April 2024 Summaries

On April 12, 2024, Palo Alto Networks disclosed a critical vulnerability, CVE-2024-3400, in its PAN-OS operating system affecting the GlobalProtect feature, which allows unauthenticated attackers to execute code with root privileges through command injection. This flaw, actively exploited since at least March 26, 2024, poses significant security risks to approximately 22,500 exposed Palo Alto GlobalProtect firewall devices and affects specific versions of PAN-OS with enabled Device Telemetry. The vulnerability does not impact cloud firewalls, Panorama appliances, or Prisma Access, and has been addressed with hotfix releases and upcoming patches for affected PAN-OS versions. Mitigation strategies include disabling device telemetry for customers without a Threat Prevention subscription until systems are updated. Coralogix's security team has incorporated related indicators of compromise into their threat intel feed to aid detection and offer further assistance through their Security Resource Center.

Sumo Logic's new Flex Pricing model allows users to ingest unlimited data into their platform, charging only when data is queried, thus aiming to maximize ROI by aligning costs with value extracted. However, this model, only available to new customers, brings challenges in cost transparency and predictability, as it charges for all scanned data and retains hidden costs related to data retention not clearly disclosed on their website. This can lead to unpredictable expenses, discouraging users from extensive querying or data ingestion due to potential cost spikes. In contrast, Coralogix presents a more straightforward and predictable pricing model, encouraging users to freely access their data without additional costs per query and offering competitive ingestion rates, which can enhance insight generation and overall data platform utilization. Coralogix also highlights its superior customer support with faster response times compared to Sumo Logic’s offerings, aiming to provide a more user-friendly and cost-effective solution for observability needs.

As data volumes increase, organizations face challenges in storing and monitoring data efficiently, often leading to poor analysis and alert fatigue. Coralogix addresses these issues with its Events2Metrics feature, which extracts essential metrics from logs and spans, enhancing performance, observability, and cost efficiency. This approach allows teams to maintain rich contextual insights while reducing data storage needs and costs by archiving logs and spans affordably. Events2Metrics offers flexibility in metric retention, enabling precise monitoring and alerting without sacrificing data retention or incurring high costs. By structuring metrics for efficient long-term storage, organizations gain actionable insights quickly, improve monitoring, and optimize alerts, significantly enhancing operational efficiency and data analysis.