What goes wrong when you feed IOCs into a SIEM
An indicator list does not gain value as it grows. Context-free IOCs create work for analysts and become a closed …
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
How to read ransomware leak sites properly
Leak sites are a marketing channel, not a victim list. Taking their numbers at face value produces wrong conclusions.
Attaching MITRE ATT&CK to a report is not enough
Listing technique IDs is not a coverage analysis. The real question is whether that technique is visible in your environment.
Who is going to read this threat intelligence report?
The same finding cannot be told to a SOC analyst and a board in one document. A report that does …
What goes into a geopolitical risk score?
Relations between states reshape the threat landscape directly. What makes a score useful is knowing which signal predicts what.
Hacktivist campaigns: noise or signal?
Most announced attacks never happen, and most that do are smaller than claimed. There is still something worth watching.
Product note: making a threat score explainable
The score is not the valuable part; the reason for it is. Every point needs a rationale you can show.