Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Threat Intelligence
Page 1 of 2
How to Read a CTI Report Like an Analyst (Not a Journalist)
Vendor threat reports mix marketing, narrative, and actionable intelligence. A repeatable method for extracting IOCs, TTPs, and detection opportunities while filtering the noise.
STIX, TAXII, MISP: A Field Guide to Threat Intel Sharing Formats
What STIX objects, TAXII transport, and the MISP platform each actually do, where interoperability breaks in practice, and when a plain CSV is all the standard you need.
Passive DNS for Investigators: Tracking Infrastructure Through Time
Attackers rotate infrastructure constantly, but DNS remembers. How passive DNS is collected, how it exposes campaigns, and how to pivot from one domain to an entire operation.
From IOC to Adversary: Attribution Basics for Blue Teams
How analysts get from a single indicator to a named adversary: activity clustering, infrastructure overlap, malware lineage, false flags, and why defenders should care more about how than who.
The IOC Lifecycle: Aging, Expiration, and Why Old Indicators Hurt You
Indicators of compromise have a shelf life. How to score, decay, and retire IOCs before your stale blocklist starts paging on-call for legitimate CDN traffic.
IOC Analysis Step-by-Step: A Complete Guide for Threat Hunters
A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping.
WHOIS Is Dead, Long Live WHOIS: Investigating Domains After GDPR
GDPR redacted the registrant fields investigators relied on for decades. Domain attribution still works, but the pivots have moved: RDAP, name servers, certificates, and history.
Understanding IOCs: A Practical Primer
A grounded introduction to Indicators of Compromise — what they are, where they break, and how to actually use them inside a SOC workflow without drowning in false positives.
Building a Threat Intelligence Program From Zero (Without Buying Anything)
A realistic roadmap for a small SOC: define intelligence requirements, wire up free feeds, build a triage workflow, disseminate what matters, and measure whether any of it helps.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note