Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
74
Categories
9
Tags
198
Latest
October 20, 2026
#siem
Newest first
Soc
SIEM vs SOAR Explained: What Each Does and When a Small Team Needs Which
A SIEM decides what is worth looking at; a SOAR decides what happens next. Here is where the two overlap, where XDR fits, and which one a small security team should actually buy (or build) first.
8 min
Threat Hunting
Sigma Rules: The Complete Guide for Detection Engineers
Master Sigma from rule anatomy to SIEM conversion: logsources, field modifiers, condition logic, correlation rules and real detection examples for PowerShell abuse, LSASS access and persistence.
15 min
Engineering
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note