Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#soc
Page 2 of 2
Threat Hunting
Sigma Rules: The Complete Guide for Detection Engineers
Master Sigma from rule anatomy to SIEM conversion: logsources, field modifiers, condition logic, correlation rules and real detection examples for PowerShell abuse, LSASS access and persistence.
15 min
Threat Hunting
Mapping Your Detection Coverage to MITRE ATT&CK (Honestly)
Most ATT&CK heatmaps flatter the SOC that made them. Here is how to build a coverage map that measures depth, survives scrutiny, and tells you which gaps to close first.
6 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note