Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#cti
Newest first
Learning CTI and SOC Skills for Free: A Student Roadmap
You do not need a paid bootcamp to become a credible junior analyst. The best free resources for threat intelligence and SOC skills, how to sequence them, and how to turn lab work into a portfolio that hiring managers actually read.
How to Read a CTI Report Like an Analyst (Not a Journalist)
Vendor threat reports mix marketing, narrative, and actionable intelligence. A repeatable method for extracting IOCs, TTPs, and detection opportunities while filtering the noise.
Building a Threat Intelligence Program From Zero (Without Buying Anything)
A realistic roadmap for a small SOC: define intelligence requirements, wire up free feeds, build a triage workflow, disseminate what matters, and measure whether any of it helps.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note