Panning For Gold: Sifting Through Network Logs to Write a New Tag

This GreyNoise blog post explains how the team uses an internal tool called Sift to sift through sensor logs, flag unusual HTTP payloads, and research them to identify and tag both well-known and obscure vulnerabilities (e.g., CVE-2006-2529), outlining the process from initial detection to validation and final tag creation rather than detailing a specific incident.