R-Vision SIEM Debuts at Standoff 17 Cyber Battle and Processes 8.8 Million Correlation Events
R-Vision has published a detailed account of its first participation with R-Vision SIEM at the Standoff 17 cyber battle. The system was deployed for the akPots defender team to monitor a telecom-operator infrastructure, detect attacks and investigate incidents under conditions that closely resemble a real SOC environment.
Preparation began two weeks before the event. Approximately 80 percent of the event sources used in the Standoff infrastructure were already supported natively. The remaining 20 percent required the addition of two new sources, normalization adjustments for four sources, four new correlation rules and modifications to fifteen existing rules.
During the four-day exercise the system triggered 46 correlation rules, producing more than 8.8 million correlation events and 40 thousand alerts. The most frequent detections involved behavioral analysis from PT NAD, PT Container Security events, privilege-escalation attempts, web attacks and vulnerability exploitation.
Analysts actively used the platform, creating 13 custom widgets, 14 quick filters and running more than 9,000 search queries. Average query execution time was 1.5 seconds, with the heaviest query completing in four seconds while consuming 1.58 GB of ClickHouse memory.
The deployment was sized for an expected maximum of 3,000 events per second. Actual resource usage stayed modest: the collector averaged 0.7 CPU cores and 1.9 GB RAM, never exceeding 2.9 CPU cores and 3.5 GB RAM at peak. Team members gave the product scores of 4 or 5 out of 5 and indicated they would recommend it to colleagues, citing raw-text search, the RQL query language and event-grouping capabilities as the most valuable features.
Related articles
Mapping Logical Air Gap Techniques for Secure Network Segmentation
A detailed technical overview explores how organizations can achieve logical air gaps to isolate high-value network segments without completely severing data exchange. The article contrasts classic physical air gaps with everyday reverse proxies and introduces six distinct levels of isolation ranging from physical media to semantic validation. It evaluates each approach across three axes: whether a direct network path remains, which side initiates connections, and whether synchronous responses are possible. Practical constructions such as dual-homed hosts, message brokers, and schema-enforced proxies are examined alongside common misconceptions including reverse tunnels and port knocking. The guide emphasizes that true logical air gaps terminate sessions at an intermediary that then originates new, controlled exchanges. Real-world deployments typically combine multiple layers, such as network separation plus transport proxies plus content validation, to balance security and usability for critical environments like industrial control systems and backup repositories.
Oxygen Cloud Platform Deploys Russian VDI Solution for Heavy 3D CAD Work in One Month
Oxygen Cloud Platform completed a rapid deployment of a domestic VDI infrastructure supporting demanding 3D graphics workloads for an unnamed Russian engineering company. The project replaced six months of prior R&D testing with a one-month rollout using Russian operating systems, hypervisors, and connection protocols. Engineers addressed GPU sharing via Forsite vGate, optimized NVIDIA A40 cards for Siemens NX and Kompas-3D, and resolved multi-monitor detection issues through firmware updates. Network latency was mitigated by tuning the Loudplay protocol and updating Astra Linux, Termidesk, and client components. Automatic resource brokering was configured in Termidesk with separate Active Directory pools to handle varying user profiles across remote sites 1500 km away. The solution delivers protected access to a secure data center over a dedicated channel while meeting strict import-substitution requirements.
MEPhI Opens 2026 Admissions for Online Cybersecurity Master's Program with Yandex Practicum
The National Research Nuclear University MEPhI, in partnership with Yandex Practicum, is accepting applications for its online master's program in Cybersecurity for the 2026 intake. The two-year program leads to a state diploma in Information Security under code 10.04.01 and a professional retraining certificate from Yandex Practicum. Students can choose from four specialized tracks covering AppSec, DevSecOps, network security, and AI security. Admission is fully online and includes document submission via Gosuslugi, an entrance exam, and a motivation letter requiring at least 80 points. The program runs entirely remotely with evening and weekend classes, allowing students to combine studies with work while accessing student benefits and an educational loan at a subsidized 3% rate.
360 Group Launches NanoWork Enterprise AI Platform with Built-in Security and Opens Nationwide Channel Partner Recruitment
On July 28 at the Beijing National Convention Center, 360 Group founder Zhou Hongyi officially unveiled NanoWork, a next-generation enterprise intelligent agent work platform. The platform is designed to bridge the gap between powerful AI models and real-world business tasks by enabling multi-agent collaboration, on-demand model scheduling, and 24/7 cloud operation across diverse scenarios. NanoWork was developed through extensive real-world testing involving 100,000 intelligent agents, coverage of 630 positions over 150 days, consumption of 350 trillion tokens, and collection of 56,000 feedback items. A core emphasis is placed on native security features drawn from 360 Group's two decades of cybersecurity experience to prevent errors that could lead to actual data loss or permission breaches. The company is now actively recruiting city-level channel partners across China to help deploy the solution in local industries and activate existing customer bases with AI capabilities.