Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 4 of 9
Ransomware Response: The Decisions That Matter in the First 24 Hours
Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time.
STIX, TAXII, MISP: A Field Guide to Threat Intel Sharing Formats
What STIX objects, TAXII transport, and the MISP platform each actually do, where interoperability breaks in practice, and when a plain CSV is all the standard you need.
Tracking Vulnerabilities in Your Stack with SBOMs
What SBOMs actually are, why regulators keep demanding them, how scanning one against a CVE database works, and where the whole approach quietly breaks.
Passive DNS for Investigators: Tracking Infrastructure Through Time
Attackers rotate infrastructure constantly, but DNS remembers. How passive DNS is collected, how it exposes campaigns, and how to pivot from one domain to an entire operation.
The First 60 Minutes: An Incident Response Checklist That Works Under Stress
When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone.
Anatomy of a CVE: From Discovery to Your Patch Queue
Follow a vulnerability through its full lifecycle: discovery, coordinated disclosure, CNA assignment, NVD enrichment, publication, and exploitation, and learn what every field of a CVE entry really tells you.
The Attack Surface You Forgot: Scanning Your Own Infrastructure
Attackers scan your perimeter every day. Most organizations scan their own once a year. Here is what external recon on yourself reveals, and why continuous beats annual.
From IOC to Adversary: Attribution Basics for Blue Teams
How analysts get from a single indicator to a named adversary: activity clustering, infrastructure overlap, malware lineage, false flags, and why defenders should care more about how than who.
Your First Threat Hunt: A Hypothesis-Driven Walkthrough
A start-to-finish first threat hunt for beginners: pick a hypothesis, gather data, write queries, separate signal from admin noise, document findings, and turn results into a durable detection. No expensive tooling required.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note