Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Threat Intelligence
Page 2 of 2
Geolocation and ASN Analysis: What an IP Address Really Tells You
An IP address is not a person, a place, or a verdict. What geolocation and ASN data actually reveal, where they mislead, and how to use them in triage.
Threat Actor Naming Hell: APT28, Fancy Bear, or STRONTIUM?
The same Russian intrusion set answers to at least eight names. Why vendors refuse to share a naming scheme, how each taxonomy works, and how to keep your own alias registry sane.
The Pyramid of Pain Explained: Why Your Hash Feeds Aren't Enough
David Bianco's pyramid of pain ranks indicators by how much they hurt an adversary when you detect them. Most SOCs live at the bottom. Here is how to climb.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note