Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Soc
Newest first
MCP for the SOC: Connecting AI Assistants to Threat Intel Without Getting Owned
The Model Context Protocol lets an AI assistant call your threat-intel lookups and case tools directly. Here is what MCP actually is, the SOC workflows where it pays off, and the guardrails you need before tool output starts steering your analyst's copilot.
SIEM vs SOAR Explained: What Each Does and When a Small Team Needs Which
A SIEM decides what is worth looking at; a SOAR decides what happens next. Here is where the two overlap, where XDR fits, and which one a small security team should actually buy (or build) first.
Webhooks as Lightweight SOAR: Patterns, Signatures and Idempotency
You do not need a SOAR platform to automate the first ten steps of triage. A signed webhook, a small receiver and a few disciplined patterns get you most of the way. Here is how to build one that does not fall over or get spoofed.
Automating IOC Enrichment with the mlab.sh API
From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note