One incident, multiple obligations: The Challenge of simplifying cybersecurity reporting

15 de October de 2026 Por Leave a Comment

When an organisation suffers a cybersecurity incident, one of its priorities should be to understand what has happened, contain it and recover its services.

However, at the same time, another task can add significant complexity: determining what needs to be reported, to whom, when, and with what information.

[Read more…]

Carmen after R2D2: from observing to understanding in industrial cybersecurity

19 de September de 2025 Por

In the world of cybersecurity, it is not enough to look at network traffic: it is necessary to understand it. With the European project R2D2, the CARMEN tool has taken a qualitative leap in its analysis capacity in industrial (OT) environments. Thanks to the new functionalities incorporated, CARMEN can now detect complex threats early, even those designed to go unnoticed, offering security teams a more complete and precise view of industrial infrastructure

Before R2D2: Carmen’s vision

Before the incorporation of the R2D2 project modules, Carmen was already a consolidated and prestigious tool for network traffic analysis. However, its approach was mainly oriented to IT and, although it could detect anomalies and monitor traffic effectively, in industrial (OT) environments it had natural limitations inherent to the original scope of the tool:

  • OT environments: it could not deeply interpret the most complex industrial protocols, limiting the understanding of commands, registers, and critical messages.
  • IT environments: the tool detected anomalies, although correlation with possible attacks from advanced groups (APTs) required additional and manual analysis.
  • Detection of APTs: effective within its scope, but with a more general approach based on known patterns.
  • Asset and risk map: it offered visibility of relevant events and alerts, but impact assessment on critical assets and attack routes depended on the analyst’s interpretation.

In short, Carmen was already a solid and reliable tool, capable of observing and alerting about important events on the network. What R2D2 brought was not “starting from scratch,” but expanding its capabilities: allowing it to delve into OT traffic, interpret complex industrial protocols, correlate anomalies with advanced attacks, and also offer greater control over the asset map and its associated risk.

[Read more…]

CARMEN: The S2 Grupo’s advanced threat detection tool

2 de October de 2024 Por

In the dynamic and ever-changing cybersecurity environment, staying ahead of threats is more crucial than ever.

At S2 Grupo, in collaboration with the National Cryptologic Center (CCN), we have developed and continuously improved CARMEN, an innovative tool designed to protect organizations against the most sophisticated threats.

What is CARMEN?

CARMEN (Center for Log Analysis and Data Mining) is a comprehensive threat detection and response solution specifically designed to address the evolution of Advanced Persistent Threats (APTs). This tool is fundamental for Threat Hunting processes, allowing security teams to proactively identify and neutralize risks.

CARMEN’s main objective is to generate intelligence from network traffic and user activities within the organization, filtering and prioritizing critical information. In this way, it helps prevent security breaches and mitigate the impact of cyber-attacks. With CARMEN, organizations achieve full visibility of their infrastructure, facilitating both early threat detection and an agile and effective response.

[Read more…]