Your alerts deserve
a real workflow.
Mlab IR turns scattered security alerts into structured investigations — enriched by nine intelligence sources and closed with the regulatory notification already filed. All on your own infrastructure.
Enrichment Sources
Regulatory Frameworks
To Deploy
Self-Hosted
Alerts in, from anything that speaks JSON.
One endpoint, your SIEM's field names rather than ours, and deduplication on a key you choose. No agent to roll out, no ETL project, no connector to wait for.
One indicator, nine opinions, one verdict.
An observable arrives as a value and nothing else. Every source you enable is asked at once, and the answers merge into a single verdict with each source still readable underneath.
Asked in parallel
Every enabled source fires at once rather than in a queue, so the wait is the slowest source, not the sum of all of them.
Routed by type
A grid decides who answers for addresses, domains, hashes and the rest, with on-demand and automatic as separate switches so a rate-limited key stays useful.
Or your own source
Any REST API returning JSON: a URL template, an auth header and a few JSON paths. No code, no rebuild, no waiting on a vendor roadmap.
From alert to resolution, in five stages.
Ingest
One endpoint. Your SIEM's field names, not ours. Deduplicated on a key you choose, enriched before an analyst ever opens it.
Triage
Every alert arrives with its enrichment verdict already attached. Decide, then escalate or close with a reason that is recorded rather than implied.
Investigate
Cases with tasks, a shared timeline, hashed evidence and correlation across every past investigation. Recurring observables link themselves.
Respond
A named incident commander, the NIST phases, and the DORA, NIS2 or GDPR clock started automatically the moment the incident is declared.
Close & review
A PDF dossier, a scored post-incident review, and action items with a due date. Hot review at five days, cold at 180.
The clock starts when the incident does.
Assign a framework to an incident and every notification it requires is created with its deadline already calculated. Overdue ones surface on the dashboard instead of in someone's memory.
Registers you can export
The DORA ICT incident register and the GDPR violations register, as JSON or CSV, with classification, costs and notification history intact.
Numbers for the board
MTTD, MTTR, noisiest sources and an append-only audit trail. Live dashboards instead of a spreadsheet rebuilt every quarter.
Reviews that close the loop
Each NIST phase scored, action items carrying the change request that implemented them. The report writes itself at closure.
Coverage you can defend in a meeting.
Tag cases with techniques and Mlab IR builds a heat-map across the matrix — every cell tells you how many cases hit it, and when. Detection gaps stop being an opinion and become a coordinate.
SOAR features, without the SOAR price tag.
Enterprise SOAR vendors charge six figures. Spreadsheets cost zero but lose every thread. Mlab IR sits between — a proper platform you actually own.
Runs entirely on your servers. The only call that is always on is an hourly license HMAC carrying the tier, a timestamp and a nonce. No alert, case, observable or evidence ever leaves your network.
docker compose up and you are done. No agents, no ETL, no consulting hours to book. Bring your own MySQL and ClickHouse if you prefer.
A REST API for everything, exports as CSV, JSON, JSONL or Markdown. Take your data out any time, with no exit fee and no migration tool to buy.
3 users, 10 alerts a month, 5 cases and 50 observables. The whole platform is there — only the monthly caps differ, and upgrading is a licence change with no reinstall.
Up to 48 hours at a time without outbound HTTPS. Beyond that the instance locks until the licence check succeeds again. Air-gapped deployments are a conversation, not a checkbox.
Password plus a second factor, TOTP or a WebAuthn passkey, with server-side sessions and a switch to force enrolment across a whole workspace.
Ready to fix your incident workflow?
Free tier included, no credit card, up and running in under five minutes.