{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "EventLake Problem Pamphlets & Active Defense Feeds",
  "home_page_url": "https://eventlake.com/feed.html",
  "feed_url": "https://eventlake.com/feeds/feed.json",
  "description": "Single-problem technical and governance briefs solving one common problem per issue for SOC operators (Weekly), Non-SOC enterprise & audit leaders (Biweekly), and smartphone users via Buoy on Android & iOS (Monthly). Zero competitor OEMs named; every claim anchored to runtime-measured proof.",
  "language": "en",
  "items": [
    {
      "id": "M04",
      "url": "https://eventlake.com/feed.html#M04",
      "title": "M04 — The 'Install This Screen-Sharing App for KYC Refund' Trap: Protecting Parents on Android & iOS",
      "date_published": "2026-10-30T09:00:00Z",
      "tags": [
        "buoy_monthly",
        "limited_cloud_buoy",
        "C45",
        "C46"
      ],
      "summary": "Elderly family members are coached on a voice call to install an untrusted APK or enable Accessibility screen-reading permissions while opening their banking app.",
      "content_text": "1. The Common Problem:\nElderly family members are coached on a voice call to install an untrusted APK or enable Accessibility screen-reading permissions while opening their banking app.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nTraditional antivirus scans only known malware hashes and ignores legitimate remote-support tools or Accessibility permission abuse during active calls.\n\n3. The EventLake Deterministic Fix:\nBuoy Device Posture audits risky Accessibility services and sideloaded packages on Android, and verifies OS patch currency, DNS encryption, and profile integrity on iOS.\n\nClaims: C45, C46 | Try Live: https://eventlake.com/apps.html"
    },
    {
      "id": "B04",
      "url": "https://eventlake.com/feed.html#B04",
      "title": "B04 — The Silent Sunday TLS Certificate Outage: Preventing Expired Internal Certs From Halting Production",
      "date_published": "2026-10-29T12:00:00Z",
      "tags": [
        "governance_biweekly",
        "on_premise_b2b",
        "C7",
        "C16"
      ],
      "summary": "A forgotten internal webhook or microservice TLS certificate expires over a weekend, causing a multi-hour customer outage.",
      "content_text": "1. The Common Problem:\nA forgotten internal webhook or microservice TLS certificate expires over a weekend, causing a multi-hour customer outage.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nExternal-only SSL scanners never see internal mTLS, Kubernetes ingress, or private load-balancer certificates.\n\n3. The EventLake Deterministic Fix:\nContinuous Certificate & Posture Ledger inventories every internal and external TLS endpoint, weak cipher, and renewal failure 30/14/7 days before expiry.\n\nClaims: C7, C16 | Try Live: https://eventlake.com/capabilities.html"
    },
    {
      "id": "W06",
      "url": "https://eventlake.com/feed.html#W06",
      "title": "W06 — Slow Retrospective Hunts: Searching 90 Days of Process Trees Without Per-Query Scan Taxes",
      "date_published": "2026-10-29T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C10",
        "C11"
      ],
      "summary": "Hunting a newly disclosed IOC across 90 days of cold telemetry times out or triggers punitive cloud per-terabyte scan charges.",
      "content_text": "1. The Common Problem:\nHunting a newly disclosed IOC across 90 days of cold telemetry times out or triggers punitive cloud per-terabyte scan charges.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nRow-oriented cloud log stores charge on ingestion and again on every retrospective search.\n\n3. The EventLake Deterministic Fix:\nColumnar zstd seg3 segments with Bloom and Roaring bitmap indexes execute needle-in-haystack lookups on local NVMe/object storage with ₹0 per-query scan fees.\n\nClaims: C10, C11 | Try Live: https://eventlake.com/anatomy-of-an-event.html"
    },
    {
      "id": "W05",
      "url": "https://eventlake.com/feed.html#W05",
