Series
MalCloud era
Posts from March and April 2026 about MalCloud, our earlier threat-intelligence product.
-
Why Your Threat Intelligence Context Doesn't Export
STIX bundles carry nodes and edges. Most platforms don't put analyst reasoning, confidence history or provenance into them, even where STIX 2.1 could carry it.
-
Detection-as-Code: Generating Sigma Rules from Threat Intelligence
Detection-as-code with Sigma as the intermediate format: example rules, conversion to Splunk, Elastic and Microsoft Defender queries with sigma-cli, test cases and coverage measurement.