Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#soc
Page 1 of 2
How to Read a CTI Report Like an Analyst (Not a Journalist)
Vendor threat reports mix marketing, narrative, and actionable intelligence. A repeatable method for extracting IOCs, TTPs, and detection opportunities while filtering the noise.
Your First Threat Hunt: A Hypothesis-Driven Walkthrough
A start-to-finish first threat hunt for beginners: pick a hypothesis, gather data, write queries, separate signal from admin noise, document findings, and turn results into a durable detection. No expensive tooling required.
Alert Fatigue Is a Design Problem, Not a Staffing Problem
SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.
SOC Metrics That Matter: Beyond MTTR
Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership.
IOC Analysis Step-by-Step: A Complete Guide for Threat Hunters
A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping.
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Understanding IOCs: A Practical Primer
A grounded introduction to Indicators of Compromise — what they are, where they break, and how to actually use them inside a SOC workflow without drowning in false positives.
Building a Threat Intelligence Program From Zero (Without Buying Anything)
A realistic roadmap for a small SOC: define intelligence requirements, wire up free feeds, build a triage workflow, disseminate what matters, and measure whether any of it helps.
So You Want to Be a SOC Analyst: A Realistic Starting Roadmap
What the job actually looks like, the four skills that matter more than any certification, home-lab ideas that cost nothing, and where the role leads after year two.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note