      "title": "W05 — Log Tampering After Root Compromise: Proving the Attacker Didn't Erase Line 4,102",
      "date_published": "2026-10-28T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C1",
        "C24"
      ],
      "summary": "Once an intruder gains root or SYSTEM, mutable syslog files and standard database indices cannot prove what was deleted.",
      "content_text": "1. The Common Problem:\nOnce an intruder gains root or SYSTEM, mutable syslog files and standard database indices cannot prove what was deleted.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nUnsealed log indices allow privileged attackers to rewrite or truncate historical rows without leaving a mathematical contradiction.\n\n3. The EventLake Deterministic Fix:\nForward-secure seg3 hash chains and per-segment Ed25519 receipts seal every batch at birth; any single-byte edit invalidates offline verification.\n\nClaims: C1, C24 | Try Live: https://eventlake.com/plane-1-substrate.html"
    },
    {
      "id": "W04",
      "url": "https://eventlake.com/feed.html#W04",
      "title": "W04 — Detection Lock-In: Moving 500 Sigma & Custom Rules Without 6 Months of Rewrites",
      "date_published": "2026-10-27T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C2",
        "C3"
      ],
      "summary": "Evaluating or migrating a detection engine usually requires months of manual query rewrites in a proprietary dialect.",
      "content_text": "1. The Common Problem:\nEvaluating or migrating a detection engine usually requires months of manual query rewrites in a proprietary dialect.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nProprietary query languages lock detection engineering IP inside one vendor's billing meter.\n\n3. The EventLake Deterministic Fix:\nDeterministic Rule Compiler translates Sigma, YARA, and correlation specifications into native AST execution with dual-run parity scoring.\n\nClaims: C2, C3 | Try Live: https://eventlake.com/research-coverage-gates.html"
    },
    {
      "id": "B03",
      "url": "https://eventlake.com/feed.html#B03",
      "title": "B03 — Cutting Your Security Telemetry Bill by 60% Without Dropping a Single Compliance Control",
      "date_published": "2026-10-22T09:00:00Z",
      "tags": [
        "governance_biweekly",
        "on_premise_b2b",
        "C13",
        "C28"
      ],
      "summary": "Enterprises pay lakhs per month to store duplicate firewall chatter and noisy health checks in expensive third-party cloud tiers.",
      "content_text": "1. The Common Problem:\nEnterprises pay lakhs per month to store duplicate firewall chatter and noisy health checks in expensive third-party cloud tiers.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nCloud-only SIEM pricing penalizes high-volume telemetry and charges extra for every analytical module.\n\n3. The EventLake Deterministic Fix:\nOn-Premise deployment (₹45,000/mo for 1 TB/day, ₹0 cloud markup) paired with the Edge Cost-Cut pre-filter drops 55–75% of noise while keeping a signed compliance archive on local disk.\n\nClaims: C13, C28 | Try Live: https://eventlake.com/sizing.html"
    },
    {
      "id": "W03",
      "url": "https://eventlake.com/feed.html#W03",
      "title": "W03 — Fear of Auto-Containment: Isolating a Compromised Host Without Bricking Production",
      "date_published": "2026-10-20T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C4",
        "C19"
      ],
      "summary": "SOCs leave automated response switched off because a naive script once isolated a domain controller or payment gateway.",
      "content_text": "1. The Common Problem:\nSOCs leave automated response switched off because a naive script once isolated a domain controller or payment gateway.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nBinary automation forces a choice between slow manual ticket queues and unguarded script execution with zero blast-radius ceiling.\n\n3. The EventLake Deterministic Fix:\nThe 10-Stop Action Gate in Actions enforces asset criticality checks, blast-radius caps, canary probes, number-matching Buoy step-up, and automatic rollback on health failure.\n\nClaims: C4, C19 | Try Live: https://eventlake.com/plane-3-execution.html"
