.
Alert fatigue is not only a queue problem. It is a story problem.
When a SOC is flooded with notifications, analysts often open one case at a time. Each case may be correct on its own. What is missing is the wider picture: which cases belong to the same attacker activity, the same account, or the same technique path. That gap is why teams can reduce noise and still feel like they are chasing fragments.
We wrote earlier about how 40,000 alerts can become fewer than 10 cases a day, and why alert fatigue is a business problem, not only a SOC inconvenience. SIEM+ 1.1.0 adds the next layer: campaigns that connect related cases so you can move from a single alert to the whole attack story.
Around mid-October 2026, Fortinet PSIRT published a cluster of product security advisories across FortiOS, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, and related products. One widely noted item in that wave was FG-IR-26-181 / CVE-2026-106174: an improper locking issue in FortiOS that can let an unauthenticated network attacker deny service to the HTTPS management GUI on affected 8.0.0 and 7.6.4–7.6.6 builds.
For security teams that already run a SIEM, the interesting part is not any single CVE. It is what happens to the queue when a major vendor drops a dense advisory set in a short window.
Eventus has published a new engineering article on Qiita: “Shifting Phishing Investigations from a Single Email to a Campaign: Scoping Impact with Defender XDR and Sentinel” (「フィッシング調査を『1通のメール』から『キャンペーン単位』に切り替える―Defender XDRとSentinelで影響範囲を出す」).