Attack path and the entity graph

Two views show alerts as connected rather than one by one. Attack Path reconstructs attacks that are happening. Entity Graph maps how hosts, users, addresses and alerts relate.

Attack Path

Which alerts are one attack

Two alerts belong to the same attack only when they share something concrete — a host, a user, an IP address, a domain or a file hash — and happened within 24 hours of each other on it. Putting alerts into one investigation also joins them, whenever they happened: that is an analyst saying they are one story.

What does not join alerts:

• a MITRE technique in common — a technique is a classification, not something two events share;
• placeholder values such as unknown, built-in accounts, and values the tenant has marked as known good.

An attack needs at least two distinct detections. A single detection is shown only if something corroborates it: an investigation already holds it, two or more MITRE techniques map to it, or it touches two or more assets.

What an attack shows

Part	What it is
Stages	One per distinct detection, in the order they were first seen. A rule firing ten times is one stage, ×10.
Links between stages	Each stage is joined to the latest earlier stage it shares something with, and the link names it (host WIN-07, ip 203.0.113.5). Nothing is drawn as a cause that was not observed.
Tactics	Each stage placed on the MITRE ATT&CK tactic its techniques belong to
Choke points	The hosts, users, addresses and files the most stages pass through, and what containing each would cut
Addresses to block	External addresses the findings name as indicators — never one of your own assets, never a private, loopback or known-good address
Investigations	Open investigations that already hold any of its alerts, so nobody opens a second one

An attack stays active while any of its alerts is open, being triaged, confirmed, under investigation or escalated.

Business Impact Score

Each attack gets one score from 0 to 100, with every input shown beside it:

score = min(100, peak alert risk × 0.5  +  min(entities involved, 10) × 4  +  asset bonus)

The asset bonus comes from the criticality of the asset under attack, set on the asset from 1 to 5: 0, 5, 10, 15 or 20 points.

Entity Graph

The graph draws every host, user, address, indicator and alert of the last 30 days, with risk carried along the connections: a host linked to a critical alert is itself at risk.

Action	Does
Search Around	Lists an entity’s connections, grouped by type
Find Path	Pick two entities; the graph shows how they connect
Blast Radius	What an entity reaches, the risk across it, and what to contain first
Auto-Investigation	For a selected entity: its blast radius and the most likely attack path through it
Layers	Hide or show each kind of entity

The Choke Points and Hubs panels list the entities with the most connections — fix one and several paths break.

Note

Both views are built only from alerts the platform raised. When there is nothing to connect, they are empty; nothing is drawn from sample data.