What goes wrong when you feed IOCs into a SIEM
An indicator list does not gain value as it grows. Context-free IOCs create work for analysts and become a closed …
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Why a password reset is not enough when a session cookie leaks
A valid session cookie removes the attacker's need for both the password and MFA. Case closure starts with session revocation.
Attaching MITRE ATT&CK to a report is not enough
Listing technique IDs is not a coverage analysis. The real question is whether that technique is visible in your environment.
Dangling subdomains: the quietest exposure
When a DNS record outlives the resource behind it, someone else can claim the name. Nobody notices, because nothing breaks.
Solving alert fatigue with thresholds, not counts
Reducing alert volume is an outcome, not a goal. The goal is that every alert can be tied to a …
Certificate transparency: free and good enough
CT logs are the cheapest way to find assets outside your inventory. They are noisy, but the noise is manageable.
Five questions before you close a case
Closure is the most rushed step of a case. Five questions stop the same finding coming back three months later.