Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#soar
Newest first
SIEM vs SOAR Explained: What Each Does and When a Small Team Needs Which
A SIEM decides what is worth looking at; a SOAR decides what happens next. Here is where the two overlap, where XDR fits, and which one a small security team should actually buy (or build) first.
Webhooks as Lightweight SOAR: Patterns, Signatures and Idempotency
You do not need a SOAR platform to automate the first ten steps of triage. A signed webhook, a small receiver and a few disciplined patterns get you most of the way. Here is how to build one that does not fall over or get spoofed.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note