Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 7 of 9
Patch Tuesday Survival Guide: Building a Monthly Vulnerability Workflow
A repeatable monthly process for Patch Tuesday: same-day triage with KEV and EPSS, patch windows by asset class, deadlines people respect, and verification that closes the loop.
Understanding IOCs: A Practical Primer
A grounded introduction to Indicators of Compromise — what they are, where they break, and how to actually use them inside a SOC workflow without drowning in false positives.
Phishing Email Analysis: Headers, EML Files, and Hidden Payloads
A hands-on dissection of a suspicious email: reading the Received chain hop by hop, interpreting SPF, DKIM and DMARC verdicts, and safely extracting URLs and attachments.
Building a Threat Intelligence Program From Zero (Without Buying Anything)
A realistic roadmap for a small SOC: define intelligence requirements, wire up free feeds, build a triage workflow, disseminate what matters, and measure whether any of it helps.
MD5 vs SHA-256: Which Hash Should You Use?
MD5 is still everywhere. SHA-256 is the default you should reach for. Here is when each one is acceptable, and when using MD5 is an actual security bug.
Automating IOC Enrichment with the mlab.sh API
From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.
Why EU Data Hosting Matters for Security Tooling
Your IOCs and telemetry contain personal data. Sending them to a US cloud service is a data transfer with legal strings attached. Here is what that means for your tooling choices.
Third-Party Risk Management Without the Spreadsheet Nightmare
Vendor questionnaires are point-in-time, self-reported, and unread. Here is why the spreadsheet model of TPRM fails, what continuous vendor risk management looks like, and how DORA forces the issue.
JWT Security: Decoding, Attacking, and Defending JSON Web Tokens
JWTs are everywhere and misused everywhere. A practitioner walkthrough of how they work, the classic attacks (alg none, key confusion, weak secrets), and how to validate them safely.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note