Detection as Code: A Pipeline That Won’t Flood Your SOC
21 September 2026
Learn detection as code with a four-stage pipeline to validate, translate, test, and deploy Sigma rules, plus the mistakes that sink SOC migrations.
Blog Articles
The Kraven Security blog is the ultimate resource for free content on cyber threat intelligence, threat hunting, and custom tooling. We publish new articles every week with tips, advice, and guided tutorials. Don’t miss a thing. Sign up to subscribe on Substack to get notified of all updates!
Lazarus Group: The Complete Guide to North Korea’s Billion-Dollar Hacking Machine
7 September 2026
Discover how the Lazarus Group became the world’s most successful cybercrime syndicate, and the detection gaps most security teams still miss.
Sigma Rules Explained: Architecture, pySigma, Modifiers, & Correlation
24 August 2026
Learn how Sigma rules, modifiers, and pySigma power platform-agnostic detection engineering and threat hunting, plus the pitfalls tutorials skip.
How to Detect North Korean Remote Workers Hiding Inside Your Company
10 August 2026
North Korean remote workers pass interviews, then extort you. Learn the DPRK remote IT worker hiring pipeline, TTPs, and seven detection opportunities.
CTI For SMB: When Your Small Business Is Actually Ready For Threat Intelligence
27 July 2026
Learn when your business is ready for CTI for SMB, which controls come first, and a 60-day roadmap to run threat intelligence on a real budget.
Why Your CTI Analyst Career Is Stuck (It’s Not a Skills Problem)
29 June 2026
Most people think breaking into cyber threat intelligence (CTI) is a skills problem. It is not. It is a signal problem. I came up through
Volt Typhoon: Hunting the Ghost Already Living in Your Network
15 June 2026
Volt Typhoon hides inside your own tools and waits. Learn how this Chinese APT pre-positions in critical infrastructure and how to hunt it in your network.
CTI for SMB: How Small Businesses Can Operationalize Threat Intelligence for Free
1 June 2026
Learn how to build a threat intelligence program for your SMB using free tools like OTX and MISP. Get actionable CTI for SMBs this afternoon.
Detection Engineering in 2026: The Complete Lifecycle (Sigma, YARA, DaC & AI)
19 May 2026
Detection engineering is more than writing SIEM rules. Learn the 6-phase lifecycle, the detection-as-code model, and why identity is the new battlefield.
The Best CTI Certification Path: 4 Certs to Land Your First Threat Intelligence Role
4 May 2026
Cut through the noise. Discover the four CTI certifications that actually get you hired, in the right order, without wasting time or money.
MCP Servers for CTI in 2026: The Tools, the Risks, and What Comes Next
20 April 2026
How MCP servers are transforming CTI workflows in 2026, which tools are worth your time, and how to secure the new attack surface they create.
Threat Profile: Scattered Spider
7 April 2026
One phone call brought down M&S and cost £300M. Here’s who Scattered Spider is, how they operate, and the controls that stop them.
Data vs Information vs Intelligence: A CTI Analyst’s Guide to Communicating What Matters
23 March 2026
Learn the difference between data, information, and intelligence. Discover how CTI analysts can brief stakeholders in language that drives action.
The F3EAD Intelligence Loop Explained: A Complete Guide 2026
9 March 2026
Discover how to use the F3EAD intelligence loop to enhance your cyber threat intelligence processes and produce actionable insights in this complete guide.
From IT to SOC to CTI Analyst: The 3-Stage Career Roadmap and Mindset Shifts
23 February 2026
Want to become a CTI analyst? This guide maps the 3-stage pathway from IT support to SOC to cyber threat intelligence. Start your journey here.