Analysts in Security Operations Centers (SOCs) are often occupied with time-consuming investigations of alerts from Network Intrusion Detection Systems (NIDSs). Many NIDS rules lack clear explanations and associations with attack techniques, complicating the alert triage and the generation of attack hypotheses. Large Language Models (LLMs) may be a promising technology to reduce the alert explainability gap by associating rules with attack techniques. In this paper, we investigate the ability of three prominent LLMs (ChatGPT, Claude, and Gemini) to reason about NIDS rules while labeling them with MITRE ATT&CK tactics and techniques. We discuss prompt design and present experiments performed with 973 Snort rules. Our results indicate that while LLMs provide explainable, scalable, and efficient initial mappings, traditional machine learning (ML) models consistently outperform them in accuracy, achieving higher precision, recall, and F1-scores. These results highlight the potential for hybrid LLM-ML approaches to enhance SOC operations and better address the evolving threat landscape. By utilizing automation, the presented methods will enhance the analysis efficiency of SOC alerts, and decrease workloads for analysts.

Background: The COVID-19 pandemic has affected populations worldwide, with extreme health, economic, social, and political implications. Health care professionals (HCPs) are at the core of pandemic response and are among the most crucial factors in maintaining coping capacities. Yet, they are also vulnerable to mental health effects caused by managing a long-lasting emergency with a lack of resources and under complicated personal concerns. However, there are a lack of longitudinal studies that investigate the HCP population.Objective: The aim of this study was to analyze the state of mind of HCPs as expressed in online discussions published on Twitter in light of the COVID-19 pandemic, from the onset of the pandemic until the end of 2020.Methods: The population for this study was selected from followers of a few hundred Twitter accounts of health care organizations and common HCP points of interest. We used active learning, a process that iteratively uses machine learning and manual data labeling, to select the large-scale population of Twitter accounts maintained by English-speaking HCPs, focusing on individuals rather than official organizations. We analyzed the topics and emotions in their discourses during 2020. The topic distributions were obtained using the latent Dirichlet allocation algorithm. We defined a measure of topic cohesion and described the most cohesive topics. The emotions expressed in tweets during 2020 were compared to those in 2019. Finally, the emotion intensities were cross-correlated with the pandemic waves to explore possible associations between the pandemic development and emotional response.Results: We analyzed the timelines of 53,063 Twitter profiles, 90% of which were maintained by individual HCPs. Professional topics accounted for 44.5% of tweets by HCPs from January 1, 2019, to December 6, 2020. Events such as the pandemic waves, US elections, or the George Floyd case affected the HCPs’ discourse. The levels of joy and sadness exceeded their minimal and maximal values from 2019, respectively, 80% of the time (P=.001). Most interestingly, fear preceded the pandemic waves, in terms of the differences in confirmed cases, by 2 weeks with a Spearman correlation coefficient of ρ(47 pairs)=0.340 (P=.03).Conclusions: Analyses of longitudinal data over the year 2020 revealed that a large fraction of HCP discourse is directly related to professional content, including the increase in the volume of discussions following the pandemic waves. The changes in emotional patterns (ie, decrease in joy and increase in sadness, fear, and disgust) during the year 2020 may indicate the utmost importance in providing emotional support for HCPs to prevent fatigue, burnout, and mental health disorders during the postpandemic period. The increase in fear 2 weeks in advance of pandemic waves indicates that HCPs are in a position, and with adequate qualifications, to anticipate pandemic development, and could serve as a bottom-up pathway for expressing morbidity and clinical situations to health agencies.

A dimension of the Internet that has gained great popularity in recent years is the platform of online social networks (OSNs). Users all over the world write, share, and publish personal information about themselves, their friends, and their workplac

In fully managed serverless environments, cloud service providers handle the underlying infrastructure, reducing application developers' operational and maintenance efforts. However, these environments limit the use of traditional cybersecurity frameworks and tools, compromising observability and situational awareness capabilities for security tasks (e.g., risk assessment, incident response). Additionally, existing security frameworks for serverless applications often lack generalizability across architectures and require specialized expertise. In this paper, we propose a three-layer security stack for fully managed serverless applications. The first layer establishes a foundational generic ontology that models serverless application resources and their interactions using API logs. In the second layer, the ontology is leveraged via perimeterless pipeline, to map the logs into a unified application activity KG, and in the third layer, two situational awareness tools that utilize the graph-based representation are implemented: (1) an incident response dashboard that leverages the ontology to visualize and examine application activity logs in the context of cybersecurity alerts; our user study showed that this dashboard enabled participants to respond 10% more accurately and almost twice as fast than the examined baseline tool, and (2) a criticality of asset (CoA) risk assessment framework that enables efficient expert-based prioritization in cybersecurity contexts; our expert-based questionnaire demonstrated strong agreement, achieving a Kendall-W score of 0.7179.