Learn · Free Guides

Learn / the concepts.

The reasoning behind the tools, in plain English.

mlab publishes four kinds of reference, and they answer different questions. Picking the wrong one is why documentation feels useless.

You are choosing between two things: The comparisons below. Each one ends with a verdict rather than a shrug.
You need a value you will forget again in five minutes: A cheat sheet. Ports, status codes, regex tokens, all in one scroll.
You hit a term in a report and it meant nothing: The glossary: 122 definitions, most linked to the tool that operates on the thing.
You want to understand a practice, not a word: The blog. Longer, written by people doing the work.

Why MD5 is broken for security and when SHA-256 is the right choice.

Is MD5 still acceptable for checksums?

Try it: Hash Generator

File/malware rules vs log-based detection, what each is built for.

Which one do I write for this detection?

Try it: hunt.mlab.sh

Detection and visibility vs automated response, and how they combine.

Do we need both, and in which order?

Try it: Free tools

Two ways to represent binary as text, size, readability and use cases.

Which encoding should this field use?

Try it: Base64 Encoder

Need a quick reference? Browse the cheat sheets

Guides from the blog

MCP for the SOC: Connecting AI Assistants to Threat Intel Without Getting Owned The Model Context Protocol lets an AI assistant call your threat-intel lookups and case tools directly. Here is what MCP actually is, the SOC workflows where it pays off, and the guardrails you need before tool output starts steering your analyst's copilot. soc · 8 min read Crypto Address Investigation for SOC Analysts: What the Chain Can and Cannot Tell You Ransom notes, sextortion emails, drainer kits and fake invoices all end in a wallet address. A practical primer on address formats, clustering heuristics, mixers and bridges, and the legal care an analyst needs before following the money. threat intelligence · 7 min read Enterprise SSO and SCIM: A Security Checklist That Goes Past "We Have SAML" SSO concentrates trust in one assertion, so every validation step you skip becomes an authentication bypass. A practical checklist for SAML, OIDC, JIT provisioning, SCIM deprovisioning and break-glass accounts. fundamentals · 8 min read Encodings in Malicious Payloads: Recognising and Peeling Base64, Hex, XOR and Friends Most "obfuscated" payloads are just encoded, sometimes three or four times over. How to recognise Base64, hex, URL encoding, UTF-16LE PowerShell and single-byte XOR at a glance, and how to peel layered encodings without guessing. fundamentals · 8 min read Learning CTI and SOC Skills for Free: A Student Roadmap You do not need a paid bootcamp to become a credible junior analyst. The best free resources for threat intelligence and SOC skills, how to sequence them, and how to turn lab work into a portfolio that hiring managers actually read. fundamentals · 6 min read Infostealers and the Logs Economy: Why Your MFA Did Not Help Infostealers turn one infected laptop into a ready-to-use bundle of passwords, cookies and tokens, sold within hours. What a stealer log contains, why session theft walks past MFA, and how defenders actually respond. threat intelligence · 7 min read

Every article →