Glossary
Terms used across mlab IR.
Alert
The atomic unit of ingestion. Comes from a security tool, has a source, severity, observables and a raw payload. Lives in the triage queue until dismissed or escalated.
Case
A structured investigation. Created by escalating one or more alerts. Holds the timeline, observables, evidence, comments, ATT&CK mapping and resolution.
Observable
An indicator of compromise (IOC): an IP, domain, hash, URL, email address, user account, registry key, etc. Tracked across alerts and cases, with cross-case correlation surfaced automatically.
Suppression rule
A rule that prevents alerts matching a pattern from reaching the triage queue. Scoped globally or per source. Time-bound - reviewed when the expiry hits.
Triage queue
The analyst's main inbox. Saved filters and bulk actions live here. The platform's job is to keep this shallow.
Verdict
The final classification of a resolved case: true positive, false positive, benign, or duplicate. Drives metrics and feeds the suppression-rule suggestions.
SLA
Service-level agreement. Per-severity targets for acknowledge / triage / resolve times. Breaches generate timeline events and (if configured) webhooks.
Timeline
An immutable, append-only log of everything that happens to an alert or case. Status transitions, comments, evidence, mentions, observable additions, ATT&CK tags.
Evidence
Files attached to a case: screenshots, PCAPs, log exports. Stored on your uploads volume, never on a third-party.
MITRE ATT&CK
The community knowledge base of adversary tactics, techniques and procedures. ir.mlab.sh lets you tag cases with techniques and view your coverage as a heat-map.
RBAC
Role-based access control. Admin, Analyst, Viewer plus custom roles. Permissions can be scoped per case for sensitive investigations.
Webhook
Outbound HTTP POST fired on case state transitions. Used to integrate with ticketing, chat, runbooks. Signed with HMAC-SHA256; retried with exponential backoff up to 24 h.
Grace period
The 48-hour window during which a cached license keeps the instance running if mlab.sh is unreachable. See Licensing.
MTTA / MTTR
Mean Time To Acknowledge / Mean Time To Resolve. Built-in dashboard metrics, sliced by source, severity and analyst.