Three correct ways to close a case
Resolved, false positive and risk accepted are not the same thing. Getting the distinction right determines what your report says …
Blog
Notes from the team
Short answers to questions we meet in the field: reading stealer logs, catching typosquats, managing IOCs, closing cases. Research, operations and product notes.
Who is going to read this threat intelligence report?
The same finding cannot be told to a SOC analyst and a board in one document. A report that does …
Limits of processing leaked data under Turkish data protection law
Examining leaked data does not mean storing it without limit. Purpose, retention and access must be written down up front.
Product note: finding ownership and closure rationale
A finding without an owner never closes; without a closure rationale it reopens three months later. We made both mandatory …
Product note: making a threat score explainable
The score is not the valuable part; the reason for it is. Every point needs a rationale you can show.