Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#incident-response
Newest first
Ransomware Response: The Decisions That Matter in the First 24 Hours
Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time.
The First 60 Minutes: An Incident Response Checklist That Works Under Stress
When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone.
Building Incident Playbooks People Actually Follow
Most IR playbooks die in a wiki: too long, written for auditors, never exercised. Here is how to write short, decision-oriented runbooks your team will use at 3 a.m.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note