Your alerts deserve
a real workflow.
Mlab IR turns scattered security alerts into structured investigations — enriched by nine intelligence sources and closed with the regulatory notification already filed. All on your own infrastructure.
Enrichment Sources
Regulatory Frameworks
To Deploy
Self-Hosted
Alerts in, from anything that speaks JSON.
One endpoint, your SIEM's field names rather than ours, batches of up to 200 and deduplication on a key you choose. Observables are pulled out of every alert automatically, defanged text included. No agent to roll out, no ETL project, no connector to wait for.
One indicator, nine opinions, one verdict.
An observable arrives as a value and nothing else. Every source you enable is asked at once, and the answers merge into a single verdict with each source still readable underneath.
Asked in parallel
Every enabled source fires at once rather than in a queue, so the wait is the slowest source, not the sum of all of them.
Routed by type
A grid decides who answers for addresses, domains, hashes and the rest, with on-demand and automatic as separate switches so a rate-limited key stays useful.
Or your own source
Any REST API returning JSON: a URL template, an auth header and a few JSON paths. No code, no rebuild, no waiting on a vendor roadmap.
From alert to resolution, in five stages.
Ingest
One endpoint. Your SIEM's field names, not ours. Deduplicated on a key you choose, enriched before an analyst ever opens it.
Triage
Every alert arrives with its enrichment verdict already attached. Decide, then escalate or close with a reason that is recorded rather than implied.
Investigate
Cases with templated tasks, SLA deadlines, a shared timeline, hashed evidence and correlation across every past investigation. Recurring observables link themselves, and duplicate cases merge into one.
Respond
A named incident commander, the NIST phases, and the DORA, NIS2 or GDPR clock started automatically the moment the incident is declared.
Close & review
A PDF dossier, a scored post-incident review, and action items with a due date. Hot review at five days, cold at 180.
Playbooks for the repetitive part.
Draw the steps once, let them run on every alert, case or incident that matches. Analysts keep the decisions; the playbook does the copy-paste.
Visual playbook editor
HTTP, condition, transform and delay nodes, triggered manually or by an alert, case, incident or webhook, with a run history for every execution.
Notifications where you work
Slack, Discord, Microsoft Teams or any endpoint, with HMAC-SHA256 signatures, retries, delivery logs and filters by severity or text.
Safe by default
Playbook HTTP nodes refuse private and internal destinations, redirects included, and every run is capped at ten minutes.
The clock starts when the incident does.
Assign a framework to an incident and every notification it requires is created with its deadline already calculated. Overdue ones surface on the dashboard instead of in someone's memory.
Registers you can export
The DORA ICT incident register and the GDPR violations register, as JSON or CSV, with classification, costs and notification history intact.
Numbers for the board
MTTD, MTTR, noisiest sources and an append-only audit trail. Live dashboards instead of a spreadsheet rebuilt every quarter.
Reviews that close the loop
Each NIST phase scored, action items carrying the change request that implemented them. The report writes itself at closure.
Risk register
Likelihood and impact on a 1–5 scale, an owner and a treatment plan, with every risk linked to the incidents that realized it.
Plans ready before the call
Versioned response plans with review dates and overdue flags, a knowledge base of draft and published articles, and an emergency contact list.
TLP and chain of custody
TLP on incidents, cases and observables, optionally enforced. Evidence hashed in SHA-256 and MD5 at upload, with an audit trail per item.
Coverage you can defend in a meeting.
Tag cases with techniques and Mlab IR builds a heat-map across the matrix — every cell tells you how many cases hit it, and when. Detection gaps stop being an opinion and become a coordinate.
SOAR features, without the SOAR price tag.
Enterprise SOAR vendors charge six figures. Spreadsheets cost zero but lose every thread. Mlab IR sits between — a proper platform you actually own.
Runs entirely on your servers. The only call that is always on is an hourly license check carrying the license key, instance ID, version and hostname. Enrichment lookups and webhooks go only where you configure them, and no alert, case or evidence content ever leaves your network.
docker compose up and you are done. No agents, no ETL, no consulting hours to book. 2 GB of RAM is enough to start. Bring your own MySQL and ClickHouse if you prefer.
A REST API with an OpenAPI spec, exports as CSV, JSON, JSONL or Markdown, PDF case reports. Take your data out any time, with no exit fee and no migration tool to buy.
3 users, 10 alerts a month, 5 cases and 50 observables, forever. The whole platform is there — Lite (€99/mo) and Company (€299/mo) only raise the caps and support level, and upgrading is a license change with no reinstall.
Up to 7 days at a time without outbound HTTPS, on the last signed license. Beyond that the instance locks until the license check succeeds again. Air-gapped deployments are a conversation, not a checkbox.
Password plus a second factor, TOTP or a WebAuthn passkey, server-side sessions, twelve granular permissions, scoped API keys and a switch to force enrollment across a whole workspace.
Ready to fix your incident workflow?
Free tier included, no credit card, up and running in under five minutes.