    },
    {
      "id": "M03",
      "url": "https://eventlake.com/feed.html#M03",
      "title": "M03 — Why SMS OTPs & Blind Push Prompts Get Phished (And How Context-Rich Passkeys & Approvals Stop It)",
      "date_published": "2026-10-18T09:00:00Z",
      "tags": [
        "buoy_monthly",
        "limited_cloud_buoy",
        "C18",
        "C45"
      ],
      "summary": "Attackers bombard users with repeated MFA push notifications at night or intercept SMS OTPs via real-time phishing proxies.",
      "content_text": "1. The Common Problem:\nAttackers bombard users with repeated MFA push notifications at night or intercept SMS OTPs via real-time phishing proxies.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nOne-tap Approve/Deny prompts hide which application, IP address, or privileged command is actually requesting access.\n\n3. The EventLake Deterministic Fix:\nBuoy (EventLake Authenticator) on Android & iOS binds origin-locked Passkeys and number-matching push approvals that display the exact action, origin, and risk context before you tap.\n\nClaims: C18, C45 | Try Live: https://eventlake.com/plane-4-identity.html"
    },
    {
      "id": "B02",
      "url": "https://eventlake.com/feed.html#B02",
      "title": "B02 — The 6-Hour CERT-In Clock: Producing a Complete Statutory Incident Dossier Before Hour 5",
      "date_published": "2026-10-15T09:00:00Z",
      "tags": [
        "governance_biweekly",
        "on_premise_b2b",
        "C20",
        "C21"
      ],
      "summary": "Assembling affected IPs, hashes, synchronized NTP timelines, and root cause across 6 tools takes days—missing the mandatory 6-hour CERT-In window.",
      "content_text": "1. The Common Problem:\nAssembling affected IPs, hashes, synchronized NTP timelines, and root cause across 6 tools takes days—missing the mandatory 6-hour CERT-In window.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nManual war-room spreadsheet assembly under incident pressure leads to incomplete filings and regulatory show-cause notices.\n\n3. The EventLake Deterministic Fix:\nOn-Premise 180-Day Log Vault + 1-Click CERT-In 6-Hour Incident Pack automatically compiles the statutory fields and Ed25519-signed raw evidence bundle on customer hardware.\n\nClaims: C20, C21 | Try Live: https://eventlake.com/for-auditors.html"
    },
    {
      "id": "W02",
      "url": "https://eventlake.com/feed.html#W02",
      "title": "W02 — The Silent Sensor Gap: Knowing Which ATT&CK Techniques Would Miss Tonight",
      "date_published": "2026-10-13T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C5",
        "C31"
      ],
      "summary": "Teams assume they have broad MITRE coverage until an incident reveals a critical log source silently stopped forwarding three weeks ago.",
      "content_text": "1. The Common Problem:\nTeams assume they have broad MITRE coverage until an incident reveals a critical log source silently stopped forwarding three weeks ago.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nStatic spreadsheet coverage maps never intersect live ingest health against the specific data sources each detection rule actually requires.\n\n3. The EventLake Deterministic Fix:\nLive Telemetry Blindness Assessment intersects active estate feeds against 17 threat matrices and ranks every dark technique by the exact feed that closes it.\n\nClaims: C5, C31 | Try Live: https://eventlake.com/proof.html"
    },
    {
      "id": "M02",
      "url": "https://eventlake.com/feed.html#M02",
      "title": "M02 — The Fake Electricity Bill, Fastag & Parcel SMS Link: Blocking Phishing Across Every App in 90 Seconds",
      "date_published": "2026-10-10T09:00:00Z",
      "tags": [
        "buoy_monthly",
        "limited_cloud_buoy",
        "C45",
        "C46"
      ],
      "summary": "A single tap on a lookalike SMS or WhatsApp link steals credentials or attempts to sideload a malicious package.",
