Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#triage
Newest first
Incident Response
The First 60 Minutes: An Incident Response Checklist That Works Under Stress
When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone.
7 min
Soc
Alert Fatigue Is a Design Problem, Not a Staffing Problem
SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.
6 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note