ManageEngine Threat Analysis Lab (METAL)
Original threat research, adversary analysis, and detection ready intelligence from ManageEngine's own telemetry.
Explore latest threat research
What is METAL (ManageEngine Threat Analysis Lab)?
METAL is ManageEngine's Threat Analysis Lab, a team of cybersecurity experts, threat hunters, and malware research analysts tracking threats in the wild and turning what they find into intelligence that helps defenders.
METAL investigates malware, adversary tradecraft, attack techniques, and campaign infrastructure observed in active intrusions. Every finding is worked end to end: from initial discovery through analysis, reconstruction, and detection engineering, so the intelligence that reaches defenders is complete rather than fragmentary.
Findings are published as technical reports that include kill chain reconstructions, IOCs, and detection logic. METAL publications are written for security analysts, threat intelligence teams, and detection engineers, and are structured to be operationally useful: readable end to end, actionable at the IOC and detection level, and grounded in evidence a practitioner can verify.
METAL's mission
Turn real-world threat research into intelligence the security community can use and defenses ManageEngine customers can rely on.
Discover
Uncover real-world threats through ManageEngine's telemetry, honeypots, sandbox environments, external threat intelligence, and researcher-driven threat hunting.
Analyze
Investigate malware, adversary behavior, attack techniques, vulnerabilities, and campaign infrastructure to understand how threats operate and evolve.
Publish
Share original threat research, coordinated vulnerability disclosures, and open detection content, including Sigma and YARA rules, hunting queries, and IOC packs in formats such as STIX 2.1.
Operationalize
Turn research findings into detection content that strengthens threat detection across ManageEngine's security products.