Mlab Blog

Threat intel, DFIR & security notes

Deep-dives, tooling write-ups and transparent product updates from the Mlab team. 49 articles so far.

All49 Announcements1 Compliance4 Crypto2 Fundamentals4 Incident Response7 Soc4 Threat Hunting9 Threat Intelligence12 Vulnerability Management6

Category: Soc clear

Soc

The Attack Surface You Forgot: Scanning Your Own Infrastructure

Attackers scan your perimeter every day. Most organizations scan their own once a year. Here is what external recon on yourself reveals, and why continuous beats annual.

#attack-surface#scanning#redkit

June 19, 2026 · 7 min

Soc

Alert Fatigue Is a Design Problem, Not a Staffing Problem

SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.

#alert-fatigue#soc#triage

June 4, 2026 · 6 min

Soc

SOC Metrics That Matter: Beyond MTTR

Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership.

#metrics#soc#mttr

April 30, 2026 · 6 min

Soc

Automating IOC Enrichment with the mlab.sh API

From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.

#api#automation#enrichment

April 3, 2026 · 7 min

Navigation

Threat intel, DFIR & security notes

The Attack Surface You Forgot: Scanning Your Own Infrastructure

Alert Fatigue Is a Design Problem, Not a Staffing Problem

SOC Metrics That Matter: Beyond MTTR

Automating IOC Enrichment with the mlab.sh API