Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Soc
Newest first
SIEM vs SOAR Explained: What Each Does and When a Small Team Needs Which
A SIEM decides what is worth looking at; a SOAR decides what happens next. Here is where the two overlap, where XDR fits, and which one a small security team should actually buy (or build) first.
Alert Fatigue Is a Design Problem, Not a Staffing Problem
SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.
SOC Metrics That Matter: Beyond MTTR
Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note