      "content_text": "1. The Common Problem:\nA single tap on a lookalike SMS or WhatsApp link steals credentials or attempts to sideload a malicious package.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nBrowser-only safe-browsing checks do not protect links opened inside messaging webviews or third-party apps.\n\n3. The EventLake Deterministic Fix:\nEventLake Encrypted DNS (DoH/DoT) blocks known phishing, scam, and C2 domains system-wide in <2ms on both Android (Private DNS) and iOS (.mobileconfig profile) with zero VPN battery drain.\n\nClaims: C45, C46 | Try Live: https://eventlake.com/encrypted-dns.html"
    },
    {
      "id": "B01",
      "url": "https://eventlake.com/feed.html#B01",
      "title": "B01 — The DPDP & GDPR Erasure Paradox: Deleting a User's PII Without Breaking Your Audit Hash Chain",
      "date_published": "2026-10-08T09:00:00Z",
      "tags": [
        "governance_biweekly",
        "on_premise_b2b",
        "C25"
      ],
      "summary": "Modifying an immutable security log to honour a DPDP §12 or GDPR Art. 17 erasure request breaks tamper-evidence; refusing erasure violates privacy law.",
      "content_text": "1. The Common Problem:\nModifying an immutable security log to honour a DPDP §12 or GDPR Art. 17 erasure request breaks tamper-evidence; refusing erasure violates privacy law.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nConventional log stores force an impossible choice between cryptographic log integrity and statutory data-principal erasure rights.\n\n3. The EventLake Deterministic Fix:\nPer-subject envelope encryption (crypto-shredding) destroys the subject's 256-bit DEK so their PII reads as [erased] while every SHA-256 block hash and Ed25519 signature verifies 100% intact.\n\nClaims: C25 | Try Live: https://eventlake.com/trust.html"
    },
    {
      "id": "W01",
      "url": "https://eventlake.com/feed.html#W01",
      "title": "W01 — The 3 AM Alert Flood: Turning 4,000 Raw Alerts into 3 Verifiable Incidents",
      "date_published": "2026-10-06T09:00:00Z",
      "tags": [
        "soc_weekly",
        "on_premise_b2b",
        "C2",
        "C15"
      ],
      "summary": "Single-event threshold rules fire hundreds of false positives every time a sysadmin runs a routine maintenance script.",
      "content_text": "1. The Common Problem:\nSingle-event threshold rules fire hundreds of false positives every time a sysadmin runs a routine maintenance script.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nConventional correlation engines evaluate flat string rules in isolation without joining process lineage, network beacon symmetry, and identity privilege deltas.\n\n3. The EventLake Deterministic Fix:\nMulti-Signal Conjunction Gates in Rules require process lineage + network beacon + privilege delta within a sliding entity window before paging an analyst.\n\nClaims: C2, C15 | Try Live: https://eventlake.com/plane-2-analytics.html"
    },
    {
      "id": "M01",
      "url": "https://eventlake.com/feed.html#M01",
      "title": "M01 — Is This Call or Message Really From My Bank? Stopping Spoofed Fraud-Department Scams",
      "date_published": "2026-10-01T09:00:00Z",
      "tags": [
        "buoy_monthly",
        "limited_cloud_buoy",
        "C45",
        "C46"
      ],
      "summary": "Scammers spoof official bank helpline numbers or send urgent KYC suspension messages to pressure victims into sharing OTPs or transferring funds.",
      "content_text": "1. The Common Problem:\nScammers spoof official bank helpline numbers or send urgent KYC suspension messages to pressure victims into sharing OTPs or transferring funds.\n\n2. Why the Conventional Paradigm Fails (Zero OEMs Named):\nStandard caller ID displays unverified display strings, and frightening links trick users into opening the address just to copy it.\n\n3. The EventLake Deterministic Fix:\nPaste the entire message or link into check.html or Buoy Scam Shield on Android & iOS to inspect every embedded address and cryptographic sender proof with zero account required.\n\nClaims: C45, C46 | Try Live: https://eventlake.com/check.html"
    }
  ]
}