Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
74
Categories
9
Tags
198
Latest
October 20, 2026
#api
Newest first
Soc
Webhooks as Lightweight SOAR: Patterns, Signatures and Idempotency
You do not need a SOAR platform to automate the first ten steps of triage. A signed webhook, a small receiver and a few disciplined patterns get you most of the way. Here is how to build one that does not fall over or get spoofed.
7 min
Soc
Automating IOC Enrichment with the mlab.sh API
From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.
7 min
Engineering
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note