Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Soc
Newest first
MCP for the SOC: Connecting AI Assistants to Threat Intel Without Getting Owned
The Model Context Protocol lets an AI assistant call your threat-intel lookups and case tools directly. Here is what MCP actually is, the SOC workflows where it pays off, and the guardrails you need before tool output starts steering your analyst's copilot.
SIEM vs SOAR Explained: What Each Does and When a Small Team Needs Which
A SIEM decides what is worth looking at; a SOAR decides what happens next. Here is where the two overlap, where XDR fits, and which one a small security team should actually buy (or build) first.
Webhooks as Lightweight SOAR: Patterns, Signatures and Idempotency
You do not need a SOAR platform to automate the first ten steps of triage. A signed webhook, a small receiver and a few disciplined patterns get you most of the way. Here is how to build one that does not fall over or get spoofed.
The Attack Surface You Forgot: Scanning Your Own Infrastructure
Attackers scan your perimeter every day. Most organizations scan their own once a year. Here is what external recon on yourself reveals, and why continuous beats annual.
Alert Fatigue Is a Design Problem, Not a Staffing Problem
SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.
SOC Metrics That Matter: Beyond MTTR
Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership.
Automating IOC Enrichment with the mlab.sh API
From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note