CTI Butler links many common knowledge bases, for example linking MITRE ATT&CK to CAPEC objects, to improve the context of our research. This post describes the logic CTI Butler employs behind the scenes to do this.

In this post I walk you through the database queries we use to compare Sigma Rules releases. We use these to identify the detail of what has changed before we push any updates internally.

We needed a way to link all of our threat intel research to detection rulesets in one place. Our solution; model Sigma Rules as STIX objects.

Last week saw the release of CWE v4.16. I took a deeper look into the latest release so you don't have to.

I pitch OpenAI, Anthropic and Google against each other to see which one best understands MITRE ATT&CK

Obstracts is the blog feed reader used by the worlds most targetted cyber-security teams. Let me show you why.

Your handy guide to streamlining upgrades of MITRE ATT&CK by comparing the changes made between releases.

Despite countless frameworks, best practices, blog posts... so many developers still hardcode credentials into their code.

Here is an easy way to search and filter data in various CTI frameworks including; MITRE ATT&CK, MITRE CWE, MITRE CAPEC, MITRE ATLAS, DISARM, and more!

A short lesson in why building a product with a single point of failure is bad (duh!), and our hunt for a Wayback Machine alternative.